The message tracking logs are ASCII text files and fairly easy to parse. If you're comfortable writing scripts you could probably code something quick-and-dirty that would give you what you want. With the right header definition Microsoft LogParser could probably do what you want, too.
Your question is truncated (stopping with "but is"), but I suspect you were asking if there is some "easier" log file than the IIS logs. While it's possible that the "Security" event log could yield some information (depending on how your Audit Policy is configured) the logs for the IIS Web Site hosting the Exchange-ActiveSync folder really are your best bet....
Access requires a default printer before it can open reports (design/print/preview). It sounds like your problem is more printers and server configuration than splitting the database. I have also run into rare cases where particular printer drivers would cause Access reports to fail.
From your description of the problem it sounds like they don't have a ...
Check package management database
Not perfectly reliable, but scan the entire filesystem for the expected executable or library file names.
Same as #2, but don't count on it if somebody wants to rename netcat to purrmeow, statically compile it, and run it by calling libc instead of a direct execution.
You could try to identify any files using the content of ...
Recent versions of auditd have a dispatcher that supports sending events to syslog so you can perform the processing through your centralized logging system (assuming you have one).
Edit: puppet supports syslog as a log dest so you could do correlation there as well.
If you check the whois record for that IP, it tells you:
Comment: To report suspected security issues specific to
traffic emanating from Microsoft online services, including the
distribution of malicious content or other illicit or illegal material
through a Microsoft online service, please submit reports to:
Comment: * https://cert....
Run a regular script (cron) that checks zpool status -x output. Longer-term, the ZFS on Linux project is working towards this in the form of an event daemon. The Solaris-derived systems had access to the Fault Management Architecture.
As far as automated reports, even commercial solutions like NexentaStor use scheduled checks. There's nothing wrong with ...
I had the same issue but the explanation is very simple :
There is many people using Office 365/Outlook or other mail provider as a secondary identity and redirect all their mail to their main mailbox (Gmail for example). The consequence is that Google is the real recipient while Microsoft act as a relay.
And according to the RFC 7489(https://tools.ietf....
What OS are you running? You can pull this information from your system's package manager (rpm -qa), SNMP (using something like snmpwalk -v2c -c communityname hostname 188.8.131.52.184.108.40.206.3.1.2), or a configuration management solution of your choice... The earlier Blueprint recommendation is very good, too.
ErikA is giving you sound advice. Instead of guessing what you have running, you should specify what you want running.
But maybe blueprint can help you get from your current state to the one you should be in.
This wouldn't actually be all that difficult to script up manually via ssh.
That said, I think you're going about this the wrong way. You ought to start deploying via a configuration management system which will ensure your servers are in a specific, reproducible, version-controlled state.
I found this powershell script over on Technet that does exactly what is needed for free.
Hope it helps others here.
And just in case the link dies in the future:
#requires -version 2.0
$today = get-date
$rundate = $($today....
Have you considered collecting metrics via another mechanism? I have a puppet manifest that deploys dstat to member nodes, where dstat is configured to send metrics to graphite.
Graphite allows you to build graphs on the fly with very little effort required.
Patrick Debois has an excellent series of blog posts on the subject ...
There are two different aspects here:
Logwatch by default is boring, but its goal is to alert on suspicious patterns on log files. If you don't edit the different rules to make it more interesting, by default it will send mails with what the creator found useful, with his own infrastructure and experience.
It is possible to update the different services, ...
You don't need to buy anything as PowerShell should be able to easily handle the task you're looking to produce. This PowerShell / VB Script Discussion is along the lines of what you're looking to accomplish, however you'll need to tweak it to suit your needs. Once you've written your script use the Windows Scheduler to schedule the job to run once a month ...
I think of two possibilities which you can try:
Create a service user which has the user right to run batch jobs and log on as a service, schedule the task as that user wether it is logged on or not. This works and I use it frequently.
Use the start-process cmdlet. I believe it is capable of doing what you want but can't test myself right now (on iphone).
A couple of quick things...
vCloud Director uses vSphere. If there's someone with vCenter access, they can probably run the PowerCLI snippet you linked.
Also, if this is an environment with vCenter Chargeback installed, you can grab some stats from there.
And finally, if you have an option for vCenter Operations Manager, it's handy to be able to glance at ...
Automatically generating such abuse reports does not sound like a good idea at all. If you ever got it working, chances are that the receivers would consider your abuse reports to be spam.
Any ISP who would actually appreciate automatic reports about abuse from their own customers would be much better off deploying their own monitoring of suspicious ...
JasperServer is a standalone tool, and can import any data source and report templates. You can for example measure network traffic and do accounting with the provided data. There's a tool called iRepprt which helps to work with data and reporting views.
In terms of icinga-reports, the package just provides all the reporting views and templates which ...
You're not going to make much progress reporting those IP addresses to the authorities. Even if the IPs hitting you weren't dynamically assigned, the quantity of them just make it not worth the trouble. I recommend installing fail2ban or a similar software and have it ban addresses that spam the server. If you really still wanted to report the addresses, you ...
From the operations center point of view, here are couple of metrics that truly matter:
Amount of email received/sent per some time period
Amount of spam filtered per some period
Amount of IP addresses connected to your SMTP server pool
Mail queue size at your SMTP servers
From those you can quickly gather an overview if you have some situation going on ...
It's not very impressive but for Lync Online you can use the Get-CsActiveUserReport to show the number of active users per tenant on a daily, weekly, monthly or yearly basis
It only works for Lync Online (O365) and I'm not sure how factors in users using on-premises servers
It sounds much more like someone has also made a change to the TS server's published app settings governing printers.
The only way I can think that splitting the DB would do this would be, if the former MDB had some logic to restrict/set the printers and after the split, you're using a new front-end MDB that doesn't have the same logic. However, from your ...
You could take a look at the stand alone linux (Ubuntu, Fedora, etc) audit script for Open-AudIT. It's a bit dated, but should provide what you are after.
Disclaimer - I am the developer.