Script to parse message tracking logs

I need to parse 30 days worth of message tracking logs and produce a report that shows for 10 users, every external email address they sent mail to. There is a *lot* of data to go through so I'm hoping to find a script that can do this. Suggestions welcomed.

Find more posts tagged with

SAVE $250 on Your Boot Camp — Use Code "EXAM26"

Exclusively for TechExams members for Infosec Boot Camps starting before April 30, 2026

View Boot Camps

Comments

HeroPsycho

This is "easy" to do with PowerShell. However, PowerShell honestly sucks for parsing large amounts of logs. How much data do you typically have your message tracking logs to parse?

rsutton

I have almost 100MB worth of logs. =\

HeroPsycho

rsutton wrote: »

I have almost 100MB worth of logs. =\

No prob. I was meaning >500M log files!

get-childitem <path to logs> | select-string "text you want to search for in the logs"

That will get you every line in the logs in that path that contains text you're searching for.

Are you wanting something more intricate than that?

rsutton

That might be a start. Although I would need to apply some logic to the search. IE I need to find all recipients of emails that userA sent (and if possible exclude internal emails). So ideally the output I need to produce in some sort of a spreadsheet will have columns with data that looks like this:

Sender----|----Recipient----|----Date Sent----|----# of emails sent to recipient
UserA         external addy        10/01/2009          25

The last two columns are nice to have but not critical.

HeroPsycho

That's an awful lot of work. It can be done, but I just don't have the bandwidth to do it.

Perhaps it's time to consider an archiving product like Enterprise Vault with the Discovery Accelerator module.

rsutton

It's a one time thing for a specific number of logs so I might just outsource the job. Thanks for the suggestions!