Message Tracking CMDlets

Exchange Message Tracking PowerShell CMDlets

Search by Message ID

Get-ExchangeServer | get-messagetrackinglog -MessageID “<messageID>” -Start “5/16/2012 12:01:00 AM” -End “5/16/2012 11:59:00 PM” | fl Timestamp,ClientIp,ClientHostname,ServerIp,ServerHostname,Source,EventId,MessageId, @{Name=”Recipients”;Expression={$_.recipients}},@{Name=”Recipientstatus”;Expression={$_.recipientstatus}},TotalBytes,MessageSubject,Sender,ReturnPath,MessageLantency

Search by Sender

Get-ExchangeServer | get-messagetrackinglog -sender user@domain.com -Start “11/15/2012 12:00:00 AM” -End “11/16/2012 11:59:00 PM” | fl Timestamp,ClientIp,ClientHostname,ServerIp,ServerHostname, Source,EventId,MessageId, @{Name=”Recipients”;Expression={$_.recipients}},@{Name=”Recipientstatus”;Expression={$_.recipientstatus}},TotalBytes,MessageSubject,Sender

Search by Recipient

Get-ExchangeServer | get-messagetrackinglog -recipient user@domain.com -sender user@domain.com -Start “11/15/2012 12:00:00 AM” -End “11/16/2012 11:59:00 PM” | fl Timestamp,ClientIp,ClientHostname,ServerIp,ServerHostname, Source,EventId,MessageId, @{Name=”Recipients”;Expression={$_.recipients}},@{Name=”Recipientstatus”;Expression={$_.recipientstatus}},TotalBytes,MessageSubject,Sender

Get Message Size of messages in MB

fl Sender,@{label=”size”;Expression={$_.Totalbytes/1mb}}

Search by Sender, Recipient and Subject

Get-ExchangeServer | get-messagetrackinglog -sender user@domain.com -recipient user@domain.com -Start “12/13/2012 12:01:00 AM” -End “12/13/2012 11:59:00 PM” -messagesubject ‘test’ | fl Timestamp,ClientIp,ClientHostname,ServerIp,ServerHostname, Source,EventId,MessageId, @{Name=”Recipients”;Expression={$_.recipients}},@{Name=”Recipientstatus”;Expression={$_.recipientstatus}},TotalBytes,MessageSubject,Sender,ReturnPath,MessageLantency

Search by Sender and Subject

Get-ExchangeServer | get-messagetrackinglog -sender user@domain.com -messagesubject ‘subject’ -Start “5/16/2012 12:00:00 AM” -End “5/16/2012 11:59:00 PM” | fl Timestamp,ClientIp,ClientHostname,ServerIp,ServerHostname, Source,EventId,MessageId, @{Name=”Recipients”;Expression={$_.recipients}},@{Name=”Recipientstatus”;Expression={$_.recipientstatus}},TotalBytes,MessageSubject,Sender,ReturnPath,MessageLantency

Search by Recipient, Subject where the Event ID is failed 

Get-ExchangeServer | get-messagetrackinglog -recipient user@domain.com -messagesubject “subject” -Start “10/10/2012 3:01:00 PM” -End “10/10/2012 9:59:00 PM” | where {$_.EventID -eq “Failed”}| fl Timestamp,MessageID, @{Name=”Recipients”;Expression={$_.recipients}},MessageSubject,EventID,Sender,ReturnPath

Search for messages blocked by transport rule

Get-ExchangeServer | get-messagetrackinglog -recipient user@domain.com -Start “10/10/2012 3:01:00 PM” -End “10/10/2012 9:59:00 PM” | where {$_.SourceContext -eq “Transport Rule Agent”}| fl Timestamp,Sender,MessageSubject,Source,EventId,MessageId, @{Name=”Recipients”;Expression={$_.recipients}},TotalBytes,SourceContext

Search by Subject

Get-ExchangeServer | get-messagetrackinglog -messagesubject ‘subject’ -Start “5/16/2012 12:00:00 AM” -End “5/16/2012 11:59:00 PM”| fl Timestamp,ClientIp,ClientHostname,ServerIp,ServerHostname, Source,EventId,MessageId, @{Name=”Recipients”;Expression={$_.recipients}},@{Name=”Recipientstatus”;Expression={$_.recipientstatus}},TotalBytes,MessageSubject,Sender,ReturnPath,MessageLantency

Search by Server and Recipient

get-messagetrackinglog -Server “server” -recipient user@domain.com -Start “9/22/2011 11:15:00 AM” -End “9/22/2011 12:15:00 PM” | fl Timestamp,ClientIp,ClientHostname,ServerIp,ServerHostname, Source,EventId,MessageId, @{Name=”Recipients”;Expression={$_.recipients}},@{Name=”Recipientstatus”;Expression={$_.recipientstatus}},TotalBytes,MessageSubject,Sender,ReturnPath,MessageLantency

Search all Hub Servers for Messages sent to Recipient

Get-ExchangeServer | Get-MessageTrackingLog -sender user@domain.com -Recipient user@domain.com -EventID “RECEIVE” -Start “9/30/2011 12:01:00 AM” -End “9/30/2011 11:59:00 PM” | fl Timestamp,MessageId, @{Name=”Recipients”;Expression={$_.recipients}},TotalBytes,MessageSubject,Sender,ReturnPath

Search all Hub Servers for Messages via MessageID

Get-ExchangeServer | get-messagetrackinglog -MessageID “<messageID>” -Start “12/13/2012 12:01:00 AM” -End “12/13/2012 11:59:00 PM” | fl Timestamp,ClientIp,ClientHostname,ServerIp,ServerHostname, source,EventId,MessageId, @{Name=”Recipients”;Expression={$_.recipients}},@{Name=”Recipientstatus”;Expression={$_.recipientstatus}},TotalBytes,MessageSubject,Sender,ReturnPath,MessageLantency ,sourcecontext

Search for Rejected Messages by searching agent logs

Get-AgentLog |?{ ($_.p1fromaddress -match “domain.com” -or $_.p2fromaddresses -match “domain.com”) -and $_.action -eq “RejectMessage”

Search for all mail sent between a specific time from a sender from the ‘contoso.com’ domain 

get-messagetrackinglog -start “7/20/2011 6:00pm” -End “7/21/2011 4:30pm” -resultsize unlimited -eventid “SEND” | where {[string]$_.sender -like “*@contoso.com”}

Search for all mail sent between a specific time from a sender from the ‘contoso.com’ domain to recipients on the ‘contoso.com’ domain

get-messagetrackinglog -start “7/20/2011 6:00pm” -End “7/21/2011 4:30pm” -resultsize unlimited -eventid “SEND” | where { [string]$_.sender -like “*contoso.com” -and [string]$_.recipients -like “*@contoso.com” } | fl Sender,TimeStamp, @{Name=”Recipients”;Expression={$_.recipients}},MessageSubject

Leave a Reply

Your email address will not be published. Required fields are marked *