Skip to content

Instantly share code, notes, and snippets.

@leechristensen
Created January 27, 2016 17:38
Show Gist options
  • Save leechristensen/7b4e3acad2588e90dcea to your computer and use it in GitHub Desktop.
Save leechristensen/7b4e3acad2588e90dcea to your computer and use it in GitHub Desktop.
Parses Exchange's RPC Client Access Logs to get client usernames/IP addresses.
# Author: Lee Christensen (@tifkin_)
#$RPClientLogDir = "$($env:exchangeinstallpath)\Logging\RPC Client Access\"
$RPClientLogDir = "."
$NumberOfLogs = 100
$RecentLogs = ls "$RPClientLogDir\*.log" | sort LastWriteTime -Descending | select -First $NumberOfLogs -ExpandProperty FullName
$UserLogons = @()
foreach($Log in $RecentLogs)
{
$LogFile = Get-Content $Log | select -Skip 5
$RCAHeaders2010 = "date-time","session-id","seq-number","client-name","organization-info","client-software","client-software-version","client-mode","client-ip","server-ip","protocol","application-id","operation","rpc-status","processing-time","operation-specific","failures"
$RCAHeaders2013 = "date-time","session-id","seq-number","client-name","organization-info","client-software","client-software-version","client-mode","client-ip","client-connection-info","server-ip","protocol","application-id","request-ids","session-cookie","operation","rpc-status","processing-time","operation-specific","failures","performance-data","activity-context-data"
$CsvLog = ConvertFrom-Csv $LogFile -Header $RCAHeaders2013
$LogonData = $CsvLog | select -property @{N='User';E={$_."client-name"}}, @{N='ClientIPAddress';E={$_."client-ip"}} | ?{
$_.ClientIPAddress `
-and $_.ClientIPAddress -notmatch '127.0.0.1|::1|^fe80:'
}
$UserLogons += $LogonData
}
$UserLogons | sort -Unique -Property User,ClientIPAddress | Out-GridView
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment