ActiveSync

This page provides insight into the usage of the ActiveSync client access method.

The page has panels that chronicle the service's top users by email and device ID. All of these panels sort by count by default, however, you can change the sorting by clicking a header in any of the panels.

Also included are panels that list the top device types and sync events over time (in events per minute). Another set of panels documents remote device wipes and user-initiated device wipe requests.

By default, the time period for all of these panels is the last 24 hours. You can change this by editing the dashboard, however.

The page uses Internet Information Server (IIS) logs to produce the events it displays.

How to use this page

• To find out more about an ActiveSync top user, click on that user in the "Top Users" or "Top Users by Device ID" list. The Splunk App for Microsoft Exchange loads the "User Behavior Overview" page and filters results to the specified user.
• If you click on an entry in the "Top Devices", "Remote Device Wipes", or "User-initiated Device Wipe Requests" panels, the Splunk App for Microsoft Exchange brings up the base search that produced the selected operating system or browser, as well as any events which contain the OS or browser.
• If you click on a node in the "Sync Events over Time" line chart, the Splunk App for Microsoft Exchange brings up the base search that produced the events at that point in time, along with the events that occurred at that point.