Exchange 2007/ 2010 Message tracking
September 20, 2010
I have been playing with Exchange over the weekend and trying to get my head round the message tracking function of it.
As you might be aware, its changed a lot from 2003 and its not as friendly to use. However I have worked out a way, with the help of TechNet of making it a bit more usful for you.
To start with, forget the Exchange console, we are going to be using PowerShell.
Open up the PowerShell on the server, the command that we need to use is “Get-MessageTrackingLog”, which is a bit unwieldy, so I Aliased that command by doing the following:
“Set-AliasTrack Get-MessageTrackingLog”
This means that I can now just use the command Track (you can use what you like, as long as its not used elsewhere) to do the same thing. If you want to see any other aliases just type “Get-Alias” and it will show you a list.
Now, say you want to see whats been happening on the Exchange server for today, just type:
Track –start “20/09/2010″
This will output something like this:
EventId Source Sender Recipients MessageSubject
——- —— —— ———- ————–
RECEIVE SMTP sys_adm@stoof.local {gavin@eekafreek…. Event Notificati…
DELIVER STORE… sys_adm@stoof.local {gavin@eekafreek…. Event Notificati…
Which is sort of useful I guess, but it could be much better…
To get some more information you can use the Format-List parameter to give you some more detailed output:
track -start “19/09/2010″ | Format-List
This as you will see dumps a lot of stuff to the command window, but its better to save it to a text file that can then be searched and formatted better:
track -start “19/09/2010″ | Format-List > c:\track.txt
On a busy exchange box this will output a lot of data, so you can filter it, in this example we are going to look for a subject line called test:
track -messagesubject “test” -start “20/09/2010″ | Format-List > c:\track.txt
You HAVE to know the Subject line correctly as you cant wild card it, however the above example will return a subject of Test, test, TEST, Testing etc etc
Another handy one to use is –sender
track -sender “gavin@domain.com” -start “20/09/2010″ | Format–List > c:\track.txt
This will return everything sent by that email user, you can also combine filters as shown:
track -messagesubject “test” -sender “gavin@domain.com” -start “20/09/2010″ | Format-List > c:\track.txt
There are a ton of searchable filters that you can use such as Server IP addresses, Server names, Timestamps, all sorts… Getting used to the Exchange PowerShell now will help you in the future, as Exchange admin is likely to be reliant on this completely in the future, and the GUI only suitable for very simple tasks.
