An error occurred while trying to access the audit log

Roger Roger 5,046 Reputation points
2024-05-26T05:58:30.8366667+00:00

Hi All I am getting below error when executing this syntax.

Write-ErrorMessage : |Microsoft.Exchange.Data.ApplicationLogic.AuditLogException|An error occurred while trying to access the audit log. For more details, see the inner exception.

Search-MailboxAuditLog user1@contoso.com -LogonTypes Owner,Delegate,Admin -ShowDetails | Export-CSV C:\temp\output.csv –NoTypeInformation -Encoding utf8

Search-MailboxAuditLog user1@contoso.com -operations HardDelete,SoftDelete,MoveToDeletedItems -LogonTypes Owner,Delegate,Admin -ShowDetails | Export-CSV C:\temp\output.csv –NoTypeInformation -Encoding UTF8
Microsoft Exchange Online
Exchange Server
Exchange Server
A family of Microsoft client/server messaging and collaboration software.
1,169 questions
Microsoft Exchange Online Management
Microsoft Exchange Online Management
Microsoft Exchange Online: A Microsoft email and calendaring hosted service.Management: The act or process of organizing, handling, directing or controlling something.
4,342 questions
Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
7,465 questions
Microsoft Exchange Hybrid Management
Microsoft Exchange Hybrid Management
Microsoft Exchange: Microsoft messaging and collaboration software.Hybrid Management: Organizing, handling, directing or controlling hybrid deployments.
1,974 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Xintao Qiao-MSFT 795 Reputation points Microsoft Vendor
    2024-05-27T09:34:45.27+00:00

    Hi,Roger Roger

    Based on your question, I understand that you are experiencing an error when running the command.

    You could provide more information about the error so that I can take the next step in troubleshooting.

    After my tests, the command you provided has no syntax errors and is able to export the .csv file successfully. My test results are shown below.

    csv1A screenshot of a computerDescription automatically generated

    Regarding your error message, you could try the following steps:

    1. The Search-MailboxAuditLog cmdlet may be deprecated. You will need to switch to a Search-UnifiedAuditLog cmdlet. For more information, please check Important Announcement: Deprecation of AdminAuditLog and MailboxAuditLog Cmdlets - Microsoft Community Hub
    2. Ensure that the account performing the action has the required permissions to access the audit log. For permissions needed, please see Find the permissions required to run any Exchange cmdlet | Microsoft Learn. You also could test with another admin account and check if the issue persists.
    3. Check that the parameters are spelled correctly. Ensure that the e-mail address or the path where the file is stored is entered correctly.
    4. Did you get the error with other commands, such as Get-MessageTrackingLog ?

    If my answer is helpful to you, please mark it as the answer so that other users can refer to it. Thank you for your support and understanding.