Getting ready to install Logbinder EX and have a couple questions


Getting ready to install Logbinder EX and have a couple questions

Will

I watched all your recorded Webinars I could find on LogBinder EX and according to them we need to run the PowerShell commands to enable Auditing on mailboxes before we install LogBinder.
These commands look something like:  Get-Mailbox -OrganizationalUnit "Users" | Set-Mailbox -AuditDelegate Delegate, Copy, Create, Folderbind, etc. .....
Now once you have done this and have LogBinder up and running you can set a Default Audit Policy. If you make changes to the default Audit Policy in LogBinder does that override the commands that you initially ran?

It is my understanding that LogBinder pulls these audit logs out of the mailboxes and emails them to the service account that is running LogBinder with an XML attachment and then LogBinder reads that XML file attachment and parses it out to what ever log format you have chosen in the Output correct?

A couple of your webinars stated there was a 24hr search delay, has that been fixed in the latest version yet. When I downloaded LogBinder EX I got version 3.4.26.0.



bjvista

Will - 8/22/2018
I watched all your recorded Webinars I could find on LogBinder EX and according to them we need to run the PowerShell commands to enable Auditing on mailboxes before we install LogBinder.
These commands look something like:  Get-Mailbox -OrganizationalUnit "Users" | Set-Mailbox -AuditDelegate Delegate, Copy, Create, Folderbind, etc. .....
Now once you have done this and have LogBinder up and running you can set a Default Audit Policy. If you make changes to the default Audit Policy in LogBinder does that override the commands that you initially ran?

It is my understanding that LogBinder pulls these audit logs out of the mailboxes and emails them to the service account that is running LogBinder with an XML attachment and then LogBinder reads that XML file attachment and parses it out to what ever log format you have chosen in the Output correct?

A couple of your webinars stated there was a 24hr search delay, has that been fixed in the latest version yet. When I downloaded LogBinder EX I got version 3.4.26.0.



Will,
Good questions.
1. You can enable the auditing manually if you want but LOGbinder for Exchange has a built-in audit policy wizard.  Using this you can configure your Exchange auditing using OU's and Groups in AD.  Any changes you make in the wizard will override any auditing you have configured manually.  For example, if you use PowerShell to configure mailbox auditing on userXYZ and also use the wizard to configure auditing on groupXYZ and that user is in the group, then his audit policy would be updated.  The Getting Started Guide has information that I think will explain it better for you. 

2. LOGbinder doesn't pull the audit logs.  It sends search requests for time spans of audit data.  These search requests are submitted to Exchange.  Exchange processes the audit data from the mailboxes and then emails them to the mailbox of the specified service account (using service accounts mailbox is the recommended best practice). LOGbinder for Exchange then reads the XML and outputs the data.  So you were almost right except that LOGbinder isn't pulling the audit logs, Exchange is doing that.

3. The 24hr search delay is still there.  You don't have to enable it but it is recommended due to a bug in Exchange.  Microsoft hasn't addressed the issue (last time we checked and tested) so we had to add the optional but recommended delay as an option.  Read more about it here: 24hr bug
Will

bjvista - 8/22/2018
Will - 8/22/2018
I watched all your recorded Webinars I could find on LogBinder EX and according to them we need to run the PowerShell commands to enable Auditing on mailboxes before we install LogBinder.
These commands look something like:  Get-Mailbox -OrganizationalUnit "Users" | Set-Mailbox -AuditDelegate Delegate, Copy, Create, Folderbind, etc. .....
Now once you have done this and have LogBinder up and running you can set a Default Audit Policy. If you make changes to the default Audit Policy in LogBinder does that override the commands that you initially ran?

It is my understanding that LogBinder pulls these audit logs out of the mailboxes and emails them to the service account that is running LogBinder with an XML attachment and then LogBinder reads that XML file attachment and parses it out to what ever log format you have chosen in the Output correct?

A couple of your webinars stated there was a 24hr search delay, has that been fixed in the latest version yet. When I downloaded LogBinder EX I got version 3.4.26.0.



Will,
Good questions.
1. You can enable the auditing manually if you want but LOGbinder for Exchange has a built-in audit policy wizard.  Using this you can configure your Exchange auditing using OU's and Groups in AD.  Any changes you make in the wizard will override any auditing you have configured manually.  For example, if you use PowerShell to configure mailbox auditing on userXYZ and also use the wizard to configure auditing on groupXYZ and that user is in the group, then his audit policy would be updated.  The Getting Started Guide has information that I think will explain it better for you. 

2. LOGbinder doesn't pull the audit logs.  It sends search requests for time spans of audit data.  These search requests are submitted to Exchange.  Exchange processes the audit data from the mailboxes and then emails them to the mailbox of the specified service account (using service accounts mailbox is the recommended best practice). LOGbinder for Exchange then reads the XML and outputs the data.  So you were almost right except that LOGbinder isn't pulling the audit logs, Exchange is doing that.

3. The 24hr search delay is still there.  You don't have to enable it but it is recommended due to a bug in Exchange.  Microsoft hasn't addressed the issue (last time we checked and tested) so we had to add the optional but recommended delay as an option.  Read more about it here: 24hr bug

Thanks for the answers. This info will get me headed in the right direction.

GO


Similar Topics


Reading This Topic


Login
Existing Account
Email Address:


Password:


Select a Forum....








LOGbinder Forum


Search