Log SMTP Relays?

[AdminStooge]

Is there a way to log when a relay is added or removed?

Thanks

 

[Xanaxo]

Not sure exactly what you are shooting for, but there are many ways to log SMTP traffic.

You can start with SMTP protocol logging and the SMTP virtual server's Extended logging.

On the properties of the server in the ESM there is a "Diagnostics Logging" tab. Click on it and you will see a "MSExchangeTransport" logging section. From here you should be able to find the "SMTP Protocol" logging. This will log events to your application log. Make sure it is large enough to accomidate the additional logs.

My favorite is the SMTP VS Extended logging. Drill down in the ESM under your server object | protocols | SMTP and you should see an Default Virtual Server. Bring up the properties of this object and you will see a check box at the bottom of the window to enable logging. I use the W3C format and choose my own location and schedule. This should effectivly log everything the virtual server does.

To take it to another level, you can always run a Netmon capture. With this capture, in conjunction to the other logging, you can determine Exactly what is happening during the SMTP sessions.

Good Luck

Steven Parent [MSFT]

 

[AdminStooge]

I would like to know when an admin adds or remove an IP within the relay. For example, if the user jsmith is logged in to a box either at the console or through remote desktop and adds an IP to the SMTP relay (1.1.1.1) then its captured in a log file.

Is something like this possible?

 

[Xanaxo]

Now that would be a different type of logging. That would be object based auditing. You will have enable that on a domain policy and then select the object that you want to audit in the AD. This is as good as it gets.

314955 HOW TO: Audit Active Directory Objects in Windows 2000

http://support.microsoft.com/?id=314955

Steven Parent [MSFT]