Wednesday, July 19, 2017

TransportAgentFactory type must be the Microsoft .NET class type of the transport agent factory.

The error correct in two ways :)

1. Install last CU for Exchange
2. Close and open "Exchange Management Shell"

How to log the names and size of attachments in messages (Exchange 2013/2016)

I want to share with you "Exchange TransportAgent" which log the names and size of attachments.
I test this agent on Exchange 2013 CU17 (15.00.1320.004) and Exchange 2016 CU6 (15.01.1034.026).

Download "AttachmentLog TransportAgent for Exchange 2013 CU17"

Download "AttachmentLog TransportAgent for Exchange 2016 CU6"

The location of the folder with logs can be controlled from the file "AttachmentLog.Config.xml"

Example of install:

001
002
003
004
005
$EXDIR="C:\MyAgents\AttachmentLog"
Net Stop MSExchangeTransport
Install-TransportAgent -Name "MyAttachmentLog" -AssemblyPath $EXDIR\AttachmentLog.dll -TransportAgentFactory MyAttachmentLog.Exchange.Agents.AttachmentLog.AttachmentLogFactory
Enable-TransportAgent -Identity "MyAttachmentLog"
Net Start MSExchangeTransport

Example of uninstall:

001
002
Uninstall-TransportAgent -Name "MyAttachmentLog"
Restart-Service MSExchangeTransport

Check Exchange version:

001
Get-Command Exsetup.exe | ForEach{$_.FileVersionInfo}

Example of results:



Wednesday, July 5, 2017

How to parse Windows DNS debug logs with Logparser: create statistics

In this article I share a powershell script that will help to identify anomalies in your DNS. Script create TOP-30 Queries and TOP-30 Clients. With the help of MS Logparser you can very quickly check the debug log files of windows-dns.

Download powershell script

1. Enable DNS debug log on all dns-servers
- set limit for file size
- set same path


2. Install on the PC from which you run the script Logparser

3. For script you have to set
- servers
- domains
- homefolder
- files with dns debug logs
- email server (anonymous smtp)
- user email

001
002
003
004
005
006
007
008
009
010
011
012
013
014
015
016
017
018
019
020
021
022
023
024
025
026
027
028
029
030
031
032
033
034
035
036
037
038
039
040
041
042
043
044
045
046
047
048
049
050
051
052
053
054
055
056
057
058
059
060
061
062
063
064
065
066
067
068
069
070
071
072
073
074
075
076
077
078
079
080
081
082
083
084
085
086
087
088
089
090
091
092
093
094
# Set variables
$HomeFolder = "D:\Scripts"
cd $HomeFolder
$LogParser = "C:\Program Files (x86)\Log Parser 2.2\LogParser.exe"
$Servers = @("dc1.blogspot.com","dc2.blogspot.com","dc3.blogspot.com")

$msg = new-object Net.Mail.MailMessage
$msg.From = "myscript@blogspot.com"
$msg.To.add("i-evgeny@blogspot.com")
$msg.Subject = "DNS-query statistics"
$msg.IsBodyHTML = $true
$SMTPServer = "smtp.blogspot.com"
$SMTPClient = New-Object Net.Mail.SmtpClient($SmtpServer, 25)

$LogTime = Get-Date -Format "yyyy-MM-dd_hh-mm-ss"
if (!(test-path "$HomeFolder\Logs")) {New-Item -ItemType directory -Path "$HomeFolder\Logs"}
$LogFile = $HomeFolder + "\Logs\DNSParser_"+$LogTime+".log"
$LogFile_top_domain = $HomeFolder + "\Logs\DNSParser_top_domain_" + $LogTime + ".log"
$LogFile_top_ip = $HomeFolder + "\Logs\DNSParser_top_ip_" + $LogTime + ".log"
$TempFile = $HomeFolder + "\DNSTemp.csv"
$DCs_str = ""
$i = 1
foreach ($d in $Servers) {
    if ($i -eq "1") {$DCs_str = "\\$($d)\c$\Scripts\Logs\Queries.log"
    } else {$DCs_str += ",\\$($d)\c$\Scripts\Logs\Queries.log"}
    $i++
}

# Logparser query: group by query, client ip

$query = """SELECT field8,CASE field16 WHEN NULL THEN field15 ELSE field16 END AS myquery INTO $($TempFile) FROM $DCs_str"""
$LogParserStr = "-i:TSV -iSeparator:space -nFields:16 -headerRow:OFF -nSkipLines:30 -o:csv " + $query
$LP = Start-Process -FilePath $LogParser -ArgumentList $LogParserStr -Wait -Passthru -NoNewWindow

Start-Sleep -s 15

$query_top_domain = """SELECT myquery, COUNT(myquery) INTO $LogFile_top_domain FROM $TempFile GROUP BY myquery ORDER BY COUNT(myquery) DESC"""
$LogParserStr = "-i:csv -o:csv " + $query_top_domain
$LP = Start-Process -FilePath $LogParser -ArgumentList $LogParserStr -Wait -Passthru -NoNewWindow

$query_top_ip = """SELECT Field8, COUNT(Field8) INTO $LogFile_top_ip FROM $TempFile GROUP BY field8 ORDER BY COUNT(field8) DESC"""
$LogParserStr = "-i:csv -o:csv " + $query_top_ip
$LP = Start-Process -FilePath $LogParser -ArgumentList $LogParserStr -Wait -Passthru -NoNewWindow

# Transformation query

$result_top_domain = import-csv $LogFile_top_domain
$good_result_top_domain = @()

for($i=0$i -le 29$i++) {
     $t=@()
     $good_name = $result_top_domain[$i].myquery -replace "\s" -replace "\(\d?\d\)","." -replace "^\." -replace "\.$"
     $t = new-object PSObject -Property @{
      Query = "$good_name";
      C = "$($result_top_domain[$i]."COUNT(ALL myquery)")"
     }
     $good_result_top_domain += $t
     $t=@()
}

# Create table for email

$msg.Body = "<html>
<body>TOP-30 Queries <br><br><table border=""0"" cellpadding=""3"" style=""font-size:8pt;font-family:Arial,sans-serif"">
<tr bgcolor=""#dddddd"">
<td valign=""top""><b>Query</b></td>
<td valign=""top""><b>Count</b></td>
</tr>
<tr bgcolor=""#dddddd"">
<td valign=""top"">"


foreach ($g in $good_result_top_domain) {
    $msg.Body += "$($g.query)</td><td valign=""top"">$($g.c)</td></tr><tr bgcolor=""#dddddd""><td valign=""top"">"
}

$result_top_ip = import-csv $LogFile_top_ip

$msg.Body += "</td></tr></table><br>TOP-30 Clients <br><br><table border=""0"" cellpadding=""3"" style=""font-size:8pt;font-family:Arial,sans-serif"">
<tr bgcolor=""#dddddd"">
<td valign=""top""><b>Clients</b></td>
<td valign=""top""><b>Count</b></td>
</tr>
<tr bgcolor=""#dddddd"">
<td valign=""top"">"


for($i=0$i -le 29$i++) {
     $msg.Body += "$($result_top_ip[$i].field8)</td><td valign=""top"">$($result_top_ip[$i]."COUNT(ALL Field8)")</td></tr><tr bgcolor=""#dddddd""><td valign=""top"">"
}
$msg.Body += "</td></tr></table></body></html>"

# Send statistics

$SMTPClient.Send($msg)

4. Schedule a task, runas account must have read permission for Debug files

Example of result:


Sunday, July 2, 2017

Quick start with PaloAlto active-active cluster and two ISP. Part2

In the first part we configured the cluster.
In the second part, we will configure two providers
Quick start :)
Case:
Active-Active cluster
Two ISP
Management IP 192.168.0.10/24
DNS IP 192.168.0.20, 192.168.0.30
Gateway 192.168.0.1
6 ethernet card (1 management, 1 local, 1 isp1, 1 isp2, 2 system replication)

1. Go to "Network – Virtual Routers – default – Static Routes". Create local and ISP


2. Go to "Network – Virtual Routers – default – Router Settings – ECMP" and enable "ECMP".
Commit config



3. Go to "Network – Interfaces". Check/assign a default virtual router for interfaces.


4. Go to "Policies - Security". Create a test access rule




5. Go to "Policies - NAT". Create nat-rules for two nodes


6. Let's check!