Message Tracking in Microsoft Exchange 2010

 

In Microsoft Exchange Server 2010, the message tracking log is a detailed record of all message activity as messages are transferred to and from the Transport service on Mailbox servers, mailboxes on Mailbox servers, and Edge Transport servers.

Supported parameters

Get-MessageTrackingLog [-ServerServer:Identity.] [-ResultSize:Integer | Unlimited] [-Start:DateTime] [-End:DateTime] [-EventId EventId] [-InternalMessageId:InternalMessageId] [-MessageId MessageId] [-MessageSubject: Subject] [-Recipients RecipientAddress1,RecipientAddress2.] [-Reference: Reference] [-Sender: SenderAddress]

Some Optional Parameters

EventId – Filters the message tracking log entries by the value of the EventId field
Server – Specifies the Exchange server on which you want to run this command. (Name,FQDN,Distinguished name,Exchange Legacy DN)
ResultSize -  Specifies the maximum number of results to return (The default value is 1000)
MessageSubject - Filters the message tracking log entries by the value of the message subject.

To view the 1000 most recent message tracking log entries on the server, run the following command:

Get-MessageTrackingLog

This example searches the message tracking logs on the local server for all entries from 3/28/2013 8:00 AM to 3/28/2013 5:00 PM for all FAIL events where the message sender was tester@maildomain.com.

Get-MessageTrackingLog -ResultSize Unlimited -Start "mm/dd/yy 8:00AM" -End "mm/dd/yy 5:00PM" -EventId "send" -Sender "tester@maildomain.com"

Searches the message tracking logs for all send messages and writing them to a output to a txt file:

Get-MessageTrackingLog -EventId Send | Format-List Send*,Recipient* "D:\Send Search.txt"

To search all message tracking log entries for a specific message across all Mailbox servers, use the following syntax:

Get-ExchangeServer | where {$_.isHubTransportServer -eq $true -or $_.isMailboxServer -eq $true} | Get-MessageTrackingLog -MessageId ba18339e-8151-4ff3-aeea-87ccf5fc9796@mailbox01.contoso.com | Select-Object Timestamp,ServerHostname,ClientHostname,Source,EventId,Recipients | Sort-Object -Property Timestamp

Searches the message tracking logs for date range and sender namexxxxxxx@domain.com getting the Output to .csv file or you can save it to html as well by using convertto-html:

Get-MessageTrackingLog -ResultSize Unlimited -Start "mm/dd/yy 00:00AM" -End "mm/dd/yy 21:00PM" -Sender " xxxxxxx@domain.com " | convertto-Csv "c:\messtrack.csv"

Get a grid view of Message tracking with optional Commands (Select-Object, Out-Gridview)

Get-MessageTrackingLog -ResultSize Unlimited -Start "mm/dd/yy 00:01AM" -End "mm/dd/yy 23:59PM" | Select-Object TimeStamp, ServerHostname,ClientHostname,MessageSubject,Source,Sender,Recipients | Out-Gridview

@Roshan