Exchange 2010: Mailbox Audit Folder Size

How much space is consumed by turning on Mailbox Auditing?

When Mailbox Auditing is switched on (not on by default and not to be confused with Admin Auditing – that is on by default), all audit logs are saved into the /RecoverableItems/Audits folder of the user’s mailbox, therefore they move around with the mailbox.

To list all folders in a mailbox:

Get-MailboxFolderStatistics {user} | ft FolderPath

Confusingly, this command lists it as “/Audits”, dispite is actually being a sub-folder of /RecoverableItems.

To show the space used by Audits:

[PS] C:>Get-MailboxFolderStatistics walker -FolderScope RecoverableItems -IncludeAnalysis | ?{$_.FolderPath -eq ‘/Audits’} | select Identity, FolderSize, ItemsInFolderAndSubfolders

or:
[PS] C:>Get-MailboxFolderStatistics walker | ?{$_.Name -eq “Audits” -and $_.FolderType -eq “Audits”} | ft Identity, ItemsInFolder, FolderSize -AutoSize
Seems to be a little quicker. Source.

To confirm this command wasn’t returning nonsence:
[PS] C:Windowssystem32>Search-MailboxAuditLog walker -ShowDetails | Measure-Object

Example:


 
 
The two commands show the number of items as being the same.

And for all mailboxes (where CustomAttribute3 = “User”) and output to CSV:

[PS] C:>get-mailbox | ?{$_.CustomAttribute3 -eq ‘User’} | Get-MailboxFolderStatistics -FolderScope RecoverableItems -IncludeAnalysis | ?{$_.FolderPath -eq ‘/Audits’} | select Identity, FolderSize, ItemsInFolderAndSubfolders | Export-Csv C:TempAudit_FolderSize.csv
 


This cmdlet take quite a while to complete.

Excluding Service Accounts

Whilst on the subject of Mailbox Auditing, if you have service accounts like Blackberry Enterprise Services, Enterprise Vault etc, these accounts will generate thousands of log entries. I would strongly suggest you exclude these using:

Set-MailboxAuditBypassAssociation

Further info here.

Searching Audit Logs:

[PS] C:>Search-MailboxAuditLog -Identity walker
-LogonTypes Delegate -ShowDetails -StartDate "24/11/2013"

-EndDate “25/11/2013” | ft Operation, OperationResult, `
LogonUserDisplayName, ItemSubject, LastAccessed, -AutoSize
 
 
 
 
 
 
 
 

Please feel free to leave a comment...