Configuring OWA logs on your Microsoft Exchange Server

To prepare your Microsoft Exchange Server to communicate with IBM® QRadar®, configure Outlook Web Access (OWA) event logs.

Procedure

  1. Log into your Microsoft Internet Information System (IIS) Manager.
  2. On the desktop, select Start > Run.
  3. Type the following command:

    inetmgr

  4. Click OK.
  5. In the menu tree, expand Local Computer.
  6. If you use IIS 6.0 Manager for Microsoft Server 2003, complete the following steps:
    1. Expand Web Sites.
    2. Right-click Default Web Site and select Properties.
    3. From the Active Log Format list, select W3C.
    4. Click Properties.
    5. Click the Advanced tab.
    6. From the list of properties, select the Method (cs-method) and Protocol Version (cs-version) check boxes
    7. Click OK.
  7. If you use IIS 7.0 Manager for Microsoft Server 2008 R2, or IIS 8.5 for Microsoft Server 2012 R2, complete the following steps:
    1. Click Logging.
    2. From the Format list, select W3C.
    3. Click Select Fields.
    4. From the list of properties, select the Method (cs-method) and Protocol Version (cs-version) check boxes
    5. Click OK.