cancel
Showing results for 
Search instead for 
Did you mean: 

Microsoft Exchange MessageTrackingLogs via McAfee Collector

Hello, I'm trying to collect Microsoft Exchange Message Tracking Logs via McAfee Collector.

As I know these logs are saved in C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\MessageTracking Directory and each log is one line, so there is no need in "event delimeter".

connection established, Collector identifies *.LOG files correctly  but in its Debug.log  output says:

McAfeeEventCollector: DEBUG 1 Start No data to process, sleeping for 300 seconds; Pausing plugin.

So Receiver cannot receive any logs.

Please Help

Thanks

collector.PNGdata_source.PNGnetstat.PNGcollector_log.PNG

17 Replies
xded
Level 12
Report Inappropriate Content
Message 2 of 18

Re: Microsoft Exchange MessageTrackingLogs via McAfee Collector

Hi,

change the Data Format from Default to MEF. This will be help.

Re: Microsoft Exchange MessageTrackingLogs via McAfee Collector

Thanks xded

mcgarl1
Level 9
Report Inappropriate Content
Message 4 of 18

Re: Microsoft Exchange MessageTrackingLogs via McAfee Collector

Xded,

Have you configured this without using the collector agent? I've followed the process outlined here:https://community.mcafee.com/thread/52745?tstart=30 but I keep receiving the following error when I try to test the connection:

NotOK.PNG

I provided support with a tcpdump, and they are telling me the account is locked. This is not the case, as I verified the account's status, and I receive the same error when I use my personal credentials for the logon. The account I am trying to use has FULL access to the share. Any suggestions??

Thanks,

LT

xded
Level 12
Report Inappropriate Content
Message 5 of 18

Re: Microsoft Exchange MessageTrackingLogs via McAfee Collector

Hi LTMcGary,

make a screenshot from your configuration of the Data Source.

mcgarl1
Level 9
Report Inappropriate Content
Message 6 of 18

Re: Microsoft Exchange MessageTrackingLogs via McAfee Collector

MessageTracking.PNG

xded
Level 12
Report Inappropriate Content
Message 7 of 18

Re: Microsoft Exchange MessageTrackingLogs via McAfee Collector

Hi,

1. enable parsing

2. set a \ (backslash) als prefix for messagetracking and try again

3. do you set up a domain for your User?

mcgarl1
Level 9
Report Inappropriate Content
Message 8 of 18

Re: Microsoft Exchange MessageTrackingLogs via McAfee Collector

Hi Xded,

I received the same NotOk \n message. Yes, I do have a domain setup for the User.

xded
Level 12
Report Inappropriate Content
Message 9 of 18

Re: Microsoft Exchange MessageTrackingLogs via McAfee Collector

Hi,

i tryed it for you.

Do you setup the share for the user with write and read access?

Unbenannt.png

And this setup

Unbenannt.png

It works without a failure

The Path to the share is: "C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs" the Folder "Log" is my share and in the folder "MessageTracking" are the Log-Data.

Re: Microsoft Exchange MessageTrackingLogs via McAfee Collector

My Exchange Server is 2012. Does that make a difference?

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community