EAS Report Details Exchange Server 2007
Exchange ActiveSync Info > Exchange ActiveSync Reporting > Reports Generated by Export-ActiveSyncLog (Part 1 of 2)
Reports Generated by Export-ActiveSyncLog
The Export-ActiveSyncLog task creates six different types of reports for you as an IT Pro to get more visibility into how your users are using their Exchange ActiveSync devices.
-
Exchange ActiveSync Usage Report
-
Exchange ActiveSync Server Usage Report
-
Number of Hits (server sync) Hourly Report
-
HTTP Reponse Code Report
-
Policy Compliance Report
-
User Agent Report
Exchange ActiveSync Usage Report
Equivalent to SELECT (see columns below)
WHERE cs-uri-stem = '/Microsoft-Server-ActiveSync'
GROUP BY cs-username, cs-uri-query(DeviceId)
| Column (in Report) |
Description |
SQL-like statement |
| User Name (Key) |
User sending up the Sync Request |
cs-username |
| Device ID (Key) |
The device ID the user is using |
cs-uri-query |
| Device q Type |
The device type of the device. It is theoretically possible to get a conflict here, so the task will use the device type from the first appearance of each user/device ID pair. |
FIRST(DeviceType) |
| Items Sent |
This is the total number of items sent to the device |
SUM(serverAdds + serverChanges) |
| Items Received |
This is the total number of items sent from the device |
SUM(clientAdds + clientChanges) |
| Hits |
This is the total number of HTTP requests |
COUNT(*) |
| Total Bytes Sent |
This is the total amount of bytes sent to the CAS Server for ActiveSync per user within the specified date range. |
SUM(sc-bytes) |
| Total Bytes Received |
This is the total amount of bytes received from the CAS Server per user within the specified date range. |
SUM(cs-bytes) |
| Total Emails Sent |
# of Adds sent to device |
SUM(serverAdds) WHERE ItemType='Em' |
| Total Emails Received |
# of SendMail, SmartReply and SmartForward commands |
COUNT(*) WHERE Cmd='SendMail' OR Cmd='SmartReply' OR Cmd='SmartForward' |
| Total Calendar Sent |
# of Adds, Changes to device (from server) |
SUM(serverAdds + serverChanges) WHERE ItemType='Ca' |
| Total Calendar Received |
# of Adds, Changes to server (from device) |
SUM(clientAdds + clientChanges) WHERE ItemType='Ca' |
| Total Contacts Sent |
# of Adds, Changes to device (from server) |
SUM(serverAdds + serverChanges) WHERE ItemType='Co' |
| Total Contacts Received |
# of Adds, Changes to server (from device) |
SUM(clientAdds + clientChanges) WHERE ItemType='Co' |
| Total Tasks Sent |
# of Adds, Changes to device (from server) |
SUM(serverAdds + serverChanges) WHERE ItemType='Ta' |
| Total Tasks Received |
# of Adds, Changes to server (from device) |
SUM(clientAdds + clientChanges) WHERE ItemType='Ta' |
| Total OOF Messages Set by Client |
We will make this change to log in the SETTINGS command |
COUNT(*) WHERE Cmd='Settings' AND OofVerb='Set' |
| Total OOF Messages Retrieved from Server |
We will make this change to log in the SETTINGS command |
COUNT(*) WHERE Cmd='Settings' AND OofVerb='Get' |
| Total Searches requested |
This is the total number of searches that this user performed in the aggregated period. |
COUNT(*) WHERE Cmd='Search' |
| Total SharePoint Access |
Extend the Protocol to have Item Operations write this into the log. |
SUM(SharePointDocs) |
| Total UNC Access |
Total number of times this user accessed a file located at a UNC path. |
SUM(UNCFiles) |
| Total Attachment Downloads |
Total number of Attachments being downloaded |
SUM(Attachments) |
| Total Attachment Size |
Sum of the # of bytes downloaded for the Attachment. |
SUM(AttachmentBytes) |
| Currently Compliant with Policy |
This aggregate will help the admin determine if there are any users who have ever been non-compliant with the mobile sync policies. Admin will then be able to drill in to see why they are not compliant.NOTE: Display in report, the last time written. |
LAST(PolicyAckStatus) |
An extra row at the bottom of the CSV will contain totals for the following columns:
Equivalent to SELECT (see columns below)
WHERE cs-uri-stem = '/Microsoft-Server-ActiveSync'
| Column (in Report) |
Description |
SQL-like statement |
| Total Items Sent |
This column is the total items sent across all ActiveSync users grouped by Email, Calendar, Contacts, Tasks. |
SUM(sc-bytes) |
| Total Bytes Sent |
This column is the total bytes sent across all ActiveSync users grouped by Email, Calendar, Contacts, Tasks. |
SUM(cs-bytes) |
| Total Items Received |
This column is the total items received across all ActiveSync users grouped by Email, Calendar, Contacts, Tasks. |
SUM(clientAdds + clientChanges) |
| Total Bytes Received |
This column is the total bytes received across all ActiveSync users grouped by Email, Calendar, Contacts, Tasks. |
SUM(serverAdds + serverChanges) |
Exchange ActiveSync Server Usage Report
Equivalent to SELECT (see columns below)
WHERE cs-uri-stem = '/Microsoft-Server-ActiveSync'
GROUP BY s-computername, cs-host, s-ip
| Column (in Report) |
Description |
SQL-like statement |
| Server (Key) |
Server Name |
s-computername (optional) |
| Host (Key) |
This is the Server Name |
cs-host (optional) |
| IP Address (Key) |
This is the server's IP address |
s-ip (optional) |
| Avg Unique Devices |
This is the average number of unique devices that connected to the CAS Server within a day. |
AVERAGE(COUNT(*)) GROUP BY date |
| Total Hits |
This is the total number of hits that the CAS received within the specified data range. |
COUNT(*) |
| Total Bytes Sent |
This is the total amount of bytes sent by ActiveSync protocol via IIS within the specified date range. |
SUM(sc-bytes) |
| Total Bytes Received |
This is the total amount of bytes received from the ActiveSync protocol within the specified date range. |
SUM(cs-bytes) |
Number of Hits (server syncs) Hourly Report
This report will provide a break down of the total number of sync requests + the count of unique devices within an hour period. The report will be spread across a week (if enough data is available in IIS Log).
Equivalent to SELECT (see columns below)
WHERE cs-uri-stem = '/Microsoft-Server-ActiveSync'
GROUP BY date.DayOfWeek, time.Hour
| Column (in Report) |
Description |
SQL-like statement |
| Day (Key) |
This is the day of the week within the specified date range. Eg. Monday To get this we will need to look up the day of the week based on the date value in the log. NOTE: If the date range is greater than a week, then the Day of week will overlap across the total number of weeks. This will actually prove beneficial to our IT Pros b/c they can see trending data. |
dateTime.DayOfWeek |
| Hour (Key) |
This is the hour period that the data will be grouped by.Eg. 2 for 2:59 AM, 15 for 3:23 PM |
dateTime.Hour |
| Unique Devices |
This is the total count of unique devices that connected within the hour grouping |
COUNT(*) GROUP BY DeviceID |
| Sync Related Requests |
This is the total count of sync and GIE commands. |
COUNT(*) WHERE Cmd='Sync' OR Cmd='GetItemEstimate' |
This report will extract all response codes for the Active Sync activities and group them by status codes.
Equivalent to SELECT (see columns below)
WHERE cs-uri-stem = '/Microsoft-Server-ActiveSync'
GROUP BY sc-status, sc-substatus
| Column (in Report) |
Description |
SQL-like statement |
| Status (Key) |
This is the HTTP Status returned to the device |
sc-status |
| SubStatus (Key) |
This is a combination of both the Status and SubStatus fields within the log. By having the Substatus code, we’ll be able to show our Admins more granular data to help them determine if they have a problem or not. |
sc-substatus |
| Hits |
This is the total number of times the status was logged in IIS, filtered just for ActiveSync traffic. |
COUNT(*) |
| Ratio |
Percentage of total. |
COUNT(*) / TotalHits |
Continue (Part 2 of Reports generated by Export-ActiveSyncLog)(http://www.exchangeninjas.com/EASReportDetails2)
| 
