Exchange 2010 CAS Array Logging

Be careful to avoid burying your troubleshooters in data; Outlook will typically initiate between 4-12 RPC sessions to the CAS server per Outlook client. These connections are related to each other but the F5 will have really no way of knowing that and will log the connection details for each independent TCP session. I'm not sure what real value the information would have, as you'll see the logged-in usernames and remote workstation name (all part of the RPC and Kerberos/NTLM transactions) in your Exchange logging just fine. From those two pieces of information, it's just a quick jump to the true source IP.

 

 

We've got over 60,000 users connecting through one CAS array (we have multiple arrays) -- and had plenty of problems -- but under no situation would I have needed that data from the F5.

 

 

Just my two cents.