Filip Kasaj

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
<code PowerShell [enable_line_numbers="true"]>

$LogTimeframeInDays = 30
$TimeStemp = Get-Date -format ddMMyyhhmmss
$ReportFilePath = "C:\Users\adm.filip.kasaj\Desktop\SMTPRelayApps_$TimeStemp.csv"
$SMTPReveiveLogFolder = "C:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs\ProtocolLog\SmtpReceive"
#Log header: date-time,connector-id,session-id,sequence-number,local-endpoint,remote-endpoint,event,data,context
$ExchangeServers = "P00000011","P00000012","P00000013","P00000014"
$ProgressActivityName = "SMTP log data loading..." 
$ConnectorName = "Open relay"

$AllLogs = @()
foreach($ExchangeServer in $ExchangeServers){
       $SMTPReveiveLogFolderPath = "\\$ExchangeServer\"+$SMTPReveiveLogFolder -replace (":","$")
       $LogFiles = Get-ChildItem $SMTPReveiveLogFolderPath|where-Object {$_.LastWriteTime -ge (Get-Date).AddDays(-$LogTimeframeInDays)}
       $ProgressCount = 0
       foreach($LogFile in $LogFiles){
              $ProgressCount++
              Write-Progress -Activity $ProgressActivityName -Status "Current Count: $ProgressCount" -PercentComplete ($ProgressCount/$LogFiles.count*100) -CurrentOperation $($ExchangeServer+" - "+$LogFile.Name)
              $LogData = Get-Content $LogFile.FullName| Where-Object {$_ -notlike '#*' -and $_ -like "*$ConnectorName*"}
              $AllLogs += $LogData |ConvertFrom-Csv -Header date-time,connector-id,session-id,sequence-number,local-endpoint,remote-endpoint,event,data,context
       }
}
write-host "Report creation: It can take a while..."
$FilteredLogs = $AllLogs|sort -unique session-id|select date-time,connector-id,@{n="remote-endpoint";e={$_."remote-endpoint".split(":")[0]}}
$FilteredLogs | sort -unique remote-endpoint | Export-Csv -Path $ReportFilePath -Encoding unicode -NoTypeInformation -Delimiter "`t"

</code>