LogParser – MS Exchange Webmail User Access List

I had to make a list of whom accessed the webmail system at work and when. Here is a way to do it with logparser if you have your IIS logs in normal IIS format.

  1. Get the IIS logs from the web server front end of the
    webmail server. Dump them into a location like g:\logs\owa
  2. Grab a copy of MS Log Parser
  3. Make a text file called WebAccess.sql and put the following
    commands in the sql text file.
    cs-username, Date
    FROM g:\logs\owa\*
    (cs-username IS NOT NULL)
    (sc-status = 200)
    GROUP BY Date, cs-username
  4. Put the ms log parser and your WebAccess.sql into the g:\logs folder
  5. Execute this command at a command line in the folder with ms log
    Logparser.exe file:WebmailAccess.sql -i:IISW3C -o:CSV
  6. If you want it to go to a file just add > WebmailUsers.csv to the end
  7. of the command in step four above. That will redirect the output to a csv you can open in excel.