Message Tracking In Exchange 2003 and 2007

 In most organizations, employees complain about undelivered mail; making message tracking often a need. Troubleshooting this problem leads to analysis of log files maintained by exchange server. This tutorial covers message tracking in exchange 2007.

You can’t do configuration in ‘Exchange Management Console (EMC)’ but in ‘Exchange Management Shell’ (EMS). By default, message tracking is enabled in Microsoft Exchange 2007. Only way to confirm is:

• Open EMC; expand Server Configuration to select Hub Transport Server then click on the properties of Hub Server.

•  Properties of the Hub Server will show the General tab. To track message, select Log Settings tab.

- Under Message tracking log of Log Settings tab, checkbox Enable tracking log file logging and Message tracking log file path specify default setting of messaging tracking, checked mean enabled, and path to log file, respectively. Message tracking can be disabled, not advised, by un-checking checkbox and log file path can be changed using Browse… button.

• You can also verify above in EMC. Open EMC to write ‘Get-TransportServer <SERVERNAME>’ and press enter.

Configuration for message tracking is done in EMS. So first, we need to see the default setting, for message tracking, in exchange server. A user with either Hub or mailbox server role can do these steps.

• Open EMS to write command ‘Get-TransportServer <SERVERNAME> | fl *messagetracking*’ for user with Hub server role or ‘Get-TransportServer <SERVERNAME> | fl *messagetracking*’with mailbox server role.

Note: If you have both roles, you either one to work.

In above figure, we used ‘Get-TransportServer <SERVERNAME> | fl *messagetracking*’. ‘fl’ does the filtering job to show only ones concerning message tracking. Output of command shows size parameter values for message tracking namely:

• Message Tracking Log Enabled
• Message Tracking Log Max Age
• Message Tracking Log Directory Size
• Message Tracking Log File Size
• Message Tracking Log Path
• Message Tracking Log Subject Logging Enabled

We talked of first and second last in EMC, previously. Let’s go through each.

Message Tracking Log Enabled tells if message tracking is enabled or not. It is enabled, by default, in exchange server 2007 under Mailbox, Hub and Edge Transport Server roles. We can disable in EMC by un-checking ‘Enable tracking log file logging’ under Log settings tab of the properties of either server role. Using EMS, we can achieve this:

Set-TransportServer <SERVERNAME> -MessageTrackingLogEnabled $false

Message Tracking Log Max Age is age limit of message tracking log. Default age limit in exchange 2007 is 30 days. If you want to change this setting, shown below, use

Set-TransportServer <SERVERNAME> -MessageTrackingLogMaxAge DD: HH:MM:SS

Message Tracking Log Directory Size specifies maximum message tracking log file size. It size exceeds that limit; oldest logs are deleted on new entries. Default size limit in exchange server 2007 is 250MB. Command to specify new settings is

Set-TransportServer <SERVERNAME> -MessageTrackingLogMaxDirectorySize <Size with Unit>

Note: Unit in command can be megabytes (MB), kilobytes (KB), gigabytes (GB), terabytes (TB) or bytes (B).

Message Tracking Log File Size specifies individual message tracking log file size, 10 MB, by default. New, log, file size can be set by command:

Set-TransportServer <SERVERNAME> -MessageTrackingLogMaxFileSize <Size with Unit>

As the name suggests, Message Tracking Log Path locates log file path. Default is exchange installation drive with\Program Files\Microsoft\Exchange Server\TransportRoles\Logs\MessageTracking. New can set by command:

Set-TransportServer <SERVERNAME> -MessageTrackingLogPath <LOGPATH>

Message Tracking Log Subject Logging Enabled gives you the ability to locate the subject message. It is enabled by default, can be unset using command

Set-TransportServer <SERVERNAME> -MessageTrackingLogSubjectLoggingEnabled $false

Inside Message Tracking Log files:  They reside either on path specified, shown below, or default entered on installation:

In the above figure, MSGTRK prefix log file found on Hub or Edge Transport server which MSGTRKM on mailbox server. With our server having both roles, so log for each can be seen. Figures below show what lies inside each. In first four lines, log files maintain exchange server information while successive log entries are followed. Message logs are comma separated with format specified in line five. Each field is self-explanatory, so take your time. Once you are done move to next step.

How to Search a Log:

Message tracking in exchange server is done through EMS or Message tracking tool. EMC has no option to that configuration. We will track EMS for this tutorial. All exchange messages can be tracked (or seen) by command Get-MessageTrackingLog but it is difficult to locate few in the whole lot. So we can use filtering on the command for desired messages.

For example, with Get-MessageTrackingLog, we can specify switch of any of the five columns, EventID, Source, Sender, Recipients and MessageSubject, in command among others.

Above figure shows all received messages filtered with EventID RECEIVE.

Conclusion: This tutorial covers all about message tracking in Exchange Server 2007, including analysis of their log files.