Export extended Exchange Admin Audit Logs to a csv file

Create a powershell script file and save it as C:\ExchangeLogs\Exchange.PS1

For daily logs:

$a = Search-AdminAuditLog -StartDate (Get-Date).AddDays(-1)  
$a | select CmdletName,ObjectModified,CmdletParameters,ModifiedProperties,Caller,ExternalAccess,Succeeded,Error,RunDate | Export-Csv "C:\ExchangeLogs\ExtendedAuditLogs_$(get-date -f yyyy-MM-dd).csv" -NoTypeInformation

For hourly logs:

$a = Search-AdminAuditLog -StartDate (Get-Date).AddHours(-1)
$a | select CmdletName,ObjectModified,CmdletParameters,ModifiedProperties,Caller,ExternalAccess,Succeeded,Error,RunDate, @{Expression={$_.CmdletParameters.Name};Label="Parameter Name";},@{Expression={$_.CmdletParameters.Value};Label="Parameter Value";} | Export-Csv "C:\ExchangeLogs\ExtendedAuditLogs_$(get-date -f yyyyMMddHHmm).csv" -NoTypeInformation

Modify paths according to your server.

Create a Windows schedules task to perform the daily or hourly export. Check this post for Exchange specific arguments in the Task Scheduler: https://blog.ahasayen.com/schedule-powershell-exchange-script/

In the Program/Script, type C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

In the Add Arguments (Optional) ,type

 -command ". 'c:\Program Files\Microsoft\Exchange Server\V15\bin\RemoteExchange.ps1'; Connect-ExchangeServer -auto; C:\ExchangeLogs\Exchange.PS1

In the Start in (Optional), leave it empty