Настройка MS Exchange для Alertix

Установите агента Alertix на серверы с Microsoft Exchange и создайте отдельную конфигурацию, в которой включите модуль Filebeat. Подготовьте конфигурацию модуля filebeat (укажите требуемые пути к журналам). Пути могут отличаться в зависимости от выполняемой сервером роли (функционирующих сервисов Exchange https://docs.microsoft.com/ru-ru/exchange/server-roles) и пути установки сервера в ОС.

Пример конфигурации:

filebeat.inputs:
    - paths:
        # Mailbox servers:
        # - MSGTRK files for the Transport service
        # - MSGTRMD files for the Mailbox Transport Delivery service
        # - MSGTRMS files for the Mailbox Transport Submission service

        # Transport service on Edge Transport servers:
        - C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\MessageTracking\*

        type: log
        enabled: true
        exclude_lines: ["^#"]
        tags: ["exchange", "msgtrk"]

    - paths:
        # Mailbox servers:
        # Front End Transport service Receive connectors:
        - C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\FrontEnd\ProtocolLog\SmtpReceive\*
        # Front End Transport service Send connectors:
        - C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\FrontEnd\ProtocolLog\SmtpSend\*
        # Transport service Receive connectors:
        - C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Hub\ProtocolLog\SmtpReceive\*
        # Transport service Send connectors:
        - C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Hub\ProtocolLog\SmtpSend\*
        # Mailbox Transport Delivery service (Receive Connectors):
        - C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Mailbox\ProtocolLog\SmtpReceive\Delivery\*
        # Mailbox Transport Submission service Send connectors:
        - C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Mailbox\ProtocolLog\SmtpSend\Submission\*
        # Mailbox Transport Submission service Side effect messages:
        - C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Mailbox\ProtocolLog\SmtpSend\Delivery\*
        # Transport service on Edge Transport servers Receive connectors:
        - C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Edge\ProtocolLog\SmtpReceive\*
        # Transport service on Edge Transport servers Receive connectors:
        - C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Edge\ProtocolLog\SmtpSend\*

        type: log
        enabled: true
        exclude_lines: ["^#"]
        tags: ["exchange", "smtp"]

    - paths:
        - C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Egde\AgentLog\*
        # - %ExchangeInstallPath%TransportRoles\Logs\Hub\AgentLog

        type: log
        enabled: true
        exclude_lines: ["^#"]
        tags: ["exchange", "antispam"]

filebeat.config.modules:
    path: $\{path.config}/modules.d/*.yml
    reload.enabled: false

output.logstash:
    ssl.enabled: true
    ssl.verification_mode: none

processors:
    - drop_fields:
        fields: ["agent.ephemeral_id", "agent.hostname", "agent.id", "agent.type", "agent.version", "agent.name", "ecs.version", "input.type", "log.offset", "version"]

Следует обратить внимание, что для версии Alertix 3.5 и выше тег "exchange" является обязательным. Для версии Alertix 3.4 антиспам агент подключается тегом "exchantispam".