Additional tasks to be performed on Exchange servers

This topic discusses additional steps that you should complete on the Exchange servers in your network in order to prepare the Splunk App for Microsoft Exchange for complete Exchange data analysis.

Note: This topic is a checklist to ensure that the Splunk App for Microsoft Exchange gets the data it needs. You might have already completed these steps.

Additional tasks for servers that run any Exchange server role

Adjust the settings for the PowerShell Event log

The Splunk App for Microsoft Exchange makes extensive use of PowerShell to gather information about Exchange services. We strongly recommend you adjust the settings for the PowerShell Event log on each Exchange server as follows:

1. Open Event Viewer.
2. Right click on Powershell Log and select Properties.
3. Set the maximum size to 10,240 kilobytes (kB).
4. Set Overwrite events as needed under Log size to "When maximum log size is reached".
5. Click OK to close the dialog.
6. Right click on the Windows PowerShell Log and select Properties.
7. Set Overwrite events as needed under Log size to "When maximum log size is reached".
8. Click OK to close the dialog.

If you need long term storage of the logs, we recommend that you index the PowerShell log in Splunk.

Additional tasks for servers that run the Hub and Edge Transport roles

1. Turn on Message Tracking from within Exchange System Manager.
2. If you have installed Microsoft Forefront Security Suite for Exchange 2007 or Exchange 2010, also deploy the TA-Forefront-Security-for-Exchange add-on.
3. If you have moved the message tracking logs, ensure you also update the data input to reflect the new location.

Additional tasks for servers that run the Mailbox Server role

Enable Exchange Administrator audit logging (Exchange 2010 or 2013 only)

If you want to track changes made to Exchange 2010 or 2012 services by Exchange administrators, enable Exchange Administrator audit logging by following the instructions at "Configure Administrator Audit Logging" (http://technet.microsoft.com/en-us/library/dd335109.aspx) on MS TechNet.

Note: Exchange Server 2010 Service Pack 1 and later versions enable administrative audit logging by default.