eventcomb work good sometime for check log. Try http://www.microsoft.com/technet/treeview/default.asp?url=/TechNet/security/prodtech/windows/windows2000/staysecure/secops06.asp
Chu Fu > Hi > > Exch 5.5 sp54 > Win2k sp2 > > I am wondering if there is a way to move the diagnostic logging events for > IMS to a custom event viewer or preferably the security log. Here is why. > > I have a group of high paid *ahem* users that receive email from potential > clients, sometimes these users will start a big problem with management > claiming that certain people cant email them and we are losing TONS of money > because of it. In a recent situation one of these users claimed this but it > turned out the user didn't check their email for 15 days. > > All of these users are pop/smtp, so I would like a way to log their > logon/logoff events but there is a catch. They logon to a invisible SMTP > that sits on the mailbox server so the logon/logoff auditing gets mingled in > with the other 1400 users and the security log that is currently 10 meg only > stores for a few days. Id really like to only log logon/logoff events for > pop3/smtp and not normal mail clients. > > Any ideas? > > Thanks > e- _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED]
