« Previous Next »

Thread: Extract TO: and FROM: with LogParser from SMTP Logs

Last post 10-22-2009 10:00 AM by qbernard. 6 replies.

Average Rating Rate It (5)

RSS

Page 1 of 1 (7 items)

Sort Posts:

  • 10-14-2009, 6:08 AM

    • FITEC
    • Not Ranked
    • Joined on 10-14-2009, 10:05 AM
    • Posts 4

    Extract TO: and FROM: with LogParser from SMTP Logs

    our goal is to get a CSV which contains all email-addresses sent/received from a specific exchange mailbox. can this be accomplished with LogParser?

  • 10-15-2009, 10:14 PM In reply to

    Re: Extract TO: and FROM: with LogParser from SMTP Logs

    Yes, what format is the exchange logfile in? W3C? If I remember correctly exchange 2000+ was supposed to default to W3C but I don't know for sure if that is true.

    Check out my blog for other cool tips and tricks:

    http://joelangley.blogspot.com/
  • 10-17-2009, 3:32 AM In reply to

    • FITEC
    • Not Ranked
    • Joined on 10-14-2009, 10:05 AM
    • Posts 4

    Re: Extract TO: and FROM: with LogParser from SMTP Logs

    Dear Joe,

    it's some kind of W3C (Log-type: SMTP Send Protocol Log):

    #Software: Microsoft Exchange Server
    #Version: 8.0.0.0
    #Log-type: SMTP Send Protocol Log
    #Date: 2009-10-17T00:07:21.813Z
    #Fields: date-time,connector-id,session-id,sequence-number,local-endpoint,remote-endpoint,event,data,context

  • 10-17-2009, 7:27 PM In reply to

    Re: Extract TO: and FROM: with LogParser from SMTP Logs

     Hmmm...Is that the only log?

    Check out my blog for other cool tips and tricks:

    http://joelangley.blogspot.com/
  • 10-20-2009, 2:10 AM In reply to

    • FITEC
    • Not Ranked
    • Joined on 10-14-2009, 10:05 AM
    • Posts 4

    Re: Extract TO: and FROM: with LogParser from SMTP Logs

    there exists also a "SMTP Send Protocol Log" which is based on the same format and "Message Tracking Logs" with the following fields:

     #Software: Microsoft Exchange Server
    #Version: 8.0.0.0
    #Log-type: Message Tracking Log
    #Date: 2009-09-21T00:02:29.040Z
    #Fields: date-time,client-ip,client-hostname,server-ip,server-hostname,source-context,connector-id,source,event-id,internal-message-id,message-id,recipient-address,recipient-status,total-bytes,recipient-count,related-recipient-address,reference,message-subject,sender-address,return-path,message-info

  • 10-22-2009, 6:40 AM In reply to

    • FITEC
    • Not Ranked
    • Joined on 10-14-2009, 10:05 AM
    • Posts 4

    Re: Extract TO: and FROM: with LogParser from SMTP Logs

    any ideas what query should be run with LogParser against the SMTP Logs to get only the recipients from a specific sender?

  • 10-22-2009, 10:00 AM In reply to

    Re: Extract TO: and FROM: with LogParser from SMTP Logs

    Just focus on these two fields then. Recipient-Address and Sender-Address. You can also try this site to generate your scripts.
    http://anonymoos.com/logparser.php

    Cheers,
    Bernard Cheah
Page 1 of 1 (7 items)
Microsoft Communities