[Webinar] Streamline your web hosting managementRegister Today

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 4656
  • Last Modified:

How would you search Exchange 2007 log files for bounced(rejected) messages

I am trying to figure out how to search the Exchange Server log files using the Get_MessageTrackingLog function through the Exchange Management Shell. What I'm actually attempting to find out currently is if our Exchange Server rejected a message due to size limits that we have defined in Exchange. About a month ago I had a user to advise they never received an email from an outside party(Outside party didn't advise they received a Delivery Failed message either). They advised that it did have a large attachment. I did some searching for that email and could never find where it hit our Exchange server. Today the same user advised they were missing another email with several attachments from a different outside party. I did somemore searching today on both the Exchange and Edge servers log files and could not find that email either. I then proceeded to send myself an email with a large attachment from my personnal account to see what happens. I did receive a Delivery Failed message back from our Exchange or Edge server(or it appears to be our Exchange or Edge server anyway, the from address of the Delivery Failure message is from "Mailer-Daemon@mydomain.com", however I've still have not been able to find where this message actually hit either our Edge or Exchange servers in the log files.
Any thoughts on how to search the log files for the messages would be great.
0
klh1969
Asked:
klh1969
  • 5
  • 4
1 Solution
 
MesthaCommented:
I don't think message tracking would show it. If the message was rejected on size then it would be rejected at the delivery point. The only place it would be logged is the transport logging.

Simon.
0
 
klh1969Author Commented:
Is there an EMS command that will allow a search of the transport logs similar to the Get-MessageTrackingLog?
0
 
Froggy_chrisCommented:
Hi,

such rejecion will happen on the HUB.
Make sure (from the EMC) that you have enable the Protocol logs from your Receive connector.

Then you can go to <install root>\TransportRoles\Logs\ProtocolLog\SmtpReceive
Here you'll find the SMTP logs.. enjoy !
0
Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

 
klh1969Author Commented:
Froggy Chris:
Thanks for the information.
The Protocol Logging Level on the receive connector was set to NONE. I changed the setting to VERBOSE and a log file did begin to be create in the path that you stated. However I once again send from my personnal account an email with a large attachment (that would not be allowed). I did once again receive the "Delivery Failed" message back to my personnal account. However there was nothing in the log file in the path above.
0
 
Froggy_chrisCommented:
Well, any mails that comes from outside to inside has to pass throuh the HUB server (or the egde first if you have an edge server).

If you don't find anything in the log, then nothing are even reached Exchange.

How is your Exc toplogy ? how many Edge / transport server (the protocol logs are servers dependant).
Do you have any other Spam filter appliances between Internet and your Exchange ?
0
 
Froggy_chrisCommented:
Some extra information.. when you mentionned "personnal account", i assumed you were talking about External Personnal account... Was I right ?
0
 
klh1969Author Commented:
Yes, External Personnal account.
I had just enabled the additional logging on the HUB Transport receive connectors which is installed on the Exchange Server in my enviroment. I probably also need to enable the same logging on the EDGE Transport receive connectors on the EDGE server. I'll do that and let you know.
Thanks
0
 
Froggy_chrisCommented:
You'll have to enable the logging for any single server / any single connector indeed

You can use the follwoing powershell to do it in one shot:

get-receiveconnector | get-receiveconnector -protocollogginglevel verbose

(might not work for the edge server though).
0
 
klh1969Author Commented:
Progress, I guess.
Enabled the protocol logging on the EDGE Transport server receive connector, sent another email with large attachment. I do see where that email was logged in the log file on the EDGE server. It did not show that it was rejected due to size liminations that are in place or anything. In fact there is an entry that says "Queued Mail for Delivery", assuming that means it is forwarding on to the Exchange server. In our enviroment all of the other Exchange Server 2007 applications are installed on this server.
0
 
Froggy_chrisCommented:
Hi,

That probably means rthat you have other limitation.

Check the organisation settings:
get-transportconfig | FL MaxReceiveSize, MaxSendsize
=> settings apply for the whole organisation

then check
get-Receiveconnector | fl Name, MaxReceiveSize
=> setting apply on a given connector,

Chris
0

Featured Post

Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

  • 5
  • 4
Tackle projects and never again get stuck behind a technical roadblock.
Join Now