Friday, October 4, 2013

Examples for search in Exchage tracking log

In Microsoft Exchange 2010 uncomfortable implemented tracking messages through GUI. You need to walk and execute Microsoft Exchange Troubleshooting Assistant on each transport server and it's very tiring, even when only two transport server. Here are some examples that can help search for tracking logs quickly with powershell:


Example: Search for all messages sent and received over a period in the tracking log and export results in CSV

Get-TransportServer | Get-MessageTrackingLog -Start "10/04/2013 00:00:00" -End "10/04/2013 23:59:00" -resultsize unlimited | select timestamp, eventid, sender, @{l="Recipients";e={$_.Recipients -join " "}}, messagesubject, totalbytes, recipientCount  | export-csv -Encoding utf8 c:\tracking_all.csv -NoTypeInformation
 

Example: Search for all messages received over a period in the tracking log for some domain and export results in CSV (wildcard search)

Get-TransportServer | Get-MessageTrackingLog -Start "10/04/2013 00:00:00" -End "10/04/2013 23:59:00" -resultsize unlimited | select timestamp, eventid, sender, @{l="Recipients";e={$_.Recipients -join " "}}, messagesubject, totalbytes, recipientCount | Where-Object {$_.recipients -like "*@branch1.somedomain.com"} | export-csv -Encoding utf8 c:\tracking_rd.csv -NoTypeInformation
 

Example: Search for all messages sent over a period in the tracking log for some domain and export results in CSV  (wildcard search)

Get-TransportServer | Get-MessageTrackingLog -Start "10/04/2013 00:00:00" -End "10/04/2013 23:59:00" -resultsize unlimited | select timestamp, eventid, sender, @{l="Recipients";e={$_.Recipients -join " "}}, messagesubject, totalbytes, recipientCount | Where-Object {$_.sender -like "*@branch1.somedomain.com"} | export-csv -Encoding utf8 c:\tracking_sd.csv -NoTypeInformation



Example: Search for all messages sent over a period in the tracking log by specified sender and export results in CSV

Get-TransportServer | Get-MessageTrackingLog -Start "10/04/2013 00:00:00" -End "10/04/2013 23:59:00"-Sender "user1@somedomain.com" -resultsize unlimited | select timestamp, eventid, sender, @{l="Recipients";e={$_.Recipients -join " "}}, messagesubject, totalbytes, recipientCount  | export-csv -Encoding utf8 c:\tracking_su.csv -NoTypeInformation
 

Example: Search for all messages received over a period in the tracking log by specified recipient and export results in CSV

Get-TransportServer | Get-MessageTrackingLog -Start "10/04/2013 00:00:00" -End "10/04/2013 23:59:00" -recipients:"user1@somedomain.com" -resultsize unlimited | select timestamp, eventid, sender, @{l="Recipients";e={$_.Recipients -join " "}}, messagesubject, totalbytes, recipientCount  | export-csv -Encoding utf8 c:\tracking_ru.csv -NoTypeInformation
 

Example: Search for all messages sent and received over a period in the tracking log by subject contain some text and export results in CSV

Get-TransportServer | Get-MessageTrackingLog -Start "10/04/2013 00:00:00" -End "10/04/2013 23:59:00" -MessageSubject "test" -resultsize unlimited | select timestamp, eventid, sender, @{l="Recipients";e={$_.Recipients -join " "}}, messagesubject, totalbytes, recipientCount  | export-csv -Encoding utf8 c:\tracking_alls.csv -NoTypeInformation

No comments:

Post a Comment