如何通过Exchange协议日志排查SMTP流量中使用旧版TLS的设备

核心问题说明 #

你之前没有得到输出的核心原因是直接用Select-String按纯文本匹配日志，忽略了Exchange SMTP接收日志本身是带标准表头的结构化CSV格式，纯文本匹配后无法关联字段、也没法按session-id跨条目关联数据。

完整实现步骤 #

• 步骤1：确认SMTP接收日志的存储路径，默认路径为C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\FrontEnd\ProtocolLog\SmtpReceive，如果自定义过路径请自行替换。
• 步骤2：在Exchange Management Shell中运行以下脚本：

# 定义日志路径和输出CSV路径
$logPath = "C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\FrontEnd\ProtocolLog\SmtpReceive\*.log"
$outputCsv = "C:\TLS1_0_Clients.csv"

# 第一步：提取所有使用TLS1.0的会话ID
$tls10Sessions = @()
Get-ChildItem -Path $logPath | ForEach-Object {
    $logContent = Import-Csv -Path $_.FullName -Header "date-time","connector-id","session-id","sequence-number","local-endpoint","remote-endpoint","event","data","context" -ErrorAction SilentlyContinue
    $tls10Entries = $logContent | Where-Object {$_.data -eq "SP_PROT_TLS1_0_SERVER"}
    $tls10Sessions += $tls10Entries | Select-Object "session-id",@{Name="TlsDetectTime";Expression={$_."date-time"}}
}
$tls10SessionIds = $tls10Sessions."session-id" | Select-Object -Unique

# 第二步：按会话ID提取对应的EHLO和MAIL FROM信息
$result = @()
Get-ChildItem -Path $logPath | ForEach-Object {
    $logContent = Import-Csv -Path $_.FullName -Header "date-time","connector-id","session-id","sequence-number","local-endpoint","remote-endpoint","event","data","context" -ErrorAction SilentlyContinue
    $targetSessions = $logContent | Where-Object {$tls10SessionIds -contains $_."session-id"}
    # 按会话ID分组处理
    $sessionGroups = $targetSessions | Group-Object "session-id"
    foreach ($group in $sessionGroups) {
        $ehloEntry = $group.Group | Where-Object {$_.event -eq "EHLO"} | Select-Object -First 1
        $mailFromEntry = $group.Group | Where-Object {$_.event -eq "MAIL" -and $_.data -like "FROM:*"} | Select-Object -First 1
        $tlsTime = $tls10Sessions | Where-Object {$_."session-id" -eq $group.Name} | Select-Object -ExpandProperty TlsDetectTime -First 1
        $result += [PSCustomObject]@{
            SessionId = $group.Name
            TLS10DetectTime = $tlsTime
            RemoteIP = $group.Group[0]."remote-endpoint".Split(':')[0]
            EHLOHost = $ehloEntry.data
            MailFrom = if ($mailFromEntry) {$mailFromEntry.data.Replace("FROM:","")} else {$null}
        }
    }
}

# 去重后导出CSV
$result | Select-Object SessionId,TLS10DetectTime,RemoteIP,EHLOHost,MailFrom -Unique | Export-Csv -Path $outputCsv -NoTypeInformation -Encoding UTF8

注意事项 #

• 日志量较大时可以先筛选指定时间范围的日志文件，避免运行时间过长
• 如果需要提取后端传输服务的SMTP接收日志，路径替换为C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Hub\ProtocolLog\SmtpReceive即可
• 输出的CSV额外包含客户端远程IP，方便直接定位未升级TLS的设备

内容的提问来源于stack exchange，提问作者Aridaen