Message Tracking In Exchange 2003 & 2007
In most organizations, employees complain about undelivered mails making message trackings a need. Troubleshooting this problem leads to analysis of log files maintained by exchange server. This tutorial covers message tracking in exchange 2007.
You can’t do configuration in ‘Exchange Management Console (EMC)’ compared to ‘Exchange Management Shell’ (EMS). By default, message tracking is enabled in Microsoft Exchange 2007. The only way to confirm is:
- Open EMC then expand Server Configuration. Next step is to select the Hub Transport Server and finally, click on the properties of Hub Server.
- Properties of the Hub Server will show the General tab. In order to track message, select Log Settings tab.
– Under Message tracking log of Log Settings tab, check the box of Enable tracking log file logging and Message tracking log file path. Specify the default setting of messaging tracking. Next, checked both the mean enabled and path to log file. Message tracking can be disabled, not recommended, by un-checking the checkbox and the log file path can be changed using Browse button.
- You can also verify above in the EMC portion. Open EMC and write ‘Get-TransportServer <SERVERNAME>’, then press enter.
Configuration for message tracking is done in EMS. So first, we need to see the default setting for message tracking in exchange server. A user having either Hub or mailbox server role can do the following:
- Open EMS then write command, ‘Get-TransportServer <SERVERNAME> | fl *messagetracking*’, for users with Hub server role or ‘Get-TransportServer <SERVERNAME> | fl *messagetracking*’with mailbox server role.
Note: If you have both roles, you can work with either of the two.
In the above figure, we used ‘Get-TransportServer <SERVERNAME> | fl *messagetracking*’. The ‘fl’ does the filtering job to show only ones concerning message tracking while the output of command shows size parameter values for message tracking namely:
- Message Tracking Log Enabled
- Message Tracking Log Max Age
- Message Tracking Log Directory Size
- Message Tracking Log File Size
- Message Tracking Log Path
- Message Tracking Log Subject Logging Enabled
Previously, we have talked about the first and second last in EMC. Let’s go through each of them.
Message Tracking Log Enabled tells if message tracking is enabled or not. It is enabled, by default, in exchange server 2007 under Mailbox, Hub and Edge Transport Server roles. We can disable in EMC by un-checking ‘Enable tracking log file logging’ under Log settings tab of the properties of either server role. Using EMS, we can achieve this:
Set-TransportServer <SERVERNAME> -MessageTrackingLogEnabled $false
Message Tracking Log Max Age is the age limit of message tracking log. The default age limit in exchange 2007 is 30 days. If you want to change this setting, refer to the illustration below:
Set-TransportServer <SERVERNAME> -MessageTrackingLogMaxAge DD: HH:MM:SS
Message Tracking Log Directory Size specifies maximum message tracking log file size. If size exceeds that limit, the oldest logs are deleted which are replaced with new entries. Default size limit in exchange server 2007 is 250MB. The command to specify new settings is:
Set-TransportServer <SERVERNAME> -MessageTrackingLogMaxDirectorySize <Size with Unit>
Note: Unit in command can be megabytes (MB), kilobytes (KB), gigabytes (GB), terabytes (TB) or bytes (B).
Message Tracking Log File Size specifies the inpidual message tracking log file size, 10 MB, by default. New, log, file size can be set by using the command option shown below:
Set-TransportServer <SERVERNAME> -MessageTrackingLogMaxFileSize <Size with Unit>
As the name suggests, Message Tracking Log Path locates log file path. Default is an exchange installation drive with Program FilesMicrosoftExchange ServerTransportRolesLogsMessageTracking. The New can be set by a command:
Set-TransportServer <SERVERNAME> -MessageTrackingLogPath <LOGPATH>
Message Tracking Log Subject Logging Enabled gives you the ability to locate the subject message. It is enabled by default and can be unset using command
Set-TransportServer <SERVERNAME> -MessageTrackingLogSubjectLoggingEnabled $false
Inside Message Tracking Log files: They reside either on path specified, shown below, or default entered on installation:
In the above figure, MSGTRK prefix log file is found on either Hub or Edge Transport server which MSGTRKM are seen in the mailbox server. With our server having both roles, the log for each can be seen. Figures below show what lies inside each of them. In the first four lines, the log files maintain exchange server information while successive log entries are followed. Message logs are comma separated with format specified in line five. Each field is self-explanatory, so take your time. Once you are done move to next step.
How to Search a Log:
Message tracking in exchange server is done through EMS or Message tracking tool. EMC has no option to that configuration. We will track EMS for this tutorial. All exchange messages can be tracked (or seen) by command Get-MessageTrackingLog but it is difficult to locate few in the whole lot. So we can use filtering on the command for desired messages.
For example, with Get-MessageTrackingLog, we can specify and switch of any of the five columns, EventID, Source, Sender, Recipients and MessageSubject, in command among others.
Above figure shows all received messages filtered with EventID RECEIVE.
Conclusion: This tutorial covers all about message tracking in Exchange Server 2007, including analysis of their log files.
