Reporting Exchange Server 2010 Message Tracking Event IDs with Log Parser

In another article I showed how to use PowerShell to create a summary report of the message tracking event IDs that have occurred on an Exchange 2010 server.

In some cases these types of summary reports are faster and easier to extract using Log Parser instead of PowerShell. Let’s take a look at the Log Parser query to generate the same report as in the other article.

SELECT
   event-id AS Event,
   COUNT(*) As HITS
from *.log
GROUP BY Event
ORDER BY HITS DESC

This query will select the event-id field, a count of total log entries, grouped by event-id, and sort them in order of most to least hits.

The complete query, when executed from the directory containing the message tracking logs, is as follows:

"C:Program Files (x86)Log Parser 2.2logparser.exe" "SELECT event-id AS Event, COUNT(*) As HITS from *.log GROUP BY Event ORDER BY HITS DESC" -i:CSV -nSkipLines:4 -rtp:-1

That query will produce a report similar to this:

Event       HITS
----------- -----
RECEIVE     58679
DELIVER     47496
NOTIFYMAPI  20812
SUBMIT      20806
SEND        19863
RESUBMIT    8679
HAREDIRECT  6826
TRANSFER    351
DSN         96
FAIL        95
SUBMITDEFER 6
BADMAIL     2

Statistics:
-----------
Elements processed: 183756
Elements output:    13
Execution time:     9.24 seconds

Aside from the speed benefits of Log Parser over Get-MessageTrackingLog you can also save time by generating graphical reports directly out of Log Parser if you have the Office Web Components also installed.

That query is as follows:

"C:Program Files (x86)Log Parser 2.2logparser.exe" "SELECT event-id AS Event, COUNT(*) As HITS INTO Events.gif from *.log GROUP BY Event ORDER BY HITS DESC" -i:CSV -nSkipLines:4 -chartType:Column3D

This type of information would be useful to see on a regular basis, so you could simply schedule this Log Parser query to run at certain intervals and use an HTML page or an automatic email to view the results each time.