Skip to main content

Parsing SMTP Protocol log files with Monad

Now that SP2 is out in the wild and I’m starting to look more at what’s happening with SenderID (by the way if you haven't seen this already there is a great post on SenderID on the Exchange Team Blog). I wanted a way I could aggregate the information that is stored in the SMTP protocol logs so I could see for each domain that is sending me email what are the IP address’s of the mail servers and how many emails do have i recieved from each IP (and do this for a time period say the last 1-2 hours). I’ve had the beta of Monad which is the next version of the Windows Shell that will be in Vista (maybe) and E12 (downloadable for here) installed on my machine for a while and this seemed like a good task to take it out for a test drive. The main advantage of Monad from my point of view is being able to get access to all the objects in the .NET framework so this means you can finally get access to hashtables in your scripts (Perl users have had this for years). Hashtables are very versatile objects to use in scripts and are perfect for the sort of aggregation I wanted to do. Adam Barr has posted a very good example of using nested hash-tables that helped a lot with working out how to get this to work.

The script is relatively simple it takes two command-line parameters the first is the directory where the logs file are (can be network drive although be careful if you have really large log files) and the second parameter is the number of hours you want to look back. So the first couple of lines deal with inputting the parameters and next couple looks in the directory for any files that where modified within the time period imputed. The next part of the script does a line by line parse of the log file, the split method is used to break the log file into an array so each element can be processed as needed. Because I’m only interested in Inbound traffic there is an if statement to drop any outbound connections. And because I’m only interested in the “FROM” lines in the log file there’s some further if statements and also finally some code that does a time comparison so only the events within the inputted time period are processed. Because the time used in the log files is in UTC there’s some code that does the UTC conversion (this is a really cool compared to how you do this in VBS). The next part of script basically handles aggregating the domains into one hashtable and then creating a nested hashtable table to handle storing each of the IP address’s that are sending for that domain using a key derived from the IP-address’s and Domain name it also counts the number of email sent from each IP address. The last part to the script handles going back though the hashtable and displaying the data in a hierarchal format.

I’ve put a downloadable copy of the script here the script itself looks like the following

param([String] $LogDirectory = $(throw "Please specify path for a Log for Directory"),
[int32] $timerange = $(throw "Please specify a Time Range in Hours"))
$reqhash1 = @{ }
$Di = New-Object System.IO.DirectoryInfo $LogDirectory
foreach($fs in $Di.GetFileSystemInfos()){
if ($fs.LastWriteTime -gt [DateTime]::get_Now().AddHours(-$timerange) ){
foreach ($line in $(Get-Content $fs.Fullname)){
if ($line.Substring(0,1) -ne "#"){
$larry = $line.split(" ")
if ($larry[3] -ne "OutboundConnectionCommand"){
if ($larry[8] -eq "MAIL"){
$ltime = [System.Convert]::ToDateTime($larry[0] + " " + $larry[1])
if($ltime -gt [DateTime]::get_UtcNow().addhours(-$timerange)){
$femail = $larry[10].Substring($larry[10].IndexOf("<")+1,$larry[10].IndexOf(">")-$larry[10].IndexOf("<")-1)
$fdomain = $femail.Remove(0, $femail.IndexOf("@")+1)
$hashtabedit = $reqhash1[$fdomain]
if($hashtabedit.ContainsKey($larry[2] + "/" + $fdomain)){
$hashtabedit[$larry[2] + "/" + $fdomain] = $hashtabedit[$larry[2] + "/" + $fdomain] + 1
$hashtabedit.Add($larry[2] + "/" + $fdomain,1)
$reqhash2 = @{ }
$reqhash2.Add($larry[2] + "/" + $fdomain,1)
foreach ($htent in $reqhash1.keys){
$reqhash2 = $reqhash1[$htent]
foreach ($htent1 in $reqhash2.keys){
" " + $htent1.Substring(0,$htent1.IndexOf("/")) + " " + $reqhash2[$htent1]

Popular posts from this blog

Export calendar Items to a CSV file using EWS and Powershell

Somebody asked about this last week and while I have a lot of EWS scripts that do access the Calendar I didn't have a simple example that just exported a list of the Calendar events with relevant information to a CSV file so here it is.

I've talked on this one before in this howto  but when you query the calendar folder using EWS you need to use a CalendarView which will expand any recurring appointments in a calendar. There are some limits when you use a calendarview in that you can only return a maximum of 2 years of appointments at a time and paging will limit the max number of items to 1000 per call. So if you have a calendar with a very large number of appointments you need to break your query into small date time blocks. In this example script I'm just grabbing the next 7 days of appointments if you want to query a longer period you need to adjust the following lines (keeping in mind what I just mentioned)

#Define Date to Query
$StartDate = (Get-Date)
$EndDate = (Ge…

EWS Managed API and Powershell How-To series Part 1

I thought I'd start the year with a series of posts that goes back over the basics of using the EWS Managed API from Powershell and provides a modular remarked example that you can easily cut and paste to build your own scripts. Along the way in this series I'll show a whole bunch of examples around specific things.

As a starting point for versions this will be Powershell Version 2.0  and the EWS Managed API 1.1 (which will soon change to 1.2 once released)

The starting point for any EWS script your going to write is connecting to Exchange for which there are three important pieces of information you will need. Firstly you need to know the version of Exchange your running in this script its going to be held in the following variable

$ExchangeVersion = [Microsoft.Exchange.WebServices.Data.ExchangeVersion]::Exchange2010_SP1

Other valid values for Exchange 2007 would be

$ExchangeVersion = [Microsoft.Exchange.WebServices.…

Writing a simple scripted process to download attachmentts in Exchange 2007/ 2010 using the EWS Managed API

Every complicated thing in life is made up of smaller simpler building blocks, when it comes to writing a script (or any code really) the more of these little building blocks you have to figure out the more the process of solving a problem can become bewildering. The Internet generally provides you with lots of half eaten sandwiches of information something someone else has taken a bite out but a lot of the time half done, and as with any code its usefulness declines over time as new and better API's and methods are derived. In this post I'm going to go through a simple scripted process that hopefully covers a few more of these smaller building blocks that you might face when asked to come up with a simple costless solution to perform an automated business function with a script.

So the process im going to look at is one that comes up a lot and that is you have an Email that comes into to certain mailbox every day with a certain subject in my case "Daily Export" this …
All sample scripts and source code is provided by for illustrative purposes only. All examples are untested in different environments and therefore, I cannot guarantee or imply reliability, serviceability, or function of these programs.

All code contained herein is provided to you "AS IS" without any warranties of any kind. The implied warranties of non-infringement, merchantability and fitness for a particular purpose are expressly disclaimed.