Filter the Exchange Logga events

Filter out uninteresting events to record only relevant entries. Filtering here means that filtered out events are not recorded.

This significantly increases the overview and reduces data volumes.

 

Understand the filter principles for Exchange Logga

The Exchange Logga Filter is designed as a blacklist filter. Blacklist means here: The Exchange Logga records to the maximum extent. You determine which events are not recorded (discarded).

 

The filter criteria work additively. An event is rejected if criterion 1 or criterion 2 or criterion 3 applies, or several criteria simultaneously.

 

The filter criteria are not correlated with each other. The events are evaluated by the Exchange Logga one after the other according to the criteria. In the case of a hit, the event is immediately rejected and no longer checked, regardless of whether another criterion has already been evaluated or not.

 

Example:

If user A is configured as an "action author" filter, all changes made by him in Exchange will be discarded, even if the actions or roles he has performed are not configured as a filter.

 

Configure the event filters for an Exchange Logga

1. The symbol indicates an Exchange Logga configuration.
2. Click the link.

 

1. Filter events from users.
2. Select one or more users and drag them to the right column. Events triggered by these users are not recorded (blacklist).

 

1. Filter events based on specific login types or actions.
2. Actions (lines) of login types (columns) with an eye icon are recorded.
3. You must enter a comment to save changes to the filter settings.

For more information about the monitored events, please see Mailbox audit logging in Exchange Server (© 2020 Microsoft, https://docs.microsoft.com/en-us/exchange/policy-and-compliance/mailbox-audit-logging/mailbox-audit-logging?view=exchserver-2019, obtained on January 29, 2020).