Hi I have run Set-Mailbox ian.shapton -AuditOwner Update, Move, MoveToDeletedItems, SoftDelete, HardDelete

I then created and deleted an email and ran Search-MailboxAuditLog -Identity "ian shapton" -LogonTypes Owner -StartDate "12/21/2014 12:00" -EndDate "12/21/2014 13:00" -ShowDetails

I see An error occurred while trying to access the audit log. For more details, see the inner exception.
    + CategoryInfo          : NotSpecified: (:) [Search-MailboxAuditLog], AuditLogException
    + FullyQualifiedErrorId : [Server=Mailbox01,RequestId=07f17915-f25d-4fd5-b23e-f07a2482f4a4,TimeStamp=21/12/2014 16:45:39] [FailureCategory=Cmdlet-AuditLogException] 255D6156,Microsoft.Exchange.Management.SystemConfigurationTasks.SearchMailboxAuditLog

MSExchange CmdletLogs shows Microsoft.Exchange.Data.ApplicationLogic.AuditLogServiceException: The Exchange Web Service returned an error while trying to access the audit log. Reason: 'Error','ErrorTimeoutExpired','The search operation could not be completed within the allotted time limit. Please try to narrow down your scope to reduce the result set.'.

I am a Recipient Admin and Org Admin and can search other mailboxes using -LogonTypes Delegate

Any idea what I am missing

Hi,

To use the Search-MailboxAuditLog cmdlet, we must be assigned to be a member of Records Management and Organization Management.

Please use the following cmdlet to add your account to Records Management to check this issue:

Add-RoleGroupMember "Records Management" -Member Name

If there are any further issue, please let me know.

Best Regards.

Thanks, I am a member of both admin roles and still receive the error

I was able to search this mailbox last week and I am able to search other mailboxes

I cant even search for a single minute timespan. I turned Audit logging off for the mailbox and then turned it back on - does this clear the log? But i still get the error

Microsoft.Exchange.Data.ApplicationLogic.AuditLogServiceException: The Exchange Web Service returned an error while trying to access the audit log. Reason: 'Error','ErrorTimeoutExpired','The search operation could not be completed within the allotted time limit. Please try to narrow down your scope to reduce the result set.'.

Could this be down to size as I have enabled logging for AuditOwner?

Hi,

If we turn off Audit logging for one mailbox then turn it back on, it will not clear logs.

If we enabled logging for AuditOwner, it will log more operations for mailbox owner.

And if the search scope is too large, then it will make the search timed out.

Please try the command without parameter ShowDetails

Search-MailboxAuditLog -Identity "ian shapton" -StartDate "12/21/2014 12:00:00" -EndDate "12/21/2014 13:00:00" -LogonTypes Owner

In addition, whats the version of CU in your Exchange?

And please also check if there are any event log in Application logs. Please post them for me to troubleshoot this issue. Thanks for your time and patience.

Best Regards.

Hi ,

Agree with Lynn-Li .Please check the below mentioned error.

Error : The search operation could not be completed within the allotted time limit. Please try to narrow down your scope to reduce the result set.'.

Based on my knowledge , You have to narrow down your scope by removing  -showdetails parameter in the command because for a mailbox owner huge no of logs will be created for every action performed by the himself.

Thanks for the responses. If I remove -ShowDetails I get

A valid LogonType must be specified when ShowDetails is set to false. Valid Logon Types when ShowDetails is false are: Admin,Delegate

I think I need to have -ShowDetails to read the Audit Log for Owner activity

So this just started working and has been for the past few weeks, last Friday I pulled out a log of 9,000 rows.

Over the weekend we performed some Datacentre Switchovers, since then this has stopped working, same error

I need to be able to rely on these logs and don't understand why the command stops working

Hi,

I have the same problem when I run the Search-MailboxAuditLog command.  It has been working for 2 weeks but suddenly after moving databases from one datacenter to another and back again it stopped working.  The account running the command is in all necessary roles needed.

This is what I have tested after it stopped working:
- Search-MailboxAuditLog -Identity "xxxxxxx" -LogonTypes Delegate -StartDate (Get-Date).Adddays(-1) = Works
- Search-MailboxAuditLog -Identity "xxxxxxx" -LogonTypes Delegate -StartDate (Get-Date).Adddays(-1) -showdetails = does not work and comes with an error.

"The Exchange Web Service returned an error while trying to access the audit log. Reason: 'Error','ErrorTimeoutExpired',
'The search operation could not be completed within the allotted time limit. 
Please try to narrow down your scope to reduce the result set.'."

This is very bad for us because we use a lot of shared mailboxes with delegates and want to report delegate action on these mailboxes.

Environment:
- 3 datacenters
- Exchange 2013 CU7

Thorir

Hi,

After opening a case at Microsoft the solution seems to be change config on EWS in the following manner:

• Edit file - C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\exchweb\ews\web.config on all Exchange Servers in Organization
• Under <appSettings> section, add the below line to increase the timeout to 5 minutes.  <add key="SearchTimeoutInMilliseconds" value="300000" />
• IISReset or reboot (what ever fancies)

This at least gave me my reports b