Team,

I am trying to do search audit log of a single id while runing the command during output. The command gets failed. Attach is the errror message screen shot.

Please help me to know what are the synatx and command need to run for  auditing and export audit logs to meet the compliance requirement in my organizastion at present i am runing Exchange 2013 sp1.

• Edited by Raritan Saturday, January 24, 2015 9:01 AM

Hi Niko,

I try above suggetion but no luck. Attach is the screen shot of error message please suggest.

• Edited by Raritan Tuesday, January 27, 2015 10:03 AM more comments

MS is working for the fixup we had escalated to L3 engineer. Look something really wiered and strange issue.

After increasing the CPU issue is fix up. Below mention are the users on which we were trying search-mailbox audit log command and it was generating error message. Today to cross verify we had try the command on below mention users and few other users as well. It was working fine

Solution from MS to implement.

The cmdlet is creating a search folder inside the exadmin mailbox and while applying the search restriction and updating the view, it had a one minute timeout.

If the Search is operation slow on the server and if the server is experiencing any resource bottleneck, it is possible that we see timeout errors during search folder creation.

 

Test-Exchangesearch always returns the result in 30msec. Time it took is not great when compared with standards, we expect a search response in 10 -20 msec.

 

While we were collecting logs, we noticed that the CPU on Exmail01 and 02 were close to 70% all the time. At this time it is ok, but if there is burst in the user load the server will run out of CPU cycles easily.

My recommendation is add more processing power to the server, may be double what you have now.

 

But for now, we shall increase the EWS search timeout setting and see if it helps.

 

Edit file - C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\exchweb\ews\web.config using notepad.

Under   <appSettings> section, add the below line to increase the timeout to 5 minutes. (Type the below line manually, do not copy paste from this email)

 

<add key="SearchTimeoutInMilliseconds" value="300000" />

 

Save the file, and do a IISreset before you test the search cmdlet again.

 

Please let me know if you have any questions on the analysis or for any assistance.