07-18-2012 01:16 AM
Hello,
I received the following request from my management : how many restore do we have from the archive per month.
Can anybody tell me how I could find out ? SQL query,....Auditing is not an option for me due to the size of my environment.
Thank you for your help
Sandrine
PS EV 9.0.2 for Exchange 2010 no shortcut.
Solved! Go to Solution.
07-18-2012 02:39 AM
Sandrine
I then think your only option is to analyze the IIS Logs.
You can use LogParser: http://www.microsoft.com/en-us/download/details.aspx?id=24659
Here are some example queries: http://blogs.iis.net/carlosag/archive/2010/03/25/analyze-your-iis-log-files-favorite-log-parser-quer...
You probably want to query for "restoreo2k.asp" or equivalent, haven't got a system to check currently.
Cheers
Michel
07-18-2012 02:39 AM
Sandrine
I then think your only option is to analyze the IIS Logs.
You can use LogParser: http://www.microsoft.com/en-us/download/details.aspx?id=24659
Here are some example queries: http://blogs.iis.net/carlosag/archive/2010/03/25/analyze-your-iis-log-files-favorite-log-parser-quer...
You probably want to query for "restoreo2k.asp" or equivalent, haven't got a system to check currently.
Cheers
Michel
07-19-2012 12:42 AM
Thank you Michel for your answer this is exactly what I supposed .
Isn't the restore link( restoreo2k) the one used only by outklook ? as we primary use the web interface ( search or archive browser) this wouldn't give me all the restores.
Sandrine
07-19-2012 12:56 AM
Use EV reporting:
http://www.symantec.com/business/support/index?page=content&id=HOWTO28055
there is a build in report "Archived Items Access report"
http://www.symantec.com/business/support/index?page=content&id=HOWTO28053
07-19-2012 12:58 AM
That report requires auditing, which to Sandrine's requirements is "not an option"
07-19-2012 12:59 AM
Probably best if you just test it and see what strings to look for in IIS.
07-19-2012 12:59 AM
Thank you but unfortunately we are not using Enterprise Vault monitoring so I can't use those great reports.