# MSExchange Management Event Log

**URL:** <https://discuss.elastic.co/t/msexchange-management-event-log/80719>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [March 30, 2017, 4:19pm UTC](https://discuss.elastic.co/t/msexchange-management-event-log/80719 "2017-03-30T16:19:34Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![wmcgilvery](https://avatars.discourse-cdn.com/v4/letter/w/eb8c5e/32.png) [@wmcgilvery](https://discuss.elastic.co/u/wmcgilvery)\
**Post date:** [March 30, 2017, 4:19pm UTC](https://discuss.elastic.co/t/msexchange-management-event-log/80719/1 "2017-03-30T16:19:34Z")

</div>

I have what appears to be a very simple question.

I wish to add the MSExchange Management event log to the winlogbeat configuration file.

get-eventlog shows it as

MSExchange Management

I added it as -name MSExchange Management and restarted the winlogbeat service on the server. Everything works fine except this event log is not showing up.

Have I missed something?

Thanks

Wil

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [March 31, 2017, 6:15am UTC](https://discuss.elastic.co/t/msexchange-management-event-log/80719/2 "2017-03-31T06:15:41Z")

</div>

Can you please post the configuration that you are using. And please check the log file for warnings or errors.

---

<div class="post-metadata">

**Author:** ![wmcgilvery](https://avatars.discourse-cdn.com/v4/letter/w/eb8c5e/32.png) [@wmcgilvery](https://discuss.elastic.co/u/wmcgilvery)\
**Post date:** [March 31, 2017, 1:41pm UTC](https://discuss.elastic.co/t/msexchange-management-event-log/80719/3 "2017-03-31T13:41:31Z")

</div>

Here you go.

Config:  
winlogbeat.event\_logs:

- name: Application  
ignore\_older: 72h
- name: Security
- name: System
- name: MSExchange Management

output.logstash:

# The Logstash hosts

```
hosts: ["10.91.50.100:5044"]

```

# Optional SSL. By default is off.

# List of root certificates for HTTPS server verifications

#ssl.certificate\_authorities: ["/etc/pki/root/ca.pem"]

# Certificate for SSL client authentication

#ssl.certificate: "/etc/pki/client/cert.pem"

# Client Certificate Key

#ssl.key: "/etc/pki/client/cert.key"

Log file:  
2017-03-31T09:27:53-04:00 INFO EventLog[MSExchange Management] Successfully published 1 events  
2017-03-31T09:27:54-04:00 INFO EventLog[Security] Successfully published 5 events  
2017-03-31T09:27:56-04:00 INFO EventLog[Security] Successfully published 4 events  
2017-03-31T09:27:58-04:00 INFO EventLog[Security] Successfully published 8 events  
2017-03-31T09:28:01-04:00 INFO EventLog[Security] Successfully published 17 events  
2017-03-31T09:28:02-04:00 INFO EventLog[Security] Successfully published 16 events  
2017-03-31T09:28:02-04:00 INFO EventLog[MSExchange Management] Successfully published 1 events  
2017-03-31T09:28:04-04:00 INFO EventLog[Security] Successfully published 15 events

Says 1 event published, but can't see it in Kibana.

---

<div class="post-metadata">

**Author:** ![wmcgilvery](https://avatars.discourse-cdn.com/v4/letter/w/eb8c5e/32.png) [@wmcgilvery](https://discuss.elastic.co/u/wmcgilvery)\
**Post date:** [March 31, 2017, 1:44pm UTC](https://discuss.elastic.co/t/msexchange-management-event-log/80719/4 "2017-03-31T13:44:20Z")

</div>

Actually this is an ID10T error - i only had this on one server and my filters were wrong - duh - everything works

thanks

Wil

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 28, 2017, 1:44pm UTC](https://discuss.elastic.co/t/msexchange-management-event-log/80719/5 "2017-04-28T13:44:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.