Message tracking is a Exchange Server 2010 feature that records log files of email traffic as messages travel between mailboxes and servers within the organization.
Message tracking is a feature of Hub Transport, Edge Transport, and Mailbox servers as these are the Exchange 2010 server roles that are involved in transmitting email messages around the network.
I spend hours each week searching message logs for all kinds of interesting information. This may be situations such as tracking the routing or delivery of a single email message, troubleshooting a server load issue, or analysing overall email traffic patterns.
Enabling or Disabling Message Tracking for Exchange Server 2010
Message tracking is an optional setting that is enabled by default. You can see the current status of message tracking on a server by opening the Properties of that server in the Exchange Management Console and looking at the Log Settings tab.
You can also query this setting with the Exchange Management Shell. One of the advantages of the shell is you can check all your servers at once.
For example, to check the message tracking log setting for all Edge and Hub Transport servers use Get-TransportServer:
[PS] C:\>Get-TransportServer | Select Name,MessageTrackingLogEnabled | ft -auto Name MessageTrackingLogEnabled ---- ------------------------- BR-EX2010-MB True HO-EX2010-MB1 True HO-EX2010-MB2 True HO-EX2010-EDGE True HO-EX2007-MB1 True
To check the same setting on Mailbox servers, use Get-MailboxServer instead:
[PS] C:\>Get-MailboxServer | Select Name,MessageTrackingLogEnabled | ft -auto Name MessageTrackingLogEnabled ---- ------------------------- BR-EX2010-MB True HO-EX2010-MB1 True HO-EX2010-MB2 True HO-EX2007-MB1 True
You’ll notice the same servers have appeared in the above output twice. Those are multi-role servers, with both the Hub Transport and Mailbox server roles installed. In those cases you can use either Get-TransportServer or Get-MailboxServer to query the same setting (it is one setting that can be queried with two cmdlets, not two separate settings).
[PS] C:\>Set-TransportServer BR-EX2010-MB -MessageTrackingLogEnabled $true
Configuring Message Tracking for Exchange Server 2010
In addition to enabling/disabling message tracking logs you can also configure some other settings as appropriate for your environment. These can be seen in the output below:
[PS] C:\>Get-MailboxServer ho-ex2010-mb1 | fl messagetracking* MessageTrackingLogEnabled : True MessageTrackingLogMaxAge : 30.00:00:00 MessageTrackingLogMaxDirectorySize : 1000 MB (1,048,576,000 bytes) MessageTrackingLogMaxFileSize : 10 MB (10,485,760 bytes) MessageTrackingLogPath : C:Program FilesMicrosoftExchange ServerV14TransportRolesLogsMessageTra cking MessageTrackingLogSubjectLoggingEnabled : True
The default settings are:
Max Age – 30 days. You can turn this up or down as required. I find sometimes by the time an issue is reported or found that 30 days is not quite enough to be able to search back in time. However this is entirely up to you, and if your logs are being backed up you can always consider restoring older logs from backup if required.
Max Directory Size – this is an additional setting for limiting the total size of message tracking logs on your server. The default limit is 1Gb but in high volume environments you may find that this limit means logs are purged before they reach the full 30 day max age, because the max directory size overrides the max age setting. On most of my servers I’ve increased this to 4Gb and in some cases as much as 10Gb. Consider your server’s disk capacity as well as the impact that more log files has on the amount of time some tracking log searches will take.
Max File Size – the default is 10mb and I’ve never seen a need to change this.
Log Path – the default is the same drive as the Exchange 2010 install directory, but you can move this to any path you wish. On some of our highest volume servers (eg messaging hub sites, and Edge Transport servers) this path has been changed to a non-OS drive with a lot more free disk space.
Subject Logging – this is enabled by default and the only reason I’ve ever needed to disable it was when there were some privacy/security concerns for that particular environment.
You can change any of these settings with Set-TransportServer or Set-MailboxServer. For example to increase the max directory size for all of the servers:
[PS] C:\>Get-TransportServer | Set-TransportServer -MessageTrackingLogMaxDirectorySize 2GB
Searching Message Tracking Logs in Exchange Server 2010
Exchange 2010 provides multiple tools for searching message tracking logs. The first two are available in the Toolbox section of the Exchange Management Console.
Message Tracking Web Interface
The web interface for message tracking is part of the Exchange Control Panel and provides very basic search functionality to search for messages either sent by or received by a mailbox, based on the sender, recipients, and subject line.
One of the advantages of this web interface is that it is available for regular users to perform delivery report searches for their own emails, or delegate the task to power users or auditors, without needing to install the Exchange 2010 management tools on their workstation.
Message Tracking Log Explorer
Message tracking log searches can also be performed in the Tracking Log Explorer, a GUI search tool that is part of the Exchange Management Console. This tool gives administrators some more control over the searches they perform such as searching for specific events (eg FAIL events), searching for a particular message ID, and controlling the date ranges for search results.
The message Tracking Log Explorer provides a fairly user-friendly interface for administrators to perform searches, but has a few limitations as well. Wildcard searches are not possible, nor are searches across multiple servers simultaneously. And although reports files are automatically saved by the tool, they can only be exported in XML format which is not as user-friendly as CSV would be.
So while the Tracking Log Explorer is decent tool for single server environments, in any larger environment you will find PowerShell a much better way to perform message tracking log searches.
The Exchange Management Shell includes the Get-MessageTrackingLog cmdlet that can be used for message tracking log searches. This is one of the most useful and powerful ways to search your tracking logs, but it may appear to be a steep learning curve for some administrators.
If you take a look at the Tracking Log Explorer mentioned above you’ll notice that as you construct a query it generates the equivalent PowerShell command below that, which means the Tracking Log Explorer is a good way to get started with the PowerShell syntax for Get-MessageTrackingLog.
Using PowerShell to search message tracking logs is a big topic so I’ve written a separate article about it including many sample queries that you can build off to suit your own situations.
Message tracking is a feature of Exchange Server 2010 that is enabled by default, and can be configured in many ways to suit your environment. It is useful for troubleshooting and reporting tasks, and Exchange 2010 comes with several tools to make tracking log searches possible.