Category Archives: Tracking logs

Exchange 2010 Tracking logs and Powershell

When using the EMC to search tracking logs, you cannot search with wildcards.  You can use the Exchange Shell to do this.
Get-MessageTrackingLog returns an object with the following properties and methods:

 

Name
MemberType
 Definition
—-
———-
 ———-
Equals
Method
 bool Equals(System.Object obj)
GetHashCode
Method
 int GetHashCode()
GetType
Method
 type GetType()
ToString
Method
 string ToString()
ClientHostname
Property
 System.String ClientHostname {get;}
ClientIp
Property
 System.String ClientIp {get;}
ConnectorId
Property
 System.String ConnectorId {get;}
EventData
Property
 System.Collections.Generic.KeyValuePair`2[[System.String, mscorlib, Version=2.0…
EventId
Property
 System.String EventId {get;}
InternalMessageId
Property
 System.String InternalMessageId {get;}
MessageId
Property
 System.String MessageId {get;}
MessageInfo
Property
 System.String MessageInfo {get;}
MessageLatency
Property
 System.Nullable`1[[Microsoft.Exchange.Data.EnhancedTimeSpan, Microsoft.Exchange…
MessageLatencyType
Property
 Microsoft.Exchange.Management.TransportLogSearchTasks.MessageLatencyType Messag…
MessageSubject
Property
 System.String MessageSubject {get;}
RecipientCount
Property
 System.Nullable`1[[System.Int32, mscorlib, Version=2.0.0.0, Culture=neutral, Pu…
Recipients
Property
 System.String[] Recipients {get;}
RecipientStatus
Property
 System.String[] RecipientStatus {get;}
Reference
Property
 System.String[] Reference {get;}
ReturnPath
Property
 System.String ReturnPath {get;}
Sender
Property
 System.String Sender {get;}
ServerHostname
Property
 System.String ServerHostname {get;}
ServerIp
Property
 System.String ServerIp {get;}
Source
Property
 System.String Source {get;}
SourceContext
Property
 System.String SourceContext {get;}
Timestamp
Property
 System.DateTime Timestamp {get;}
TotalBytes
Property
 System.Nullable`1[[System.Int32, mscorlib, Version=2.0.0.0, Culture=neutral, Pu…
 
Given this information, we can use these properties to search tracking logs for required details.  EG:
To get a list of all emails from any address @gmail.com between the dates 10-07-14 and 15-07-14, use the following command (must use MM/DD/YYYY date format, even though regional settings are for Australia!) (one line):
Get-MessageTrackingLog –ResultSize Unlimited –Start “07-10-2014” –End “07-15-2014” | where {$_.sender –like “*@gmail.com”}
Combining this with a select-object we can get specific details about the object returned.  To show the TimeStamp, Source, Event ID, Sender, Recipients, Message Subject and Size, use the following (one line):
Get-MessageTrackingLog –ResultSize Unlimited –Start “07-10-2014” –End “07-15-2014” | where {$_.sender –like “*@gmail.com”} | Select-Object Timestamp, Source, EventID,Sender, {$_.Recipients}, MessageSubject,TotalBytes
You can also use Export-CSV to get the data into a CSV (one line):
Get-MessageTrackingLog –ResultSize Unlimited –Start “07-10-2014” –End “07-15-2014” | where {$_.sender –like “*@gmail.com”} | Select-Object Timestamp, Source, EventID,Sender, {$_.Recipients}, MessageSubject,TotalBytes | –Export-CSV –path export.csv
Search with a wildcard subject (not case sensitive) (one line):
Get-MessageTrackingLog –ResultSize Unlimited | where {$_.MessageSubject –like “*Dell*”} | Select-Object Timestamp, Source, EventID,Sender, {$_.Recipients}, MessageSubject,TotalBytes