Hello! Please help me to solve the problem with Search-MailboxAuditLog and Search-AdminAuditLog (in ECP).I have test environment with EXCHANGE_2013_CU6_RUSSIAN (all exch roles on it) and want to check audit before production use.I was surprised that audit no working, i do that:
1) Enable and check audit for Test mailbox
2) Add Delete Actions to Owner of mailbox (in my case - Test) for fast checking
3) Login to Outlook under Test and delete 1 item, after thatcheck folder statistic for Test mailbox
4) Return to Outlook and delete one more item and see statistic again (for sure)
5) As we can see something write to audit folder, it's good, BUT:<o:p></o:p>Resume:Search-MailboxAuditLog - NO RESULT, with any parameters
Another problem -> Search-AdminAuditLog - HAVE RESULT, but from ECP i don't see it.
My TEST DB have healthy status of indexes, no problem with system mailbox but i have russian exchange. Maybe trouble in different language (not English) wrong parse logs or something else? I really need audit reports in production, it's very serious question, please help!!!