LOGbinder for EX not recieving emails from Exchange 2010

Home
»
LOGbinder Forums
»
LOGbinder for Exchange
»
LOGbinder for EX not recieving emails from Exchange 2010

LOGbinder for EX not recieving emails from Exchange 2010

Muhammad ObaidurRehman

Muhammad ObaidurRehman Posted 2 Years Ago

#861

We are testing the trial version of LOGbinder and are facing few problem fetching the logs into LOGbinder. We have followed the LOGbinder guides during the installation, configuration and troubleshooting. The issue we are currently facing is that the service account is not receiving any audit related emails from Microsoft Exchange. We have performed the powershell test successfully without any error and the WSDL is also being received from the Exchange URL as per the Referring to the “LogbinderEX Getting Started” guide Appendix D, but no success in getting any emails from Exchange.
The Event Viewer shows the following warning consecutively and the logbinder for EX shows many transactions in the input section but none of these transactions have reached the completed status.

LOGbinder warning
No Response From Exchange – Audit Data Gap
Exchange has not responded to an audit data request in a reasonable time. If Exchange eventually responds with audit data for this request, LOGbinder will process it for up to 30 days. However, this warning indicates that there is currently a gap in audit data.
Request data:
a5a4de23-76a7-4bf6-afd0-1f2f895c81fc
Exchange Admin audit search Initiated: 8/7/2018 4:11:23 PM Start time: 8/7/2018 10:45:56 AM End time: 8/7/2018 10:51:23 AM

As per instructions on forum thread “https://forum.logbinder.com/Topic355-2.aspx”, this issue may be resolved by Enabling the 24 hour delay which we did but still no results.
Another error which appears in the windows security logs after more than 8 hours of logbinder service started, as following,

LOGbinder error
Error when processing events. Details: System.Management.Automation.Runspaces.InvalidRunspaceStateException: Cannot open the runspace because the runspace is not in the BeforeOpen state. Current state of the runspace is 'Broken'.; at System.Management.Automation.RemoteRunspace.AssertIfStateIsBeforeOpen()
at System.Management.Automation.RemoteRunspace.Open() at Mtg.Logbinder.Exchange.ExchangeShellService.Run(SettingsLastExportServer lastExportInfo) in C:\agent\_work\10\s\LogbinderEX\Mtg.Logbinder.Exchange\ExchangeShellService.cs:line 628 at Mtg.Logbinder.Exchange.AuditorExporterServer.runServices() in C:\agent\_work\10\s\LogbinderEX\Mtg.Logbinder.Exchange\AuditorExporterServer.cs:line 379 at Mtg.Logbinder.Exchange.AuditorExporterServer.Export() in C:\agent\_work\10\s\LogbinderEX\Mtg.Logbinder.Exchange\AuditorExporterServer.cs:line 57 at Mtg.Logbinder.Exchange.ExAuditorExporter.Mtg.Logbinder.Base.IAuditorExporter.Export() in C:\agent\_work\10\s\LogbinderEX\Mtg.Logbinder.Exchange\AuditorExporter.cs:line 48 at Mtg.Logbinder.Base.Auditor.Run(AuditorProcessor processor) in C:\agent\_work\10\s\Core\Mtg.Logbinder.Base\Auditor.cs:line 62

Any suggestion or guidance on this issue will be much appreciated.

Tags

Tamas Lengyel

Tamas Lengyel Posted 2 Years Ago

#870

mobaid - 8/9/2018

Any suggestion or guidance on this issue will be much appreciated.

Can you please confirm that you have performed steps 1-6 under Verifying PowerShell Connectivity and Exchange Authority.

Also, are the LOGbinder service account and the recipient set under the input properties the same? (If the recipient account is different from the LOGbinder for Exchange service account, the service account needs to have the necessary permissions to access the recipient's mailbox.)

Muhammad ObaidurRehman

Muhammad ObaidurRehman Posted 2 Years Ago

#874

Tamas Lengyel - 8/10/2018

The steps 1-5 are completed from our end, whereas at step six, we are supposed to receive emails on the specified email address which we are not receiving as of yet. The screenshot of step 1-5 is attached below,

The logbinder service account and the Recipient email is the same. The same account is used for receiving emails from exchange server.
Thank you so much for your support.

Tamas Lengyel

Tamas Lengyel Posted 2 Years Ago

#886

mobaid - 8/10/2018

Tamas Lengyel - 8/10/2018

The logbinder service account and the Recipient email is the same. The same account is used for receiving emails from exchange server.
Thank you so much for your support.

Thank you for the screenshot. This shows that the PowerShell session is established and you manage to create an audit log search request. Now it is up to Exchange to serve that request.

What is the build number of your Exchange 2010 installation?

Get-Command ExSetup | ForEach {$_.FileVersionInfo}

Muhammad ObaidurRehman

Muhammad ObaidurRehman Posted 2 Years Ago

#911

Tamas Lengyel - 8/10/2018

Get-Command ExSetup | ForEach {$_.FileVersionInfo}

Exchange 2010
Build No.: 14.03.0123.003

Tamas Lengyel

Tamas Lengyel Posted 2 Years Ago

#913

mobaid - 8/15/2018

Tamas Lengyel - 8/10/2018

Get-Command ExSetup | ForEach {$_.FileVersionInfo}

Exchange 2010
Build No.: 14.03.0123.003

Thanks. Since the troubleshooting steps didn't conclude outside of LOGbinder, it shows that this is an Exchange issue. Unless Exchange is providing audit log search results, LOGbinder will not be able to operate. Please work with your Exchange admin and possibly with Microsoft to resolve this issue.

A few possible things to check:

Can you do synchronous audit log search instead of the asynchronous? Do you get results?
Use the Search-MailboxAuditLog and Search-AdminAuditLog cmdlets instead of New-MailboxAuditLogSearch and New-AdminAuditLogSearch.
Is there any error message in the MSExchange Management log in Event Viewer after you initiate an audit log search?
You should also check the status of your mailbox databases using the Get-MailboxDatabaseCopyStatus cmdlet to make sure they are in the Healthy state.

Edited
2 Years Ago by Tamas Lengyel

Muhammad ObaidurRehman

Muhammad ObaidurRehman Posted 2 Years Ago

#946

Tamas Lengyel - 8/15/2018

Can you do synchronous audit log search instead of the asynchronous? Do you get results?
Use the Search-MailboxAuditLog and Search-AdminAuditLog cmdlets instead of New-MailboxAuditLogSearch and New-AdminAuditLogSearch.
Is there any error message in the MSExchange Management log in Event Viewer after you initiate an audit log search?
You should also check the status of your mailbox databases using the Get-MailboxDatabaseCopyStatus cmdlet to make sure they are in the Healthy state.

We performed the above mentioned tests but still no result on email. Can you please confirm a few details about the log binder. We have a typical distributed exchange setup with 2 transport servers and 3 mailbox servers. 1 is HA whose address appears by running the command for virtual directory. I need to confirm on which exchange server should we be running the above commands.
I was running the commands on transport as well as the HA server, as shown in the thread I can see the receipt of the request after entering the command but no success.
Please confirm the server on which I should be running the request, the set of ports that I need to open on the firewall and the directionality for the ports. Kindly mention the direction of port opening e.g., "Open port 443 on firewall from logbinder server to exchange server. etc" I need this information for the network team and exchange team to confirm the issue is on there end.

Tamas Lengyel

Tamas Lengyel Posted 2 Years Ago

#949

mobaid - 9/10/2018

Tamas Lengyel - 8/15/2018

Can you do synchronous audit log search instead of the asynchronous? Do you get results?
Use the Search-MailboxAuditLog and Search-AdminAuditLog cmdlets instead of New-MailboxAuditLogSearch and New-AdminAuditLogSearch.
Is there any error message in the MSExchange Management log in Event Viewer after you initiate an audit log search?
You should also check the status of your mailbox databases using the Get-MailboxDatabaseCopyStatus cmdlet to make sure they are in the Healthy state.

From the screenshot in one of your previous posts, you manage to create the PowerShell session to the Exchange server and you are able to issue the audit log search cmdlets. So you seem to be using the correct server and the necessary ports are open.

The rest is handled by Exchange internally. Exchange should now process the request and send the results by email. No communication outside of the Exchange environment is needed for this.

The question is, why you are not receiving any response from Exchange. To help troubleshooting, please verify the results of the three bullet points in my previous post.

Muhammad ObaidurRehman

Muhammad ObaidurRehman Posted 2 Years Ago

#951

Tamas Lengyel - 9/10/2018

[/quote]

I have verified the three bullet points in which i ran a synchronous search and another asynchronous search for audit logs on exchange powershell and the commands executed successfully.
The event viewer also showed the log of cmdlet succeeded.
And the Get-MailboxDatabaseCopyStatus also shows the healthy status for all mailbox databases.

Kindly guide me for any further troubleshooting that i could perform.

Tamas Lengyel

Tamas Lengyel Posted 2 Years Ago

#952

mobaid - 9/12/2018

Tamas Lengyel - 9/10/2018

[/quote]

What version of Exchange 2010 are you using?

Get-Command ExSetup | ForEach {$_.FileVersionInfo}

Reading This Topic