I have been struggling with setting up a data source for parsing MS Exchange message logs. Part of the problem, I believe, is that we already have a data source set up for the same Exchange server that is parsing WMI logs.
When configuring the new data source for the message logs, I can get a successful connection with the share where the message logs reside, but looking at TCP dumps coming into the receiver from the Exchange server I'm only seeing the WMI logs, nothing from the message logs.
I am using IIS ASP for the data source model since these are W3SVC1 logs and CIFS File Source as the data retrieval. At this point I'm just parsing, not logging.
Any suggestions as to how I can sort this out would be appreciated.