I went over your documentation on LogBinder for Exchange with our Exchange Admin and he now says everything is setup as far as permissions so that Logbinder can collect Exchange logs according to your documentation. I go in to the console and set up the connection to exchange and it connects. (At least I can get a mailbox count). I then setup the Audit Policy and then select from AD Groups who to monitor and then try starting the service and I get an error. I changed log level to one and tried again and got the same error which I am attaching to this post. Could I get some help with setting up LogBinder?

When LOGbinder is first started, it needs to create some event sources, so it can send status messages to the Application log in Event Viewer as well as optionally outputs to the custom LOGbinder event log. Creating event sources requires elevated privileges. Please try starting LOGbinder with the 'Run as administrator' option.

Thanks, I think it is running now. When I configured the Generic Syslog in the output it I had an option to test it. When I clicked on the test it stated to check where the log file was written to. Where is that? I have checked the Program file, Windows Sys32 folder and even the Windows Sys32 WinEvnt folder but don't know exactly what I am looking for.

There are two options for Syslog-Generic outputs:

• Syslog-Generic: a Syslog server using the generic Syslog format.
  
• This outputs through UDP using the specified IP address and port number.
  
• Syslog-Generic (File): a Syslog file using the generic Syslog format.
• This outputs to Syslog files in the "C:\ProgramData\LOGbinder EX" folder or the "Alternate Output Data Folder" if specified in the options.

Thanks, looks like I am getting some logs now. With the 24hr delay it looks like most of them are just LogBinder Setting the Audit policy. I will continue to monitor. You can close this issue for now.