Hi all,

I'm trying to figure out what this IIS (OWA) logs mean and hope the experts here could shed some light :)

1) Looking at the cs(User-agent) field, am I correct to say that the request was done by MS Outlook?

2) What kind of request was that? What request /EWS/Exchange.asmx could mean?

3) Any way that the request was done by a browser accessing OWA?

Thanks!

date	time	s-ip	cs-method	cs-uri-stem	cs-uri-query	s-port	cs-username	c-ip	cs(User-Agent)	sc-status	sc-substatus	sc-win32-status	time-taken
8/29/2013	12:03:35	172.77.8.96	POST	/EWS/Exchange.asmx	-	443	ABC-DC\user123	2.200.70.21	Microsoft+Office/14.0+(Windows+NT+6.1;+Microsoft+Outlook+14.0.4760;+Pro)	200	0	64	2761
8/29/2013	12:03:52	172.77.8.96	POST	/EWS/Exchange.asmx	-	443	ABC-DC\user123	2.200.70.21	Microsoft+Office/14.0+(Windows+NT+6.1;+Microsoft+Outlook+14.0.4760;+Pro)	200	0	64	3993

1. Yes - recent versions of Outlook use Exchange Web Services to get mailbox data. If you have time to read something about it http://msdn.microsoft.com/en-us/library/exchange/dd877012(v=exchg.150).aspx#bk_ewssoap .

2. The POST to EWS/Exchange.asmx is how Outlook communicates with the Client Access Server. Exchange Web Services is an http-based protocol.

3. No. All requests by the OWA client go to /owa.

Hi,

Here is a reference about IIS log and it can help you understand IIS log clearly.
http://msdn.microsoft.com/en-us/library/ms525410(v=vs.90).aspx

Hope it can help you.

Thanks,
Angela Shi