Solved

How would you search Exchange 2007 log files for bounced(rejected) messages

Posted on 2009-05-06
10
4,433 Views
Last Modified: 2012-05-06
I am trying to figure out how to search the Exchange Server log files using the Get_MessageTrackingLog function through the Exchange Management Shell. What I'm actually attempting to find out currently is if our Exchange Server rejected a message due to size limits that we have defined in Exchange. About a month ago I had a user to advise they never received an email from an outside party(Outside party didn't advise they received a Delivery Failed message either). They advised that it did have a large attachment. I did some searching for that email and could never find where it hit our Exchange server. Today the same user advised they were missing another email with several attachments from a different outside party. I did somemore searching today on both the Exchange and Edge servers log files and could not find that email either. I then proceeded to send myself an email with a large attachment from my personnal account to see what happens. I did receive a Delivery Failed message back from our Exchange or Edge server(or it appears to be our Exchange or Edge server anyway, the from address of the Delivery Failure message is from "Mailer-Daemon@mydomain.com", however I've still have not been able to find where this message actually hit either our Edge or Exchange servers in the log files.
Any thoughts on how to search the log files for the messages would be great.
0
Comment
Question by:klh1969
  • 5
  • 4
10 Comments
 
LVL 65

Expert Comment

by:Mestha
Comment Utility
I don't think message tracking would show it. If the message was rejected on size then it would be rejected at the delivery point. The only place it would be logged is the transport logging.

Simon.
0
 

Author Comment

by:klh1969
Comment Utility
Is there an EMS command that will allow a search of the transport logs similar to the Get-MessageTrackingLog?
0
 
LVL 6

Expert Comment

by:Froggy_chris
Comment Utility
Hi,

such rejecion will happen on the HUB.
Make sure (from the EMC) that you have enable the Protocol logs from your Receive connector.

Then you can go to <install root>\TransportRoles\Logs\ProtocolLog\SmtpReceive
Here you'll find the SMTP logs.. enjoy !
0
 

Author Comment

by:klh1969
Comment Utility
Froggy Chris:
Thanks for the information.
The Protocol Logging Level on the receive connector was set to NONE. I changed the setting to VERBOSE and a log file did begin to be create in the path that you stated. However I once again send from my personnal account an email with a large attachment (that would not be allowed). I did once again receive the "Delivery Failed" message back to my personnal account. However there was nothing in the log file in the path above.
0
 
LVL 6

Expert Comment

by:Froggy_chris
Comment Utility
Well, any mails that comes from outside to inside has to pass throuh the HUB server (or the egde first if you have an edge server).

If you don't find anything in the log, then nothing are even reached Exchange.

How is your Exc toplogy ? how many Edge / transport server (the protocol logs are servers dependant).
Do you have any other Spam filter appliances between Internet and your Exchange ?
0
Do email signature updates give you a headache?

Do you feel like all of your time is spent managing email signatures? Too busy to visit every user’s desk to make updates? Want high-quality HTML signatures on all devices, including on mobiles and Macs? Then, let Exclaimer solve all your email signature problems today!

 
LVL 6

Expert Comment

by:Froggy_chris
Comment Utility
Some extra information.. when you mentionned "personnal account", i assumed you were talking about External Personnal account... Was I right ?
0
 

Author Comment

by:klh1969
Comment Utility
Yes, External Personnal account.
I had just enabled the additional logging on the HUB Transport receive connectors which is installed on the Exchange Server in my enviroment. I probably also need to enable the same logging on the EDGE Transport receive connectors on the EDGE server. I'll do that and let you know.
Thanks
0
 
LVL 6

Expert Comment

by:Froggy_chris
Comment Utility
You'll have to enable the logging for any single server / any single connector indeed

You can use the follwoing powershell to do it in one shot:

get-receiveconnector | get-receiveconnector -protocollogginglevel verbose

(might not work for the edge server though).
0
 

Author Comment

by:klh1969
Comment Utility
Progress, I guess.
Enabled the protocol logging on the EDGE Transport server receive connector, sent another email with large attachment. I do see where that email was logged in the log file on the EDGE server. It did not show that it was rejected due to size liminations that are in place or anything. In fact there is an entry that says "Queued Mail for Delivery", assuming that means it is forwarding on to the Exchange server. In our enviroment all of the other Exchange Server 2007 applications are installed on this server.
0
 
LVL 6

Accepted Solution

by:
Froggy_chris earned 300 total points
Comment Utility
Hi,

That probably means rthat you have other limitation.

Check the organisation settings:
get-transportconfig | FL MaxReceiveSize, MaxSendsize
=> settings apply for the whole organisation

then check
get-Receiveconnector | fl Name, MaxReceiveSize
=> setting apply on a given connector,

Chris
0

Featured Post

Why spend so long doing email signature updates?

Do you spend loads of your time carrying out email signature updates? Not very interesting are they? Don’t let signature updates get you down. Let Exclaimer Cloud - Signatures for Office 365 make managing email signatures a breeze.

Join & Write a Comment

Not sure what the best email signature size is? Are you worried about email signature image size? Follow this best practice guide.
Scam emails are a huge burden for many businesses. Spotting one is not always easy. Follow our tips to identify if an email you receive is a scam.
In this Micro Video tutorial you will learn the basics about Database Availability Groups and How to configure one using a live Exchange Server Environment. The video tutorial explains the basics of the Exchange server Database Availability grou…
The video tutorial explains the basics of the Exchange server Database Availability groups. The components of this video include: 1. Automatic Failover 2. Failover Clustering 3. Active Manager

728 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now