Exchange 2010: Search client access log for errors

by

Here I have already reported on the logging of the Client Access service. Today I had a specific case in which there were repeated connection errors or interruptions. I therefore created a script that extracts all errors from the RCA log into a CSV file. The script can be categorized as Quick & Dirty, but if you like you can adapt or extend it to your needs.

# Search RCA log for errors
# www.frankysweb.de

$exportpath = "d:\fehler.csv"

#—————————————————
"Time;User;Database;Client;Client version;Error" | set-content "$exportpath"
$today = get-date -Format yyyyMMdd
$installpath = $installpath = Get-ChildItem env:ExchangeInstallPath | ForEach-Object {$_.Value}
$rcalogpath = "$installpath\Logging\RPC Client Access\RCA_$today-1.log"

$rcalogvalues = import-csv -path "$rcalogpath" -delimiter "," -header "date-time", "session-id", "seq-number", "client-name", "organization-info", "client-software", "client-software-version","client-mode", "client-ip", "server-ip", "protocol", "application-id", "operation", "rpc-status", "processing-time", "operation-specific", "failures" | where-object {$_.failures -match "\W"}

foreach ($rcalogvalue in $rcalogvalues)
{
$failure = $rcalogvalue.failures
$cn = $rcalogvalue.'client-name'
$client = $rcalogvalue.'client-software'
$clientversion = $rcalogvalue.'client-software-version'
$mailbox = get-mailbox "$cn"
$username = $mailbox.name
$database = $mailbox.database
$timestamp = $rcalogvalue.'date-time' | get-date -Format "dd.MM.yyyy HH:mm:ss"
"$timestamp;$username;$database;$client,$clientversion;$failure" | add-content "$exportpath"
}

Good luck with your troubleshooting.

PS: Also take a look at over hereFeedback is always welcome.

Leave a Comment