Exchange 2007 ActiveSync reporting
Increase in the number of mobile users using Exchange ActiveSync has grown rapidly over the years. iPhone and Windows mobile capturing market nowadays, its extremely important for exchange admins to monitor and report their usage real-time.
There have been instances where Exchange design solutions where implemented not knowing the exact impact of OWA and ActiveSync users and the load balancing CAS servers went unresponsive.
This article stresses on the importance and processes for a term well used in Exchange 2007 – Exchange ActiveSync reporting.
The best part is, we don’t have to install any tools or additional software’s for this, the Exchange 2007 power shell does the trick.
I am going to explain two cmd-lets in this article, one for all IIS logs in the W3SVC folder and one for a Single IIS log file. The process of extracting Exchange ActiveSync users with mobile devices is known as PARSING and this process was rather a hectic one in Exchange 2003.
Method1:
Create a folder: C:\ActiveSync_reporting.
Keep in mind that the IIS logs in a windows 2008 machine is stored in C:\inetpub\logs\LogFiles\W3SVC1.
This is for all files in the logs folder:
Get-Childitem C:\inetpub\logs\LogFiles\W3SVC1 | where-object {$_.lastwritetime -gt $DateToCompare} | ForEach { Export-ActiveSyncLog -FileName $_.FullName -OutputPath “C:\ActiveSync_reporting” -OutputPrefix $_.Name.Replace(“.log”,”_”) -UseGMT:$true}
Output will be 6 files as shown:
Length Name
—————————
u_ex100411_Users.csv
u_ex100411_Servers.csv
u_ex100411 _Hourly.csv
u_ex100411_StatusCodes.csv
u_ex100411_PolicyCompliance.csv
u_ex100411_UserAgents.csv
u_ex100412_Users.csv
u_ex100412_Servers.csv
u_ex100412_Hourly.csv
u_ex100412_StatusCodes.csv
u_ex100412_PolicyCompliance.csv
u_ex100412_UserAgents.csv
If we need output for just a single IIS log:
Export-ActiveSyncLog -FileName “C:\inetpub\logs\LogFiles\W3SVC1\u_ex100410.log” -UseGMT:$true -OutputPath “C:\ActiveSync_reporting”
Length Name
———————–
u_ex100410_Users.csv
u_ex100410_Servers.csv
u_ex100410_Hourly.csv
u_ex100410_StatusCodes.csv
u_ex100410_PolicyCompliance.csv
u_ex100410_UserAgents.csv
The most important file in the output is Users.csv which shows:
1. Username
2. Device ID
3. Device type
4. Hits on the CAS server
With the StatusCodes.csv, we can create a report based on http code status and find device-server communication health:
200 – Authentication pass
400 – Bad/invalid request
401 and 403 – Unauthorized/server refusing request
404 – File not found
449 – Retry
500 – Server error
503 – Service unavailable
Update ##############
Method2:
If you need to know all users synicng with one particular DeviceType or DeviceUserAgent, run this:
$AdminSessionADSettings.ViewEntireForest = $true
Get-CASMailbox -ResultSize unlimited -filter {HasActivesyncDevicePartnership -eq $True} | % {Get-ActiveSyncDeviceStatistics -Mailbox $_.identity} | ft Identity, DeviceType, DeviceID, DeviceUserAgent, LastSuccessSync >>”C:\ActiveSync_Report_AllUSers.txt”
Now look at:
Troubleshooting Exchange ActiveSync and reading IIS logs: https://msexchangeguru.com/2012/02/01/exchange-activesync/
I have give a Table for iOS Ver, Device Type and DeviceUserAgent… Play with Excel and sort out LastSuccessSync
Ratish Nair
MVP Exchange
Team@ MSExchangeGuru
May 21st, 2010 at 12:07 pm
This worked Ratiish. Thanks a lot.
June 24th, 2010 at 3:00 pm
I ran the above-suggested cmdlets for all files in the logs folder (with the exception of changing the path to “C:\synclogs” to match my pre-existing output folder) on my Exchange 2010 CAS server and it prompted me with “>>”.
May 17th, 2011 at 2:36 pm
i got the same “>>” as Brant. i checked my command and when i copied and pasted the command from the web site it changed the ” after w3svc1 to a ? I changed it back to a ” and it ran fine. FYI
May 27th, 2011 at 8:09 am
It works fine for a given file, but I want to run it for all the files in a directory.
May 27th, 2011 at 9:22 am
@Harendra – This one is to run for all files in the folder:
Get-Childitem C:\inetpub\logs\LogFiles\W3SVC1 | where-object {$_.lastwritetime -gt $DateToCompare} | ForEach { Export-ActiveSyncLog -FileName $_.FullName -OutputPath “C:\ActiveSync_reporting” -OutputPrefix $_.Name.Replace(“.log”,”_”) -UseGMT:$true}
Ratish
June 8th, 2011 at 5:50 am
Hi Ratish.
We are having problems with ipads that are deleting calender appointments on its own acccord from the exchange server. I have enabled advanced logging on the “microsoft-active-sync” and i am using your commands above to show me the log files. But im not finding anything in regards to errors and the like.
Any ideas how i can troubleshoot this further?
September 20th, 2011 at 1:53 pm
Ben,
We are also having trouble with calendar appointments on iPhones, have you found a solution?
September 20th, 2011 at 1:56 pm
@Dan – please refer to: https://msexchangeguru.com/2011/07/14/outlook-meeting-vanishing/
September 27th, 2011 at 9:10 am
Hi!
On all my ActiveSync Users I get “Total Bytes Received = 0”. Do I need to enable this logging attribute or is this a bug?
“Total Attachment Size” shows correct.
Frode
September 27th, 2011 at 9:37 am
Found it! Just enable the bytes sent/received fields on the IIS site.
Could be a good idea to store the logfiles og a seperate drive..
October 21st, 2011 at 7:25 pm
Dear Ratish, reading your post has been very helpful, i work in a large enviroment,we have 4 CAS and 4 HUB, Exchange 2010 SP1, windows2008 server, when we retrieve the Active Sync logs, they are empty?
we are having problems with iphones and ipad, it is intermitting, they just simple time out and the devices stop syncing. Any ideas on how to retrieve this logs?
any help would be greatly appreciated.
October 24th, 2011 at 8:47 am
Why are the log files empty? Are you looking at the right IIS log files? Parse it and look for HTTP 500 errors…
You simply might need one more CAS server to handle the load…
November 21st, 2011 at 2:44 pm
Ratish, thanks for your excellent posts. I stumbled upon a mystery last week that has me perplexed. The w3svc1 ActiveSync log files for our Exchange server 2003 jumped from approximately 20mb per day, to over 1.2gb per day for the past four days. My review of the log files show that our iOS devices (iPads and iPhones) are registering thousands of log entries per minute. Have you seen this behavior elsewhere?
Dan Kempka
November 21st, 2011 at 2:55 pm
I have seen a behavior in the past which did something to a user’s iPhone which made IIS logs grow 10mb per minute….
I had her update the iOS to the latest version…
1.2 GB Log files are a lot… how many devices do you have in your company?
Ratish
November 21st, 2011 at 3:03 pm
We have four iPhones, and four iPads. We also have at least a dozen Android phones, but they don’t seem to create the excessive log file entries that I’m seeing from iOS devices. All of the iOS devices are running the very latest version of iOS 5. I saw the first large jump in IIS log sizes last April when the files went from 20mb per day to over 150mb. Then the files dropped back down to the 20mb range in late July. In early September, the log files jumped back up to over 150mb per day, then dropped for a few days in November, then exploded to over 1gb currently. I’m guessing that Apple’s implementation of Exchange ActiveSync is the culprit, but I have no way to tell if that’s true…
February 1st, 2012 at 9:29 am
[…] Exchange 2007 ActiveSync reporting: https://msexchangeguru.com/2010/05/20/e2k7-activesync-reporting/ […]
March 13th, 2012 at 4:38 pm
This information is great. Is there anyway to get the device iOS level for each user/device in the User.csv file. I know there are issues with older iOS revisions and I would like to tie a device to a user so that we can get the to upgrade their device?
March 13th, 2012 at 4:44 pm
@Kevin:
$AdminSessionADSettings.ViewEntireForest = $true
Get-CASMailbox -ResultSize unlimited -filter {HasActivesyncDevicePartnership -eq $True} | % {Get-ActiveSyncDeviceStatistics -Mailbox $_.identity} | ft Identity, DeviceType, DeviceID, DeviceUserAgent, LastSuccessSync
DeviceUserAgent is what you are looking for…
Now look at:
Troubleshooting Exchange ActiveSync and reading IIS logs: msexchangeguru.com/2012/02/01/exchange-activesync/
I have give a Table for iOS Ver, Device Type and DeviceUserAgent….
Hope it helps…
Ratish Nair
June 24th, 2012 at 2:21 am
Thanks Ratish, simple and quick.
October 23rd, 2012 at 5:00 pm
[…] Exchange 2007 ActiveSync reporting: https://msexchangeguru.com/2010/05/20/e2k7-activesync-reporting/ […]
April 26th, 2013 at 9:12 am
Hi, I have issue with android phones,
any android phone is unable to connect to Active sync.
Iphone = no problem active sync works
NOKIA = no problem active sync works
HTC(android) = stop syncing 2 weeks ago, error message is chceck user and password…
I tried almost everything, include create new certifications , nothing help
on test connectivity fail with error :
Trying to send OPTIONS command to the server.
Testing the OPTIONS command failed.
URL / Microsoft-Server-ActiveSync/default.eas? AspxAutoDetectCookieSupport = 1 was adopted in response to an unexpected diversion.
IIS log show me this:
2013-04-26 08:07:14 192.168.10.30 POST /Microsoft-Server-ActiveSync/default.eas Cmd=GetItemEstimate&User=user1&DeviceId=HTCAnd9356cd93&DeviceType=htcbravo 443 domain.cz\user1 192.168.10.117 Android-EAS/0.1 302 0 0 0
2013-04-26 08:07:14 192.168.10.30 POST /Microsoft-Server-ActiveSync/default.eas User=user2&DeviceId=ApplC39JRM44DTWF&DeviceType=iPhone&Cmd=Sync&Log=V121_Fc1_Fid:3_Ty:Em_Filt3_St:S_Sk:1816584723_Sst2_Cli:0a0c0d1f0e_LdapC3_LdapL0_RpcC31_RpcL78_Pk388095853_S1_ 443 domain\user2 192.168.10.163 Apple-iPhone5C2/1001.525 200 0 0 202
2013-04-26 08:36:27 192.168.10.30 POST /Microsoft-Server-ActiveSync/default.eas User=user3&DeviceId=ApplC32JW1U3DTWF&DeviceType=iPhone&Cmd=FolderSync&Log=V121_St:S_LdapC0_LdapL0_RpcC17_RpcL0_Pk4149113506_ 443 domain.cz\user3 82.209.1.34 Apple-iPhone5C2/1002.329 200 0 0 31
2013-04-26 08:36:28 192.168.10.30 POST /Microsoft-Server-ActiveSync/default.eas User=user3&DeviceId=ApplC32JW1U3DTWF&DeviceType=iPhone&Cmd=Settings&Log=V121_LdapC0_LdapL0_RpcC12_RpcL15_Pk4149113506_UserInfo:Get_DevModel:iPhone5C2_DevName:B%c3%adl%c3%bd+iPhone+5_DevOS:iOS+6.1.3+10B329_DevLang:cs_ 443 domain.cz\user3 82.209.1.34 Apple-iPhone5C2/1002.329 200 0 0 46
2013-04-26 08:36:28 192.168.10.30 POST /Microsoft-Server-ActiveSync/default.eas Cmd=Sync&User=user1&DeviceId=HTCAnd9356cd93&DeviceType=htcbravo 443 domain.cz\user1 89.24.10.32 Android-EAS/0.1 302 0 0 811
April 26th, 2013 at 9:17 am
sorry here is details:
exchange 2007 v08.01.0240.006 on server SBS2008 (win server standart FE SP2)