The Quest Intrust Plug-in for Exchange product provides the EventIDManager.exe command-line tool which allows for enabling or disabling the generation of certain mailbox access events. However, this tool does not provide the switch that displays the list of currently enabled and disabled events, what can pose a problem.
This solution overviews possible ways around this problem.
The EventIDManager.exe command-line tool does not provide the switch that displays the list of currently enabled and disabled events.
Method 1:
Upon each restart of the Intrust Plug-in for Exchange service, an event with id 39 is logged in the Application log on the target Exchange Server which contains the list of all currently disabled event IDs. Below is the sample of this event:
Event Type: Information
Event Source: Quest InTrust For Exchange Auditing Service
Event Category: None
Event ID: 39
Date: 24-Dec-08
Time: 14:16:02
User: N/A
Computer: TX-EX1
Description:
Disabled events: 264, 273, 274, 275, 276, 277, 278, 301, 529, 530, 531, 532, 533, 534, 785, 786, 787, 788, 789, 790, 1041, 1042, 1043, 1044, 1045, 1046, 1297, 1298, 1299, 1300, 1301, 1302, 1553, 1554, 1555, 1556, 1557, 1558, 1809, 1810, 1811, 1812, 1813, 1814, 2065, 2066, 2067, 2068, 2069, 2070, 2321, 2322, 2323, 2324, 2325, 2326, 2577, 2578, 2579, 2580, 2581, 2582
Method 2:
Open file itexconfig .xml (found in Program Files\Quest Software\InTrust Plug-in for Exchange\Storage), find the node "EnabledAlerts" and jump to the element attribute name of the element "mv_attribute". The values of this attribute hold the currently enabled event IDs. Below is the sample of this section:
<node type="EnabledAlerts" ID="{3BCEEF3C-CB60-4DF3-8FC0-073188483998}">
<attribute name="ID" type="8" value="{3BCEEF3C-CB60-4DF3-8FC0-073188483998}"/>
<attribute name="InstanceVersion" type="8" value="1"/>
<attribute name="ParentID" type="0" value=""/>
<attribute name="Type" type="8" value="EnabledAlerts"/>
<mv_attribute name="EventCategories" type="8195">
<value val="3"/>
<value val="5"/>
<value val="6"/>
<value val="7"/>
<value val="255"/>
<satellite name="InstanceVersion" type="8" value="2"/>
</mv_attribute>
<mv_attribute name="Events" type="8195">
<value val="257"/>
..................
<value val="2307"/>
<value val="2308"/>
<value val="2309"/>
<value val="2310"/>
<value val="2561"/>
<value val="2562"/>
<value val="2563"/>
<value val="2564"/>
<value val="2565"/>
<value val="2566"/>
</mv_attribute>
