private IEnumerable <MailboxAuditLogRecord> SearchMailboxStorage(EwsAuditClient ewsClient, bool isArchive)
{
FolderIdType auditRootId;
bool auditExists = ewsClient.FindFolder("Audits", isArchive ? MailboxAuditLogSearchWorker.ArchiveRecoverableItemsRootId : MailboxAuditLogSearchWorker.RecoverableItemsRootId, out auditRootId);
if (auditExists)
{
TaskLogger.Trace("Search query filter is defined. Searching audit log messages in audit folder", new object[0]);
int maxCount = this.resultSize.IsUnlimited ? int.MaxValue : ((this.resultSize.Value > this.outputCount) ? (this.resultSize.Value - this.outputCount) : 0);
EwsAuditLogCollection logCollection = new EwsAuditLogCollection(ewsClient, auditRootId);
IEnumerable <MailboxAuditLogRecord> records;
if (this.queryString != null)
{
records = AuditLogSearchQuery.SearchAuditLogs <MailboxAuditLogRecord, QueryStringType>(logCollection, this.queryString, maxCount, TimeSpan.FromSeconds((double)this.searchTimeoutSeconds), new MailboxAuditLogSearchWorker.QueryStrategy(this), MailboxAuditLogSearchWorker.Tracer);
}
else
{
records = AuditLogSearchQuery.SearchAuditLogs <MailboxAuditLogRecord, RestrictionType>(logCollection, this.queryFilter, maxCount, TimeSpan.FromSeconds((double)this.searchTimeoutSeconds), new MailboxAuditLogSearchWorker.QueryStrategy(this), MailboxAuditLogSearchWorker.Tracer);
}
foreach (MailboxAuditLogRecord record in records)
{
yield return(record);
}
}
yield break;
}
// Token: 0x06000011 RID: 17 RVA: 0x000024D8 File Offset: 0x000006D8
private static MailboxConnectivity CheckMailboxConnectivity(MailboxConnectivity mailboxConnectivity)
{
try
{
mailboxConnectivity.Message = "Getting ADSessionSettings";
ADSessionSettings adsessionSettings = ADSessionSettings.RootOrgOrSingleTenantFromAcceptedDomainAutoDetect(mailboxConnectivity.TenantAcceptedDomain);
if (adsessionSettings == null)
{
mailboxConnectivity.Message = "ADSessionSettings were not found.";
return(mailboxConnectivity);
}
mailboxConnectivity.Message = "Creating IRecipientSession";
IRecipientSession tenantOrRootOrgRecipientSession = DirectorySessionFactory.Default.GetTenantOrRootOrgRecipientSession(null, true, ConsistencyMode.IgnoreInvalid, null, adsessionSettings, 223, "CheckMailboxConnectivity", "f:\\15.00.1497\\sources\\dev\\Management\\src\\ServiceHost\\Servicelets\\AuditLogSearch\\Program\\AuditLogSearchHealthHandler.cs");
if (tenantOrRootOrgRecipientSession == null)
{
mailboxConnectivity.Message = "IRecipientSession was not found.";
return(mailboxConnectivity);
}
bool flag = mailboxConnectivity.ExchangeUserId.CompareTo(Guid.Empty) == 0;
ADUser aduser;
if (flag)
{
mailboxConnectivity.Message = "Getting OrganizationId";
OrganizationId organizationId = OrganizationId.FromAcceptedDomain(mailboxConnectivity.TenantAcceptedDomain);
mailboxConnectivity.Message = "Finding arbitration mailbox";
aduser = AdminAuditLogHelper.GetTenantArbitrationMailbox(organizationId);
mailboxConnectivity.ExchangeUserId = aduser.ExchangeGuid;
}
else
{
mailboxConnectivity.Message = "Finding ADRecipient";
ADRecipient adrecipient = tenantOrRootOrgRecipientSession.FindByExchangeGuidIncludingAlternate(mailboxConnectivity.ExchangeUserId);
aduser = (adrecipient as ADUser);
}
if (aduser == null)
{
mailboxConnectivity.Message = "ADUser was not found.";
return(mailboxConnectivity);
}
mailboxConnectivity.Message = "Getting ExchangePrincipal";
ExchangePrincipal principal = ExchangePrincipal.FromADUser(aduser, null);
mailboxConnectivity.Message = "Creating EwsAuditClient";
EwsAuditClient client = new EwsAuditClient(new EwsConnectionManager(principal, OpenAsAdminOrSystemServiceBudgetTypeType.Default, ExTraceGlobals.ServiceletTracer), TimeSpan.FromSeconds(5.0), ExTraceGlobals.ServiceletTracer);
mailboxConnectivity.Message = "Checking connectivity";
AuditLogSearchHealthHandler.CheckMailboxConnectivity(client, false);
mailboxConnectivity.Message = "Checking connectivity (archive)";
AuditLogSearchHealthHandler.CheckMailboxConnectivity(client, true);
mailboxConnectivity.Message = "Ok";
mailboxConnectivity.Success = true;
}
catch (Exception ex)
{
mailboxConnectivity.Message += " FAILED.";
mailboxConnectivity.Exception = ex.ToString();
}
return(mailboxConnectivity);
}
// Token: 0x06000008 RID: 8 RVA: 0x00002260 File Offset: 0x00000460
private static void CheckMailboxConnectivity(EwsAuditClient client, bool isArchive)
{
FolderIdType folderIdType;
client.FindFolder("Audits", isArchive ? AuditLogSearchHealthHandler.ArchiveRecoverableItemsRootId : AuditLogSearchHealthHandler.RecoverableItemsRootId, out folderIdType);
}
public AdminAuditLogEvent[] Search()
{
TaskLogger.LogEnter();
TaskLogger.Trace("Search criteria:\\r\\n{0}", new object[]
{
this.searchCriteria.ToString()
});
if (DatacenterRegistry.IsForefrontForOffice())
{
return(this.SearchInFFO());
}
ADUser tenantArbitrationMailbox;
try
{
tenantArbitrationMailbox = AdminAuditLogHelper.GetTenantArbitrationMailbox(this.searchCriteria.OrganizationId);
}
catch (ObjectNotFoundException innerException)
{
TaskLogger.Trace("ObjectNotFoundException occurred when getting Exchange principal from the discovery mailbox user.", new object[0]);
throw new AdminAuditLogSearchException(Strings.AdminAuditLogsLocationNotFound(this.searchCriteria.OrganizationId.ToString()), innerException);
}
catch (NonUniqueRecipientException innerException2)
{
TaskLogger.Trace("More than one tenant arbitration mailbox found for the current organization.", new object[0]);
throw new AdminAuditLogSearchException(Strings.AdminAuditLogsLocationNotFound(this.searchCriteria.OrganizationId.ToString()), innerException2);
}
Exception ex = null;
ExchangePrincipal principal = ExchangePrincipal.FromADUser(this.searchCriteria.OrganizationId.ToADSessionSettings(), tenantArbitrationMailbox, RemotingOptions.AllowCrossSite);
AdminAuditLogEvent[] result;
try
{
TaskLogger.Trace("Opening EWS connection for the tenant arbitration mailbox", new object[0]);
EwsAuditClient ewsAuditClient = new EwsAuditClient(new EwsConnectionManager(principal, OpenAsAdminOrSystemServiceBudgetTypeType.Default, AdminAuditLogSearchWorker.Tracer), TimeSpan.FromSeconds((double)this.searchTimeoutSeconds), AdminAuditLogSearchWorker.Tracer);
FolderIdType folderIdType = null;
ewsAuditClient.CheckAndCreateWellKnownFolder(DistinguishedFolderIdNameType.root, DistinguishedFolderIdNameType.recoverableitemsroot, out folderIdType);
ewsAuditClient.CheckAndCreateWellKnownFolder(DistinguishedFolderIdNameType.recoverableitemsroot, DistinguishedFolderIdNameType.adminauditlogs, out folderIdType);
if (folderIdType == null)
{
result = Array <AdminAuditLogEvent> .Empty;
}
else
{
EwsAuditLogCollection logCollection = new EwsAuditLogCollection(ewsAuditClient, folderIdType);
AuditLogSearchId auditLogSearchId = this.searchCriteria.Identity as AuditLogSearchId;
IEnumerable <AdminAuditLogEvent> source;
if (this.UseFASTQuery())
{
QueryStringType queryFilter = this.GenerateFASTSearchQueryString();
source = AuditLogSearchQuery.SearchAuditLogs <AdminAuditLogEvent, QueryStringType>(logCollection, queryFilter, this.searchCriteria.ResultSize + this.searchCriteria.StartIndex, TimeSpan.FromSeconds((double)this.searchTimeoutSeconds), new AdminAuditLogSearchWorker.QueryStrategy(this.searchCriteria), AdminAuditLogSearchWorker.Tracer);
}
else
{
RestrictionType queryFilter2 = this.GenerateSearchQueryFilterForEWS();
source = AuditLogSearchQuery.SearchAuditLogs <AdminAuditLogEvent, RestrictionType>(logCollection, queryFilter2, this.searchCriteria.ResultSize + this.searchCriteria.StartIndex, TimeSpan.FromSeconds((double)this.searchTimeoutSeconds), new AdminAuditLogSearchWorker.QueryStrategy(this.searchCriteria), AdminAuditLogSearchWorker.Tracer);
}
if (this.searchStatistics != null)
{
this.searchStatistics.QueryComplexity = this.searchCriteria.QueryComplexity;
this.searchStatistics.CorrelationID = ((auditLogSearchId != null) ? auditLogSearchId.Guid.ToString() : string.Empty);
}
AdminAuditLogEvent[] array = source.Take(this.searchCriteria.ResultSize).ToArray <AdminAuditLogEvent>();
this.RedactCallerField(array);
if (this.searchStatistics != null)
{
this.searchStatistics.ResultsReturned += array.LongLength;
this.searchStatistics.CallResult = true;
}
result = array;
}
}
catch (StorageTransientException ex2)
{
ex = ex2;
TaskLogger.Trace("Search admin audit log failed with transient storage exception. {0}", new object[]
{
ex2
});
throw new AdminAuditLogSearchException(Strings.AdminAuditLogSearchFailed, ex2, this.searchCriteria);
}
catch (StoragePermanentException ex3)
{
ex = ex3;
TaskLogger.Trace("Search admin audit log failed with permanent storage exception. {0}", new object[]
{
ex3
});
throw new AdminAuditLogSearchException(Strings.AdminAuditLogSearchFailed, ex3, this.searchCriteria);
}
catch (AuditLogException ex4)
{
ex = ex4;
TaskLogger.Trace("Search admin audit log failed with storage exception. {0}", new object[]
{
ex4
});
throw new AdminAuditLogSearchException(Strings.AdminAuditLogSearchFailed, ex4, this.searchCriteria);
}
finally
{
if (this.searchStatistics != null && ex != null)
{
this.searchStatistics.ErrorType = ex;
this.searchStatistics.ErrorCount++;
}
TaskLogger.LogExit();
}
return(result);
}
