Where can I locate log data for exchange 2010 that will show me data such as users accessing the db, or failed logon attempts.
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
Login-attempts are filed with the normal Windows login attept log, in the Security event-log. I don't believe there is a way to disambiguate Exchange logins from normal Windows logins, but your Client-access servers shouldn't be seeing any plain-windows logins anyway, so it's safe to assume that everything there is Exchange-related.
I don't believe, though may be wrong, that there is a way to audit database-access. That kind of log would get insanely spammy in an organization of any size due to the amount of activity Outlook does just sitting there apparently doing nothing. The default Outlook connection mode is based on a pull model, so Outlook polls the Exchange server periodically (the interval can be tuned, but by default it is pretty short) which would be the kind of thing to get logged.
As far as I am aware, there isn't a way to audit access to the Mailbox databases. If a user is logged in and connected to Exchange (via OWA, Outlook client, or mobile device with ActiveSync), you can basically assume that they're interfaced with the mailbox servers.
User authentication for Exchange is handled by Active Directory. The Security Log in the client access server may contain some security auditing information, but the best place to look would be the security logs on the domain controller. This will only tell you who was authenticating when (and possibly the client they were connecting from). However, tracking when/where a user logged in can be difficult if you have multiple domain controllers because you would need to search the security logs on EVERY domain controller to find the information you're looking for. There are some 3rd party programs that will do this for you.
Assuming you're running Exchange 2010 SP1, you might be looking for Mailbox Audit Logging. You'll have to turn it on, and configure it for what you're looking for. Once you do, you'll definitely need to take care to watch out for the growth of this because it can get to be a lot of information pretty quickly.
As far as where you can find the logs, you'll need to run the powershell commands found in that article to see the logs, but I believe the info is stored in the individual mailboxes. I can't point to documentation on that one, so I might be mistaken about where they're stored.
I found the IIS logs to be most helpful in tracking down authentication failures since the logs just show the IP address for the Exchange server. Remember they are for GMT time... I was able to find the invalid login attempt and work out the employee had TWO different email clients installed on a mobile device, but was only updating one...so the other one was locking out their account.