Message Tracking CMDlets

Home/Exchange Server/Message Tracking CMDlets

Message Tracking CMDlets

Search by Message ID
Get-ExchangeServer | get-messagetrackinglog -MessageID “<messageID>” -Start “5/16/2012 12:01:00 AM” -End “5/16/2012 11:59:00 PM” | fl Timestamp,ClientIp,ClientHostname,ServerIp,ServerHostname,Source,EventId,MessageId,Recipients,RecipientStatus,TotalBytes,MessageSubject,Sender,ReturnPath,MessageLantency

Search by Sender
Get-ExchangeServer | get-messagetrackinglog -sender user@domain.com -Start “11/15/2012 12:00:00 AM” -End “11/16/2012 11:59:00 PM” | fl Timestamp,ClientIp,ClientHostname,ServerIp,ServerHostname, Source,EventId,MessageId,Recipients,RecipientStatus,TotalBytes,MessageSubject,Sender

Search by Recipient
Get-ExchangeServer | get-messagetrackinglog -recipient user@domain.com -sender user@domain.com -Start “11/15/2012 12:00:00 AM” -End “11/16/2012 11:59:00 PM” | fl Timestamp,ClientIp,ClientHostname,ServerIp,ServerHostname, Source,EventId,MessageId,Recipients,RecipientStatus,TotalBytes,MessageSubject,Sender

Get Message Size of messages in MB
fl Sender,@{label=”size”;Expression={$_.Totalbytes/1mb}}

Search by Sender, Recipient and Subject
Get-ExchangeServer | get-messagetrackinglog -sender user@domain.com -recipient user@domain.com -Start “12/13/2012 12:01:00 AM” -End “12/13/2012 11:59:00 PM” -messagesubject ‘test’ | fl Timestamp,ClientIp,ClientHostname,ServerIp,ServerHostname, Source,EventId,MessageId,Recipients,RecipientStatus,TotalBytes,MessageSubject,Sender,ReturnPath,MessageLantency

Search by Sender and Subject
Get-ExchangeServer | get-messagetrackinglog -sender user@domain.com -messagesubject ‘subject’ -Start “5/16/2012 12:00:00 AM” -End “5/16/2012 11:59:00 PM” | fl Timestamp,ClientIp,ClientHostname,ServerIp,ServerHostname, Source,EventId,MessageId,Recipients,RecipientStatus,TotalBytes,MessageSubject,Sender,ReturnPath,MessageLantency

Search by Recipient, Subject where the Event ID is failed
Get-ExchangeServer | get-messagetrackinglog -recipient user@domain.com -messagesubject “subject” -Start “10/10/2012 3:01:00 PM” -End “10/10/2012 9:59:00 PM” | where {$_.EventID -eq “Failed”}| fl Timestamp,MessageID,Recipients,MessageSubject,EventID,Sender,ReturnPath

Search for messages blocked by transport rule
Get-ExchangeServer | get-messagetrackinglog -recipient user@domain.com -Start “10/10/2012 3:01:00 PM” -End “10/10/2012 9:59:00 PM” | where {$_.SourceContext -eq “Transport Rule Agent”}| fl Timestamp,Sender,MessageSubject,Source,EventId,MessageId,Recipients,TotalBytes,SourceContext

Search by Subject
Get-ExchangeServer | get-messagetrackinglog -messagesubject ‘subject’ -Start “5/16/2012 12:00:00 AM” -End “5/16/2012 11:59:00 PM”| fl Timestamp,ClientIp,ClientHostname,ServerIp,ServerHostname, Source,EventId,MessageId,Recipients,RecipientStatus,TotalBytes,MessageSubject,Sender,ReturnPath,MessageLantency

Search by Server and Recipient
get-messagetrackinglog -Server “server” -recipient user@domain.com -Start “9/22/2011 11:15:00 AM” -End “9/22/2011 12:15:00 PM” | fl Timestamp,ClientIp,ClientHostname,ServerIp,ServerHostname, Source,EventId,MessageId,Recipients,RecipientStatus,TotalBytes,MessageSubject,Sender,ReturnPath,MessageLantency

Search all Hub Servers for Messages sent to Recipient
Get-ExchangeServer | Get-MessageTrackingLog -sender user@domain.com -Recipient user@domain.com -EventID “RECEIVE” -Start “9/30/2011 12:01:00 AM” -End “9/30/2011 11:59:00 PM” | fl Timestamp,MessageId,Recipients,TotalBytes,MessageSubject,Sender,ReturnPath

Search all Hub Servers for Messages via MessageID
Get-ExchangeServer | get-messagetrackinglog -MessageID “<messageID>” -Start “12/13/2012 12:01:00 AM” -End “12/13/2012 11:59:00 PM” | fl Timestamp,ClientIp,ClientHostname,ServerIp,ServerHostname, source,EventId,MessageId,Recipients,RecipientStatus,TotalBytes,MessageSubject,Sender,ReturnPath,MessageLantency ,sourcecontext

Search for Rejected Messages by searching agent logs
Get-AgentLog |?{ ($_.p1fromaddress -match “domain.com” -or $_.p2fromaddresses -match “domain.com”) -and $_.action -eq “RejectMessage”

Search for all mail sent between a specific time from a sender from the ‘contoso.com’ domain
get-messagetrackinglog -start “7/20/2011 6:00pm” -End “7/21/2011 4:30pm” -resultsize UNLIMITED -eventid “SEND” | where {[string]$_.sender -like “*@contoso.com”}

Search for all mail sent between a specific time from a sender from the ‘contoso.com’ domain to recipients on the ‘contoso.com’ domain
get-messagetrackinglog -start “7/20/2011 6:00pm” -End “7/21/2011 4:30pm” -resultsize UNLIMITED -eventid “SEND” | where { [string]$_.sender -like “*contoso.com” -and [string]$_.recipients -like “*@contoso.com” } | fl Sender,TimeStamp,Recipents,MessageSubject

 

Please feel free to share.
By | 2013-07-24T07:39:26+00:00 July 24th, 2013|Exchange Server|1 Comment

About the Author:

One Comment

  1. imkottees July 24, 2013 at 5:20 pm - Reply

    Hi,

    Good one, keep doing. I would prefer Get-TransportServer instead of Get-ExchangeServer

Leave A Comment