Exchange Server 2019 Security related logs

System Admin - Exch 60

Hello, For monitoring purpose we required the location of Security related logs in Exchange 2019 Server. All logs location that related to security. Thanks

Adrian Stadelmann 0 Reputation points

2024-04-22T08:35:05.18+00:00

Hi

Have a look at the Azure Sentinel Solution they give you a good hint:

Exchange HTTP Proxy:

C:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy\Autodiscover*.log, C:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy\Eas*.log,

C:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy\Ecp*.log,

C:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy\Ews*.log,

C:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy\Mapi*.log,

C:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy\Oab*.log,

C:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy\Owa*.log,

C:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy\OwaCalendar*.log,

C:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy\PowerShell*.log

C:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy\RpcHttp*.log

C:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy\HttpProxy*.LOG'

Exchange Message Tracking:

C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\MessageTracking*.log

Exchange IIS Log File:

C:\inetpub\logs\Logfiles\W3SVC1

System and Application Log Exchange Servers

Windows event log and search Application

Windows event log and enter MS Exchange Management as log name.

1 answer

Kael Yao-MSFT 37,496 Reputation points Microsoft Vendor

2024-02-27T01:22:20.8566667+00:00

Hi System Admin - Exch

Can you share some more information on "security related logs"?

As to me, there aren't specific "security related logs" in Exchange.

For example, if you are looking for sign-in failure attempts, you can check Event Viewer>Windows logs>Security for event 4625, or check IIS logs for the sign-in request.

IIS log location: C:\inetpub\logs\LogFiles\W3SVC1

If you are looking for admin audit log or mailbox audit log, you can refer to below links:

How to use administrator audit logging in Exchange Server

Mailbox audit logging in Exchange Server

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
Kael Yao-MSFT 37,496 Reputation points Microsoft Vendor

2024-03-01T01:55:30.13+00:00

Hi @System Admin - Exch

I am writing here to confirm with you how thing going now?

Please let us know if you would like further assistance.
Sign in to comment