LOGbinder Blog

Updates, Tips and News   RSS Feed  

LOGbinder for Exchange 3.3.5 Released

Wed, 13 Jul 2016 18:15:30 GMT
We are happy to announce the release of the latest update to LOGbinder for Exchange.  The latest update, Version 3.3.5, introduces some improvements as well as a few bug fixes.  We know that some of our customers that utilize the LEEF Syslog output may have had a few issues with the format of the LEEF output.  This latest release fixes that issue.  We have also created a more robust installer for LOGbinder that automatically configures many of the prerequisites that previously had to be configured manually.  Click here to see a list of all of the latest enhancements and bug fixes.

In conjunction with this release, we have also added a new support section at LOGbinder.com that we will be keeping up-to-date with the latest news, bulletins and features of the entire suite of LOGbinder products.

LOGbinder for SharePoint Restricted Lookups Option

Wed, 06 Jul 2016 14:55:50 GMT

LOGbinder for SharePoint by default makes every effort to fully translate and enrich SharePoint audit events through so called "lookups" where-in LOGbinder makes extra queries to SharePoint to obtain this information.  But there is a cost/benefit relationship to be considered.  Some events in the native SharePoint audit log include fields that are of low or no value to end users at many organizations.  Each field in the native log, including these low or no value fields, requires a lookup by LOGbinder to resolve the native SharePoint data in to user friendly data.  

For example, below is a sample of LOGbinder for SharePoint event ID 13: 

Document checked in
Occurred: 6/25/2016 1:13:04 PM
Site: http://sp2010-sp
User: Administrator
  URL: Shared Documents/FinancialData.xlsx
  Title: n/a
  Version: 1.0 

As you can see in the above event, the “Title” field returned from SharePoint is “n/a”.  This is obviously of no value to the end user.  Since SharePoint includes these low/no value fields, LOGbinder for SharePoint includes an option to intelligently restrict the number of lookups it processes resulting in increased performance of LOGbinder.  You can manage the amount of SharePoint lookups by opening the LOGbinder Control Panel selecting File and then Options.  The amount of lookups performed by LOGbinder can be customized by choosing a value under “Amount of SharePoint lookups.”  See figure 1 below.

Figure 1: Managing the amount of SharePoint lookups

The fields that are affected (with the exception of the “Restrict all lookups option”) are all child fields of the targeted object.  “URL” is the most important field included in the events and that field is always reported except on some permission change events and only if the “Exclude high/medium-cost” option is selected. 

Most organizations who need to speed up LOGbinder can safely use the “Exclude high-cost lookups” option without losing significant audit information.  Please note that the “Exclude high/medium-cost” option does adversely impact permission change events. 

We have created a document that explains outlines which fields are affected depending on which option is selected when managing the amount of SharePoint lookups.  You can find a link to the document on the LOGbinder for SharePoint resources page or by clicking here.

previous | next

powered by Bloget™