There are a number of logs available from the content agent logs for antispam, Protocol logs, Send/Receive logs but this article will focus on one of my favorites Message Tracking.

When working in mixed Exchange 2003 and Exchange 2007 you have to manage each logs separately as the tools provided will not allow us to parse logs from different versions of the products.

Another item I found out in early beta was the GUI provided in Exchange 2007 only searches the logs on the server we are running the query from, we must user EMS to query all our servers.

Permissions:

Exchange 2007 RTM, the account you use must be delegated the following:

• Exchange Server Administrator role and local Administrators group for the target server

Exchange 2007 SP1, the account you use must be delegated the following:

• Exchange View-Only Administrator role

Edge Transport server role you must log on by using an account that is a member of the local Administrators group on that computer.

EMC

Click “toolbox” -> Under Mail flot tools –> Select Message tracking

when the this is first selected the tool will connect to Microsoft and see if there are any new updates.

next we are presented with the welcome screen

On the Message Tracking Parameters we have the ability to select from the following filters
Recipients, Sender, Server, Event ID (Receive, Send, Fail, DSN, Deliver, BadMail, Resolve, Expand), Message ID, Internal Message ID, Subject m reference, Start, and End

Once we have made our selections the window as the bottom shows up the EMS commands that will be run to retrive the logs

I sent a message from brian.tirch@vm.local to generate some log data, for my filters I selected Sender,Start, and End

We can see the 2 entries are returned 1. Receive and 1 for Deliver

We can see in the data returned that there are a number of fields listed that are not search able from EMC like client IP and Server IP

From this log we can see that the message was received from vmmbx1 to vmcashub and then delivered from vmcashub to vmmbx1

**Notice the only logs we have data are from the server which we ran the message tracking tool from**

http://technet.microsoft.com/en-us/library/bb124375(EXCHG.80).aspx

EMS:
Lets use EMS to search the message tracking logs and please reference the “How to Search Message Tracking Log” article below to see the differences between the available fields.

If we run the Get-Help command we can see the available switches.

C:\>get-help Get-MessageTrackingLog

Name
Get-MessageTrackingLog

SYNOPSIS
Use the Get-MessageTrackingLog cmdlet to search message information that i
stored in the message tracking log.

SyNTAX
Get-MessageTrackingLog [-DomainController ] [-End ] [-Even
Id ] [-InternalMessageId ] [-MessageId ] [-Message
ubject ] [-Recipients ] [-Reference ] [-ResultSi
e ] [-Sender ] [-Server ] [-Start ] []

let perform the same search as above and see if we get any different data:
Get-Messagetrackinglog -Sender “brian.tirch@vm.local” -Start “5/10/2008 7:42:00PM” -End “5/12/2008 7:52:00 PM”

you can see the first return is truncated

so we can pipe to the FL command to get more details

After viewing this the data both results are the same…..

Now we can add some parameters to our command so that we can pull logs from all servers.
Get-ExchangeServer | where {$_.isHubTransportServer -eq $true -or $_.isMailboxServer -eq $true} | Get-MessageTrackingLog

by piping the Get-ExchangeServer cmdlet to the Where command we can pull logs from all hubs servers and mailbox server to limit our filter to pull from selected servers.

Lets run the same command for Get-Messagetrackinglog but add the leading Where statement.

We can see now that we have an additional entry for Submit

the Submit entry shows the log from our mailbox server submitting a message to a hub server for delivery.

We can see that the message tracking logs can be vary useful in determining any issues or validating messages delivery.

How to Search Message Tracking Logs
http://technet.microsoft.com/en-us/library/bb124926.aspx

http://technet.microsoft.com/en-us/library/bb124375(EXCHG.80).aspx

http://technet.microsoft.com/en-us/library/aa997984(EXCHG.80).aspx