RPC client access log and IIS log, difference??

RPC logging is in "C:\Program Files\Microsoft\Exchange Server\V14\Logging\RPC Client Access" by default.
And IIS logs is in "C:\inetpub\logs\LogFiles\W3SVC1" by default.
Just want to know which client will generate which Log?
For example, exchange server 2010 supports:
Outlook Web App
Outlook anywhere
Exchange ActiveSync
POP3 and IMAP4
Autodiscover
So far as I know, "exchange activesync" is always appear in IIS log. But outlook users(all in domain), most of them are always appear in RPC log, but sometime a few users appear in IIS log.
For example:(IIS log)
2014-03-31 00:01:51 172.23.0.100 POST /EWS/Exchange.asmx - 443 TEST\alice 172.26.0.41 Microsoft+Office/14.0+(Windows+NT+6.1;+Microsoft+Outlook+14.0.7116;+Pro) - 200 0 0 312
RPC log:
2014-03-31T00:42:09.964Z,1024,1,/o=first organization/ou=exchange administrative group(fydibohf23spdlt) /cn=recipients/cn=alice,,OUTLOOK.EXE,14.0.7108.5000,Cached,,,ncacn_http,,OwnerLogon,0,00:00:00.0156287,,
I want to understand the logging rules, please help?

Hi, Steve:
Thanks very much for your reply. I have a question to your reply here.
RPC-->Outlook clients, and then EWS(includes Outlook 2011??) What's the difference between Outlook clients and Outlook 2011(I think it should be 2010?), but is that Outlook 2010 not belong to 'Outlook clients'?
Best Regards,
Ryo

Similar Messages

RPC Client Access Logs - Throttling Policy

Trying to get useful information on who is being throttled by a specific policy.
Created the policy: New-ThrottlingPolicy -Name LimitMessagesSent -RecipientRateLimit 5 -ThrottlingPolicyScope Organization
Enabled RPC Client access logging: <add key="LoggingTag" value="ConnectDisconnect, Logon, Failures, ApplicationData, Warnings, Throttling" /> and bounced the service.
Forced the throttling by sending many emails.
Opened the log and found this:
2014-07-23T21:24:28.820Z,40,1,/o=Exch/ou=Monitoring Mailboxes/cn=Recipients/cn=HealthMailbox872ac0efb9c44ddf9d0d1d4f0e4dbb55,,Microsoft.Exchange.RpcClientAccess.Monitoring.dll,15.0.0.0,Cached,,,,ncacn_http,Client=Microsoft.Exchange.RpcClientAccess.Monitoring,,,,,00:00:00.0160000,"BS=Owner:Sid~CAMPUS\SM_6f8aaf3f77f94192a~Rca~false,Conn:1,MaxConn:40,MaxBurst:150000,Balance:149988.3,Cutoff:Unlimited,RechargeRate:900000,Policy:LimitMessagesSent,IsServiceAccount:False,LiveTime:00:02:00.0650494",,,
Makes no mention of the user that was throttled. How can I troubleshoot if I cannot see the user in the logs?
Thanks.

Hi
We need to assign this newly created throttling policy to the end users else it will not be effective.
The below commands will help you out.
Use below command to assign this newly created throttling policy to the user
Set-Mailbox MBXName -ThrottlingPolicy LimitMessagesSent
Run the below command to ensure that the throttling policy is assigned
Get-Mailbox MBXName | Select Throttling Policy
Remember to mark as helpful if you find my contribution useful or as an answer if it does answer your question.That will encourage me - and others - to take time out to help you Check out my latest blog posts on http://exchangequery.com

Difference between Tuxedo Logs and Appserver Logs

Hello
What is the difference between Tuxedo Logs and Appserver Logs? What are the scenarios to look into Tuxedo Logs and Appserver Logs?
Thanks

The application server log keep the application informations and trace.
The tuxedo log keep the application server management informations and trace.
Nicolas.

Difference between sysout log and server log???

Hi All,
from the long time am trying to find out the difference between sysout log and server log, can anyone please share me the info regarding that?
Thanks.

Server Logs
The server log records information about events such as the startup and shutdown of servers,the deployment of new applications, or the failure of one or more subsystems. The messages include information about the time and date of the event as well as the ID of the user who initiated the event.
Standard output logs
In addition to writing messages to a log file, each server instance prints a subset of its messages to standard out. Usually, standard out is the shell (command prompt) in which you are running the server instance.WebLogic Server administrators and developers configure logging output and filter log messages to troubleshoot errors or to receive notification for specific events.
Regards
Fabian

No new mail notification in Outlook - CAS Exchange RPC Client Access problem

Hi, we're facing this problem:
Users start complaining they suddenly don’t receive new mail notifications in Outlook (2010/2013) anymore
Inbox does not show the new mail either
When the user changes folders in outlook, the new mail does show in the Inbox folder
Restarting Outlook shows the new mail as well.
The same new e-mail arrives instantly (with notifications) in Owa and on mobile devices
Sometimes the new mail notification pops up after a longer period of time (from 30 seconds to 10 minutes). But more often not at all.
This issue seems to occur at random. We’ve been problem free for a week, and sometimes it comes back three times a day.
Clients running Outlook 2010, 2013 cached or online, on site and off site. So it seems server related, not client.
It was seen first around January 8th. We did not make any changes around that time that we can link to this problem.
Only one CAS server (EXCH1-RTD) shows this issue. CAS servers on other sites are ok
EXCH1-RTD has CAS and HUB transport roles. The same site has two mailbox only servers. EXCH2-RTD (mailbox server for normal mailboxes). And EXCH3-RTD (mailbox server for archive mailboxes)
No entries in the event logs that seems to be related
As the problem only occurs with Outlook clients, I suspected RPC issues. We cannot gracefully stop the “Microsoft Exchange RPC Client Access” service on EXCH1-RTD while the issue occurs. We
can only kill the process and restart the service, solving the issue instantly.
What we’ve tried until now:
Updated all Exchange servers from Exchange 2010 SP3 RU6 to RU8-v2 (server OS=W2K8R2)
Updated all Exchange servers to latest critical Windows updates
Recalculated requirements using MS Sizing tool. Upgraded EXCH1-RTD VM from 8GB and 2 vCPU (1 core/cpu) to 16GB
and 4vCPU (1 core/cpu)
Ran various perfmon counters and compared them with other Exchange servers, not finding any obvious anomalies.
Any ideas would be greatly appreciated!
Ron

Hi Ron,
From your description, OWA works well, the issue is related to Outlook side. In your case, I recommend you use Outlook safe mode to determine whether the issue is related to add-ins. If the issue persists, you can create a new profile to check the result.
Hope this can be helpful to you.
Best regards,
Amy Wang
TechNet Community Support

Microsoft Exchange RPC Client Access will not start.

A few days ago all my outlook clients were disconnected. Looking into it and the Microsoft Exchange RPC Client Access service had died. Tried several restarts of the system but the service will not go into a running state. It always says
Starting. But it is actually terminating and restarting. In the system log get Event 7031 - "The Microsoft Exchange RPC Client Access service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be
taken in 5000 milliseconds: Restart the service." I can't find anything else on the error in any log file. Some other info not sure if this related or not. The contentIndex are corrupt and will not rebuild. Get a state of "Failed"
with an error message of "The database has been dismounted." Also at time the system is very sluggish. Mostly right after a reboot for an hour or two. Details about the system are; Running Exchange 2013 SP1 on server 2012 R2. All
roles on one machine. About 20 mailboxes. Database is about 40gig. No VM, just a normal server. plenty of diskspace, memory and CPU. The system has been running fine for about a year. Also, mobile devices and OWA work fine. Mail flow
is fine. Outlook just can't connect.
Tried restoring the databases and logs from before the problem started but that did not help.
Not sure what to try from here.
Thanks

Hi,
Please check whether an unavailable Public Folder database is pointed to in your Exchange 2013 mailbox database as the default public folder database setting.
If there is no legacy public folder database and you are working in a pure Exchange 2013 environment, please remove the default public folder database setting on each Exchange 2013 Mailbox database that points to the deleted public folder database object
in ADSI Edit:
1. Open ADSIEdit, Connect to the Configuration container.
2. Expand Configuration, expand CN=Configuration,DC=Domain,DC=com.
3. Expand CN=Services -> CN=Microsoft Exchange -> CN=Domain -> CN=Administrative Groups -> CN=Exchange Administrative Group -> CN=Databases.
4. In the right hand pane you will see a list of databases. Right-click the listed database object -> Properties.
5. Check whether the msExchHomePublicMDB value is set to an unavailable value. If you see reference to the old database, please clear the value.
6. Click OK.
7. Check the rest of the databases to make sure that they are not populated in the same way.
For more information about this, please refer to:
http://support2.microsoft.com/kb/2962915/en-us
Regards,
Winnie Liang
TechNet Community Support

Diff bteween trace,log and audit log

Diff bteween trace,log and audit log....?
Harsha

Hi,
Audit Log :The adapter engine uses the messaging system to log the messages at every stage, This log is called the Audit Log.
The audit log can be viewed from the runtime work bench(RWB) to look into the details of the life cycle of the message. During our journey we will also have a look at the messages that are logged at different stages.
Audit logs are mainly used to trace our messages. In case of any failures, we can easily trace where message stands. we can give the entries for the logs in UDFs, custom modules etc..
Audit logs are generally gives us the sequence of the steps from where the message is picked up with file name and path and how the message is sent to the I.E pipeline..it also shows the status of the message like DLNG,DLVD like that...generally we look into the audit logs if there are any errors in message processing...
It gives the complete log of your message.
Go to RWB --> Component Monitoring --> Adapter Engine --> Communication channel Monitoring --> Select the Communicatin channel --> click on use filter --> then click on the Message Id.
Trace Log:
Log file:
A log file contains generally intelligible information for system administrators. The information is sorted by categories and is used for system monitoring. Problem sources or critical information about the status of the system are logged in this file. If error messages occur, you can determine the software component that has caused the error using the location. If the log message does not provide enough details to eliminate the problem, you can find more detailed information about the error in the trace file.
The log file is located in the file system under
"/usr/sap/SID/instance/j2ee/cluster/server[N]/log/applications.[n].log" for every N server node.
Access the file with the log viewer service of the J2EE visual administrator or with the standalone log viewer.
Trace file:
A trace file contains detailed information for developers. This information can be very cryptic and extensive. It is sorted by location, which means by software packages in the Java environment, for example, "com.sap.aii.af". The trace file is used to analyze runtime errors. By setting a specific trace level for specific locations, you can analyze the behavior of individual code segments on class and method level. The file should be analyzed by SAP developers or experienced administrators.
The trace file is located in the file system under
"/usr/sap/SID/instance/j2ee/cluster/server[N]/log/defaultTrace.[x].trc" for each N server node.
Access the file with the log viewer service of the J2EE visual administrator or with the standalone log viewer.
Thanks
Virkanth

Exception.log and mail.log stopped logging (MX7)

Hi all - we have been experiencing intermittent problems with our MX 7.02 server & checked the log files to help diagnose the problem.
However both exception.log and mail.log appear to have stopped logging information in June 2010.
The size of the logfiles is only 178K and 34K.
Does anyone know why they've stopped & how to restart the logging?
Many thanks
cf_rog

On CF7 as far as I know you need to restart the CF server. In CF9 you
can selectively enable/disable logging for those files and thus
attempt to restart logging.
Mack

[svn:bz-trunk] 14330: BLZ-476 : Getting different error message in server' s servlet log and console log when class is not of expected type.

Revision: 14330
Revision: 14330
Author:   [email protected]
Date:     2010-02-22 10:03:03 -0800 (Mon, 22 Feb 2010)
Log Message:
BLZ-476 : Getting different error message in server's servlet log and console log when class is not of expected type.
QA: no
Doc: no
checkin test : pass
Ticket Links:
    http://bugs.adobe.com/jira/browse/BLZ-476
Modified Paths:
    blazeds/trunk/modules/core/src/flex/messaging/MessageBrokerServlet.java

Hi, wbracken ,
As known, there are 2 different questions I raised.
Regarding the reply for the second one (Nothing to do with Chinese), I noticed there are several similar issues found in this forum, and it seems no response could solve my that problem. The related methods and classes were also well check, as well as the parameters put.
Any way, your reponse was appreciated.
Thank you for the help.

[svn:bz-trunk] 14341: BLZ-476 : Getting different error message in server' s servlet log and console log when class is not of expected type.

Revision: 14341
Revision: 14341
Author:   [email protected]
Date:     2010-02-22 13:19:46 -0800 (Mon, 22 Feb 2010)
Log Message:
BLZ-476 : Getting different error message in server's servlet log and console log when class is not of expected type.
Ticket Links:
    http://bugs.adobe.com/jira/browse/BLZ-476
Modified Paths:
    blazeds/trunk/modules/core/src/flex/messaging/MessageBrokerServlet.java
    blazeds/trunk/modules/core/src/flex/messaging/util/ClassUtil.java

Hi, wbracken ,
As known, there are 2 different questions I raised.
Regarding the reply for the second one (Nothing to do with Chinese), I noticed there are several similar issues found in this forum, and it seems no response could solve my that problem. The related methods and classes were also well check, as well as the parameters put.
Any way, your reponse was appreciated.
Thank you for the help.

Ttcwerrors.log and ttcwmesg.log file locations

Is there an option we can set in the ttcrsagent.options file to change the location of the ttcwerrors.log and ttcwmesg.log files?
We can change the location of the daemon user and error log files by setting the -supportlog and -userlog options in ttendaemon.options, so we were hoping we could do the same in ttcrsagent.options.
Thanks,
-Jules

Unfortunately, no. The ttcw log file location is not configurable
Simon

Ocsd.log and crsd.log

I am newbie to rac, i am see the following below message in ocsd.log and crsd.log in both nodes of 10.2.0.3 windows 2003, is it any sympton to failure or error?
And both instances of are working fine. And one more thing lots of prefix CDMP_ files are generating in bdump folder. Please advise.
ocsd.log
CSSD]2009-10-06 16:39:04.602 [3784] >TRACE: clssgmClientConnectMsg: Connect from con(0000000004A64DB0) proc(0000000004A5ED80) pid() proto(10:2:1:1)
[    CSSD]2009-10-06 16:39:36.449 [3784] >TRACE: clssgmClientConnectMsg: Connect from con(0000000004A64FE0) proc(0000000004A5EF00) pid(5684) proto(10:2:1:1)
[    CSSD]2009-10-06 16:40:05.202 [3784] >TRACE: clssgmClientConnectMsg: Connect from con(0000000004A64B80) proc(0000000004A5ED80) pid() proto(10:2:1:1)
[    CSSD]2009-10-06 16:40:21.579 [3784] >TRACE: clssgmClientConnectMsg: Connect from con(0000000004A64DB0) proc(0000000004A5ED80) pid(2356) proto(10:2:1:1)
[    CSSD]2009-10-06 16:41:05.787 [3784] >TRACE: clssgmClientConnectMsg: Connect from con(0000000004A64DB0) proc(0000000004A5ED80) pid() proto(10:2:1:1)
[    CSSD]2009-10-06 16:41:09.490 [3784] >TRACE: clssgmClientConnectMsg: Connect from con(0000000004A64B80) proc(0000000004A5ED80) pid() proto(10:2:1:1)
[    CSSD]2009-10-06 16:42:06.387 [3784] >TRACE: clssgmClientConnectMsg: Connect from con(0000000004A64DB0) proc(0000000004A5ED80) pid() proto(10:2:1:1)
[    CSSD]2009-10-06 16:43:07.003 [3784] >TRACE: clssgmClientConnectMsg: Connect from con(0000000004A64FE0) proc(0000000004A5EF00) pid() proto(10:2:1:1)
[    CSSD]2009-10-06 16:44:07.604 [3784] >TRACE: clssgmClientConnectMsg: Connect from con(0000000004A65210) proc(0000000004A5EF00) pid() proto(10:2:1:1)
[    CSSD]2009-10-06 16:44:09.994 [3784] >TRACE: clssgmClientConnectMsg: Connect from con(0000000004A64FE0) proc(0000000004A5EF00) pid() proto(10:2:1:1)
[    CSSD]2009-10-06 16:44:26.090 [3784] >TRACE: clssgmClientConnectMsg: Connect from con(0000000004A65210) proc(0000000004A5EF00) pid(6008) proto(10:2:1:1)
[    CSSD]2009-10-06 16:45:08.188 [3784] >TRACE: clssgmClientConnectMsg: Connect from con(0000000004A64B80) proc(0000000004A5ED80) pid() proto(10:2:1:1)
[    CSSD]2009-10-06 16:46:08.773 [3784] >TRACE: clssgmClientConnectMsg: Connect from con(0000000004A64DB0) proc(0000000004A5ED80) pid() proto(10:2:1:1)
[    CSSD]2009-10-06 16:46:16.164 [3784] >TRACE: clssgmClientConnectMsg: Connect from con(0000000004A64B80) proc(0000000004A5ED80) pid() proto(10:2:1:1)
[    CSSD]2009-10-06 16:47:09.373 [3784] >TRACE: clssgmClientConnectMsg: Connect from con(0000000004A64B80) proc(0000000004A5ED80) pid() proto(10:2:1:1)
[    CSSD]2009-10-06 16:47:20.812 [3784] >TRACE: clssgmClientConnectMsg: Connect from con(0000000004A64DB0) proc(0000000004A5ED80) pid() proto(10:2:1:1)
[    CSSD]2009-10-06 16:48:09.974 [3784] >TRACE: clssgmClientConnectMsg: Connect from con(0000000004A64DB0) proc(0000000004A5ED80) pid() proto(10:2:1:1)
[    CSSD]2009-10-06 16:49:10.543 [3784] >TRACE: clssgmClientConnectMsg: Connect from con(0000000004A64B80) proc(0000000004A5ED80) pid() proto(10:2:1:1)
[    CSSD]2009-10-06 16:50:11.127 [3784] >TRACE: clssgmClientConnectMsg: Connect from con(0000000004A64DB0) proc(0000000004A5ED80) pid() proto(10:2:1:1)
[    CSSD]2009-10-06 16:51:10.040 [3784] >TRACE: clssgmClientConnectMsg: Connect from con(0000000004A64B80) proc(0000000004A5ED80) pid() proto(10:2:1:1)
[    CSSD]2009-10-06 16:51:11.712 [3784] >TRACE: clssgmClientConnectMsg: Connect from con(0000000004A64DB0) proc(0000000004A5ED80) pid() proto(10:2:1:1)
[    CSSD]2009-10-06 16:52:12.297 [3784] >TRACE: clssgmClientConnectMsg: Connect from con(0000000004A64B80) proc(0000000004A5ED80) pid() proto(10:2:1:1)
[    CSSD]2009-10-06 16:52:45.676 [3784] >TRACE: clssgmClientConnectMsg: Connect from con(0000000004A64DB0) proc(0000000004A5ED80) pid(548) proto(10:2:1:1)
[    CSSD]2009-10-06 16:53:12.897 [3784] >TRACE: clssgmClientConnectMsg: Connect from con(0000000004A65670) proc(0000000004A5EA80) pid() proto(10:2:1:1)
10/06/09 14:41:01 entered scmhandler 4 tid = 2544 pid = 2548
10/06/09 14:56:01 entered scmhandler 4 tid = 2544 pid = 2548
10/06/09 14:56:59 entered scmhandler 4 tid = 2544 pid = 2548
10/06/09 15:11:03 entered scmhandler 4 tid = 2544 pid = 2548
10/06/09 15:26:01 entered scmhandler 4 tid = 2544 pid = 2548
10/06/09 15:41:01 entered scmhandler 4 tid = 2544 pid = 2548
10/06/09 15:56:03 entered scmhandler 4 tid = 2544 pid = 2548
10/06/09 16:11:01 entered scmhandler 4 tid = 2544 pid = 2548
10/06/09 16:26:01 entered scmhandler 4 tid = 2544 pid = 2548
10/06/09 16:41:01 entered scmhandler 4 tid = 2544 pid = 2548
10/06/09 16:56:04 entered scmhandler 4 tid = 2544 pid = 2548
10/06/09 16:56:59 entered scmhandler 4 tid = 2544 pid = 2548

Check Document Id : 400778.1
Thanks

Control the size of Essbase.log and application log

Understand that there are many message were written to the Essbase.log and application log. Is there any method to control what kind of message to be written to the log file so as to reduce the IO frequency of the server disk folders?
Thanks for your help!

CL wrote:
You might want to think about forcing your BSO/ASO PAG & IND/DAT files to go onto a separate drive volume from your base Essbase binaries. This can be tough to do in a SAN environment as it is difficult to know what is truly where.
Another option would be to use CLEARLOGFILE to reset the logs (this will delete them every time you stop/restart Essbase, so make sure you archive them if you need log history).
See: http://download.oracle.com/docs/cd/E10530_01/doc/epm.931/html_esb_techref/config/clearlogfile.htm
Yet another would be to set SSLOGUNKNWON to false to cut down on the log.
See: http://download.oracle.com/docs/cd/E10530_01/doc/epm.931/html_esb_techref/config/sslogunknown.htm
Regards,
Cameron LackpourThanks! We already separate the log files from the data files but they still in the same hardware server. Yes, in SAN environment we really don't know where it the physical drive.
Essbase do not have log rotate option like Apache and maybe we should archive the essbase log regularly and clear it up.
We don't have much unknown member case in our log. Anyway we will investigate the option SSLOGUNKNOWN
Thanks again!

Redo Log and Supplemental Logging related doubts

Hi Friends,
I am studying Supplemental logging in detail. Have read lots of articles and oracle documentation about it and redo logs. But couldnot found answers of some doubts..
Please help me clear it.
Scenario: we have one table with primary key. And we execute an update query on that table which is not using the primary key column in any clause..
Question: In this case, does the redo log entry generated for the changes done by update query contain the primary columns values..?
Question: If we have any table with primary key, do we need to enable the supplemental logging on primary columns of that table? If yes, in which circumstances, do we need to enable it?
Question: If we have to configure stream replication on that table(having primary key), why do we actually need to enable its supplemental logging ( I have read the documentation saying that stream requires some more information so.., but actually what information does it need. Again this question is highly related to the first question.)
Also please suggest any good article/site which provide inside details of redo log and supplemental logging, if you know.
Regards,
Dipali..

1) Assuming you are not updating the primary key column and supplemental logging is not enabled, Oracle doesn't need to log the primary key column to the redo log, just the ROWID.
2) Is rather hard to answer without being tautological. You need to enable supplemental logging if and only if you have some downstream use for additional columns in the redo logs. Streams, and those technologies built on top of Streams, are the most common reason for enabling supplemental logging.
3) If you execute an update statement like
UPDATE some_table
SET some_column = new_value
WHERE primary_key = some_key_value
AND <<other conditions as well>>and look at an update statement that LogMiner builds from the redo logs in the absence of supplemental logging, it would basically be something like
UPDATE some_table
SET some_column = new_value
WHERE rowid = rowid_of_the_row_you_updatedOracle doesn't need to replay the exact SQL statement you issued, (and thus it doesn't have to write the SQL statement to the redo log, it doesn't have to worry if the UPDATE takes a long time to run (otherwise, it would take as long to apply an archived log as it did to generate the log, which would be disasterous in a recovery situation), etc). It just needs to reconstruct the SQL statement from the information in redo, which is just the ROWID and the column(s) that changed.
If you try to run this statement on a different database (via Streams, for example) the ROWIDs on the destination database are likely totally different (since a ROWID is just a physical address of a row on disk). So adding supplemental logging tells Oracle to log the primary key column to redo and allows LogMiner/ Streams/ etc. to reconstruct the statement using the primary key values for the changed rows, which would be the same on both the source and destination databases.
Justin

Adadmin.log and adpatch.log files

Hi All,
Is it safe to delete the "adadmin.log" and "adpatch.log" from $APPL_TOP/admin/PROD/log directory ?
These log files are really big and consuming space.
Thanks,

Afia wrote:
Hi All,
Is it safe to delete the "adadmin.log" and "adpatch.log" from $APPL_TOP/admin/PROD/log directory ?
These log files are really big and consuming space.
Thanks,Yes it is safe to delete them.
How ever i would suggest you to zip them with some date conventions like from10dec12_to_13mar13 and save it for later reference and delete the originals
As it is text the compression ratio will be high. It will make it much smaller.
Thanks

RPC client access log and IIS log, difference??

Similar Messages

Maybe you are looking for