hi, at the moment i am just testing so i have the queries available in the log parser studio library.
for example "activeSync report", "activeSync: Top 3 ActiveSync Users"
I run the log parser from a Hub transport.
"activeSync: Top 3 ActiveSync Users" Query Below:
SELECT TOP 3 cs-username AS UserID,
cs(User-Agent) AS DeviceType,
cs-uri-stem AS Vdir,
c-ip AS CLIENT,
cs-method,
Count(*)
FROM '[LOGFILEPATH]'
WHERE cs-uri-stem LIKE '%Microsoft-Server-ActiveSync%' AND cs-method LIKE 'OPTIONS'
GROUP BY UserID, DeviceType, Vdir, Client, cs-method
ORDER BY COUNT(*) DESC
regards