Solved

How would you search Exchange 2007 log files for bounced(rejected) messages

Posted on 2009-05-06
10
4,547 Views
Last Modified: 2012-05-06
I am trying to figure out how to search the Exchange Server log files using the Get_MessageTrackingLog function through the Exchange Management Shell. What I'm actually attempting to find out currently is if our Exchange Server rejected a message due to size limits that we have defined in Exchange. About a month ago I had a user to advise they never received an email from an outside party(Outside party didn't advise they received a Delivery Failed message either). They advised that it did have a large attachment. I did some searching for that email and could never find where it hit our Exchange server. Today the same user advised they were missing another email with several attachments from a different outside party. I did somemore searching today on both the Exchange and Edge servers log files and could not find that email either. I then proceeded to send myself an email with a large attachment from my personnal account to see what happens. I did receive a Delivery Failed message back from our Exchange or Edge server(or it appears to be our Exchange or Edge server anyway, the from address of the Delivery Failure message is from "Mailer-Daemon@mydomain.com", however I've still have not been able to find where this message actually hit either our Edge or Exchange servers in the log files.
Any thoughts on how to search the log files for the messages would be great.
0
Comment
Question by:klh1969
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 4
10 Comments
 
LVL 65

Expert Comment

by:Mestha
ID: 24319725
I don't think message tracking would show it. If the message was rejected on size then it would be rejected at the delivery point. The only place it would be logged is the transport logging.

Simon.
0
 

Author Comment

by:klh1969
ID: 24320042
Is there an EMS command that will allow a search of the transport logs similar to the Get-MessageTrackingLog?
0
 
LVL 6

Expert Comment

by:Froggy_chris
ID: 24325346
Hi,

such rejecion will happen on the HUB.
Make sure (from the EMC) that you have enable the Protocol logs from your Receive connector.

Then you can go to <install root>\TransportRoles\Logs\ProtocolLog\SmtpReceive
Here you'll find the SMTP logs.. enjoy !
0
VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

 

Author Comment

by:klh1969
ID: 24326047
Froggy Chris:
Thanks for the information.
The Protocol Logging Level on the receive connector was set to NONE. I changed the setting to VERBOSE and a log file did begin to be create in the path that you stated. However I once again send from my personnal account an email with a large attachment (that would not be allowed). I did once again receive the "Delivery Failed" message back to my personnal account. However there was nothing in the log file in the path above.
0
 
LVL 6

Expert Comment

by:Froggy_chris
ID: 24326095
Well, any mails that comes from outside to inside has to pass throuh the HUB server (or the egde first if you have an edge server).

If you don't find anything in the log, then nothing are even reached Exchange.

How is your Exc toplogy ? how many Edge / transport server (the protocol logs are servers dependant).
Do you have any other Spam filter appliances between Internet and your Exchange ?
0
 
LVL 6

Expert Comment

by:Froggy_chris
ID: 24326116
Some extra information.. when you mentionned "personnal account", i assumed you were talking about External Personnal account... Was I right ?
0
 

Author Comment

by:klh1969
ID: 24326245
Yes, External Personnal account.
I had just enabled the additional logging on the HUB Transport receive connectors which is installed on the Exchange Server in my enviroment. I probably also need to enable the same logging on the EDGE Transport receive connectors on the EDGE server. I'll do that and let you know.
Thanks
0
 
LVL 6

Expert Comment

by:Froggy_chris
ID: 24326301
You'll have to enable the logging for any single server / any single connector indeed

You can use the follwoing powershell to do it in one shot:

get-receiveconnector | get-receiveconnector -protocollogginglevel verbose

(might not work for the edge server though).
0
 

Author Comment

by:klh1969
ID: 24326832
Progress, I guess.
Enabled the protocol logging on the EDGE Transport server receive connector, sent another email with large attachment. I do see where that email was logged in the log file on the EDGE server. It did not show that it was rejected due to size liminations that are in place or anything. In fact there is an entry that says "Queued Mail for Delivery", assuming that means it is forwarding on to the Exchange server. In our enviroment all of the other Exchange Server 2007 applications are installed on this server.
0
 
LVL 6

Accepted Solution

by:
Froggy_chris earned 300 total points
ID: 24328597
Hi,

That probably means rthat you have other limitation.

Check the organisation settings:
get-transportconfig | FL MaxReceiveSize, MaxSendsize
=> settings apply for the whole organisation

then check
get-Receiveconnector | fl Name, MaxReceiveSize
=> setting apply on a given connector,

Chris
0

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article will help to fix the below error for MS Exchange server 2010 I. Out Of office not working II. Certificate error "name on the security certificate is invalid or does not match the name of the site" III. Make Internal URLs and External…
Check out this step-by-step guide for using the newly updated Experts Exchange mobile app—released on May 30.
To show how to create a transport rule in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Mail Flow >> Rules tab.:  To cr…
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…
Suggested Courses

635 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question