Hi All, Does anyone know how to monitor logins and logon attempts with Outlook Web Access 2007 running on SBS 2008? Thanks

Do they show up in your IIS logs?

Hi, Thanks for your reply and time. Logging is enabled within IIS on the default website...and this does flow through down to Exchange. I checked the logs and I can see the files. Maybe the next question is, do you know of any good programs that can decrypt / decipher these log files? We used to run SBS 2003, and it was much simpler to view the logins, I am not sure why MS changed it? Thanks again

MS Log Parser 2.2http://www.iis.net/downloads/default.aspx?tabid=34&g=6&i=1287

System Center Operations Manager is MS monitoring product but it's sort of heavy for this sort of thing. Maybe look at nagios for simple ping check on the box. Also possibly doing SNMP. Mark Morowczynski|MCT| MCSE 2003:Messaging, Security|MCITP:EMA 2K7,EDA Win 7,ES,SA,EA|MCTS:Windows Mobile Admin|Security+|http://almostdailytech.com

Any other solutions?

MOM does sound kinda heavy, and if I am not mistaken there is a charge to use this? I was looking at Nagios before, and I ended up going with Spicworks, just no plugins for any type of log filing viewing. I am open to other log viewers...I just need to ensure that no one is attempting to 'hack' into the site. Thanks

How "real time" does the monitoring and alerting need to be? If it doesn't have to be real-time, you can script the log analysis and notification, and run that as a periodic schedulet task.

I was thinking once a day would suffice...we do not receive that much attraction. How would I script this?

I'd use Powershell. You might want to use something else. Basically you'd just identify what you'd consider suspicious events, and have the script read throgh the last 24 hours worth of logs looking for those events, and send you an email if it finds them. Then schedule it to run once a day.

I am not overly familiar with powershell...any examples?

I can give you an example of PS code if you can give me an example of a log entry that you want alerted on.

Great, thanks....I would need a script to monitor successful mailbox logins and failed mailbox logins for users...and if possible, for attempted logins on mailboxes that do not exist? If you need more, please let me know.

This is going to be text parsing. I'd need to know exactly what the log entries look like, and what it is you want to do with them, depending on what the content is.

Hi mjolinor.... Thanks for all of your help....I ended up coming across Lizard Labs GUI for LogParser 2.2. This has taken care of my needs, and makes it a little more user friendly, and not to mention, easier to read. Thanks again.

Hi,You can refer the article below to use IIS praser to analyze the IIS log:Using the Logparser Utility to Analyze Exchange/IIS Logshttp://www.msexchange.org/tutorials/Using-Logparser-Utility-Analyze-ExchangeIIS-Logs.html