Change Auditor

Searching for email subject in audit log

In ChangeAuditor (for Exchange) ver 6.9.3, is there a way to locate an event based on the subject line of the email message?  For example, several people have access to a shared mailbox. Someone improperly moved a message. The manager would like to know who moved that specific message, sometime over a 2 week period. The problem is that there are thousands of "non-owner moved a message" events over that given timeframe. It would be much easier if I could look for events based on the message subject.

No Data
  • I have tried narrowing the search, but still have thousands of results. Filtering by description didn't return matching subject lines. I'll try to fiddle around with that some more, maybe my filtering context is wrong.

    How about querying SQL? Any notes on a way to construct a sql query to pull out the subject line? I assume the subject line is in the database since it appears in the search results.
No Data