Unified Communications Analytics 8.8.3


	TIP: When specifying individual mailboxes as targets, it is recommended that you add the user mailboxes to a distribution group. You can then add the distribution group for the target mailboxes.

If you have an Exchange hybrid environment, you can configure an Exchange Online Mailbox Contents data source to collect Office 365 mailboxes. For more information, see Permissions needed for Exchange Mailbox Contents, Exchange Mailbox Content Summary, or Exchange Calendar data sources and Permissions needed for Exchange Online Mailbox Contents data .

In addition to message traffic, you can configure the mailbox contents collection to gather the following message information from the target mailboxes:

•

Subject

•

Body

•

File attachments

•

Localized send / receipt time (to time zone of working hours) and working hours
This option is used to show “after hours” and “response time” data in insights, based on the working hours set in the calendar for each mailbox.

•

Internet Message Headers (provides technical details about the message, such as who sent it, the software used to compose it, and the email servers that it passed through on its way to the recipient)

For information about how times are calculated on insights when you use the “response time” or “after hours” filters, see the section titled How the Filters Work in the UC Analytics User Guide.


	TIP: For some fields you can enter multiple values separated by a semi-colon (;). For details, see Entering multiple values in a field .

To set up an Exchange mailbox contents data collection

Click the gear icon

on the home page side bar.

Click Data Collection.

Click + beside the name of the target environment.

Select the Exchange Mailbox Contents check box.

Enable the data collection for this data source.


	NOTE: If you have installed more than one Data Engine (Collector), you have the option to select a different computer that hosts a data collector.,

Modifying the collection schedule

By default the data collection is set to run every four hours, aligned to midnight UTC. You can modify the run interval or you can set the collection to run at a specific time on specific days.

Set the schedule for the data collection:

Click Minimum amount of time between job runs: and select an hourly interval.

- OR -

Click Run job at: and select the specific job run time, the number of days between each job run, and a start date.

Selecting data to collect

Select the data to collect.

Recommendation
If you select Body or Internet Message Headers, it is recommended that you limit the number of mailboxes to a key group of user mailboxes for this specific data collection.

Specifying the LDAP connection parameters

Specify the Windows credentials for the LDAP connection

- OR -

Select the Use Data Engine service credential option.

Specifying the target mailboxes

You have different options for specifying the target mailboxes to be included:

•

Select all mailboxes.

•

Specify the mailbox server for the mailboxes.

•

Specify the organizational unit (OU) to which the mailboxes belong.

•

Specify certain mailboxes that you want collected.

When specifying certain mailboxes you can enter the common name or email address of a mailbox, a group. or a dynamic distribution group. For more information about using a dynamic distribution group for target mailboxes, see Using dynamic distribution groups to select target mailboxes .

Specifying data collection parameters for EWS connection

Select the versions of Exchange from which you want to collect data:

•

Collect from mailboxes on all supported Exchange versions

•

Specify a specific Exchange version from which you want to collect data.

Specify the credential used to collect the mailbox data. For more information see Permissions needed for Exchange Mailbox Contents, Exchange Mailbox Content Summary, or Exchange Calendar data sources .

Specify the URLs for the CAS (Client Access Servers or Client Access Services) to be used by Exchange Web Services (EWS).

•

Use Exchange auto-discovery for each mailbox

•

Specify the specific Exchange Web Services URLs


	TIP: In many Exchange environments, Exchange auto-discovery does not always work so it is recommended that you specify individual Exchange Web Services URLs.

When you specify the CAS for the EWS gathering, you must enter the URL for the server. For example, the URL might be:

https://MyCASServer/ews/Exchange.asmx

You can specify multiple CAS URLs to be used for the EWS gathering. If you specify multiple CAS URLs, data collection is faster. If you do not specify one or more CAS URLs, the Exchange Autodiscover service is used to find the CAS servers for the target mailboxes.

Collecting messages

You can set the collection scope to collect messages from the entire mailbox or only from the default (Inbox and Sent) folders. For performance reasons, you might want to only to collect messages from the Inbox and Sent folders.

•

Entire mailbox

•

Default folders

Expanding child groups for recipient parent groups

By default, the data source collects message data for groups that were direct message recipients and expands the groups to include any child groups that were message recipients. You have the option to restrict data collection to include only the groups that are direct message recipients.


	NOTE: If you have a lot of child groups that are hidden or deleted you might want to restrict the data collection to only groups that are direct message recipients.

Decide is you want to expand all child groups or only collect groups that are direct recipients by clicking Yes or No.

Advanced settings (not required for most deployments)

•

If you want to specify one or more explicit domain controllers instead of automatically discovering the domain controller, click Show Advanced Settings in the LDAP Collection Parameters section. For more information, see Specifying explicit domain controllers for LDAP connections . The domain controller must be a global catalog server.

If the Data Engine is in a different forest from the data to be collected, you must specify the domain controller you want to use for data collection. If you leave the default setting to automatically discover domain controller, the data collector selects a domain controller from the forest that hosts the Data Engine, not a domain controller from the forest from which you are collecting the data.

Click Save.

Tips for better performance for mailbox contents collection

You can specify more than one set of Exchange gathering credentials and you can specify more than one CAS server for EWS data collection.

If you specify multiple EWS credentials and multiple CAS servers, it allows the EWS gathering to collect data from more mailboxes in parallel. This will reduce the time that is needed to collect the data.

For information about the types of data collections and the rate at which message data is collected, see Determining where to install services .

You could also increase the Exchange throttling quota for the accounts used to collect the message data.


	IMPORTANT: If you configure a mailbox content data gathering to collect the message body, storage requirements can be doubled. It is strongly recommended that if you collect the message body, you specify only a limited number of target mailboxes for this data collection.

How many CAS URLs and credentials are needed for mailbox content data collection?

By increasing the number of CAS URLs and the number of credentials that are used for collection of the Exchange data, you can shorten the time that it takes EWS to collect the message data.

Assuming that Exchange throttling is set to the default value for the gathering credentials, the estimated collection times are as follows:

•

The initial data collection is a collection that collects 30 days data from all the target mailboxes. Messages that are older than 30 days are not collected even if they are still in the mailbox. You can expect a collection rate of 25 mailboxes an hour per CAS server/credential pair set.

You can change the number of days for the initial data collection period when you configure the connection on the Data Collection page under Admin Settings.

•

After the initial collection, each subsequent collection is an ongoing collection in which only new or changed messages are collected. The ongoing collection runs every 30 minutes. Collection times decrease and you can expect a collection rate of 100 mailboxes an hour per CAS server/credential pair set.

Do I need both Exchange Tracking Logs and Exchange Mailbox Contents collections?

Though the mailbox contents data collection and the Exchange tracking log data collection both gather message information, there are some differences.

Table 23. Comparison of Exchange tracking log and mailbox contents collections

Exchange tracking log data collection

Exchange mailbox contents data collection

The Exchange tracking log collection gathers message information for all mailboxes.

The mailbox contents collection gathers message information for only the specified target mailboxes.

The Exchange tracking log collection gathers both message data and DLP rule matches.

The mailbox contents collection (EWS) gathers only message data but includes specific data not found in tracking logs such as

•

file attachments

•

“in reply to”

•

time-of-day data.

The mailbox contents data collection can also include message body text if configured.

NOTE: If a message is collected through EWS and the message was sent from a mailbox user to a distribution group to which the user belongs, the user is counted only as a sender, not a recipient. If the tracking log collection was also run, that user is also counted as a recipient.

The Exchange tracking log collection is much faster than the mailbox contents collection.

The mailbox contents collection is much slower than the Exchange tracking log collection.

You run the Exchange tracking log collection against both Exchange mailbox servers and hub transport servers.

The mailbox contents collection accesses the Exchange CAS (Client Access Servers) to gather data.

For more detailed information, see What are the differences between the Exchange Mailbox Contents and Exchange Tracking Logs data sources? .

Creating an Exchange IIS Logs data source

You configure an Exchange IIS logs data source to collect mobile device activities such as messages sent, messages received, and device information from the IIS log files. You can also configure the Exchange IIS Logs data source to collect Outlook on the Web (OWA) logon information.

You must collect the logs of the IIS sites for both on your front-end Exchange Client Access Server (CAS) and on your back-end Exchange Mailbox servers. The back-end IIS logs are required for information about the number of messages that are downloaded and uploaded using ActiveSync.

•

For information about what permissions are required by the credentials for the data collection, see Permissions needed for the Exchange IIS Logs (ActiveSync and OWA) data source .

•

For information about how IIS logging must be configured on your Exchange CAS servers, see Appendix C: Configuring IIS Log Files to capture ActiveSync or OWA events .

•

For information about the ActiveSync events that are collected, see What ActiveSync events are collected and displayed in the insights? .


	TIP: For some fields you can enter multiple values separated by a semi-colon (;). For details, see Entering multiple values in a field .

To set up an Exchange IIS logs collection

Click the gear icon

on the home page side bar.

Click Data Collection.

Click + beside the name of the target environment.

Select the Exchange IIS Logs check box.

Enable the data collection for this data source.


	NOTE: If you have installed more than one Data Engine (Collector), you have the option to select a different computer that hosts a data collector.,

Modifying the collection schedule

By default the data collection is set to run every 4 hours, aligned to midnight UTC. You can modify the run interval or you can set the collection to run at a specific time on specific days.

Set the schedule for the data collection:

Click Run job every: and select an hourly interval.

- OR -

Click Run job at: and select the specific job run time, the number of days between each job run, and a start date.

Selecting data to collect

Select the check box for each type of data to be collected:

•

Exchange ActiveSync Events

•

Logons for Outlook on the Web (OWA)

LDAP Connection Parameters

Specify the Windows credentials to be used for the LDAP connection to Active Directory or select the Use Data Engine service credential option.

Targets

Select whether you want to collect data for all Exchange mailboxes or for only the mailboxes in specified organizational units (OUs).

IIS Log Collection Parameters

Enter the path location for the IIS log files that you want to collect.

Enter the credentials needed to access the Exchange server that hosts the log files.

Advanced settings (not required for most deployments)

•


	NOTE: If the Data Engine is in a different forest from the data to be collected, you must specify the domain controller you want to use for data collection. If you leave the default setting to automatically discover domain controller, the data collector selects a domain controller from the forest that hosts the Data Engine, not a domain controller from the forest from which you are collecting the data.