Solved

How would you search Exchange 2007 log files for bounced(rejected) messages

Posted on 2009-05-06
10
4,520 Views
Last Modified: 2012-05-06
I am trying to figure out how to search the Exchange Server log files using the Get_MessageTrackingLog function through the Exchange Management Shell. What I'm actually attempting to find out currently is if our Exchange Server rejected a message due to size limits that we have defined in Exchange. About a month ago I had a user to advise they never received an email from an outside party(Outside party didn't advise they received a Delivery Failed message either). They advised that it did have a large attachment. I did some searching for that email and could never find where it hit our Exchange server. Today the same user advised they were missing another email with several attachments from a different outside party. I did somemore searching today on both the Exchange and Edge servers log files and could not find that email either. I then proceeded to send myself an email with a large attachment from my personnal account to see what happens. I did receive a Delivery Failed message back from our Exchange or Edge server(or it appears to be our Exchange or Edge server anyway, the from address of the Delivery Failure message is from "Mailer-Daemon@mydomain.com", however I've still have not been able to find where this message actually hit either our Edge or Exchange servers in the log files.
Any thoughts on how to search the log files for the messages would be great.
0
Comment
Question by:klh1969
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 4
10 Comments
 
LVL 65

Expert Comment

by:Mestha
ID: 24319725
I don't think message tracking would show it. If the message was rejected on size then it would be rejected at the delivery point. The only place it would be logged is the transport logging.

Simon.
0
 

Author Comment

by:klh1969
ID: 24320042
Is there an EMS command that will allow a search of the transport logs similar to the Get-MessageTrackingLog?
0
 
LVL 6

Expert Comment

by:Froggy_chris
ID: 24325346
Hi,

such rejecion will happen on the HUB.
Make sure (from the EMC) that you have enable the Protocol logs from your Receive connector.

Then you can go to <install root>\TransportRoles\Logs\ProtocolLog\SmtpReceive
Here you'll find the SMTP logs.. enjoy !
0
Revamp Your Training Process

Drastically shorten your training time with WalkMe's advanced online training solution that Guides your trainees to action.

 

Author Comment

by:klh1969
ID: 24326047
Froggy Chris:
Thanks for the information.
The Protocol Logging Level on the receive connector was set to NONE. I changed the setting to VERBOSE and a log file did begin to be create in the path that you stated. However I once again send from my personnal account an email with a large attachment (that would not be allowed). I did once again receive the "Delivery Failed" message back to my personnal account. However there was nothing in the log file in the path above.
0
 
LVL 6

Expert Comment

by:Froggy_chris
ID: 24326095
Well, any mails that comes from outside to inside has to pass throuh the HUB server (or the egde first if you have an edge server).

If you don't find anything in the log, then nothing are even reached Exchange.

How is your Exc toplogy ? how many Edge / transport server (the protocol logs are servers dependant).
Do you have any other Spam filter appliances between Internet and your Exchange ?
0
 
LVL 6

Expert Comment

by:Froggy_chris
ID: 24326116
Some extra information.. when you mentionned "personnal account", i assumed you were talking about External Personnal account... Was I right ?
0
 

Author Comment

by:klh1969
ID: 24326245
Yes, External Personnal account.
I had just enabled the additional logging on the HUB Transport receive connectors which is installed on the Exchange Server in my enviroment. I probably also need to enable the same logging on the EDGE Transport receive connectors on the EDGE server. I'll do that and let you know.
Thanks
0
 
LVL 6

Expert Comment

by:Froggy_chris
ID: 24326301
You'll have to enable the logging for any single server / any single connector indeed

You can use the follwoing powershell to do it in one shot:

get-receiveconnector | get-receiveconnector -protocollogginglevel verbose

(might not work for the edge server though).
0
 

Author Comment

by:klh1969
ID: 24326832
Progress, I guess.
Enabled the protocol logging on the EDGE Transport server receive connector, sent another email with large attachment. I do see where that email was logged in the log file on the EDGE server. It did not show that it was rejected due to size liminations that are in place or anything. In fact there is an entry that says "Queued Mail for Delivery", assuming that means it is forwarding on to the Exchange server. In our enviroment all of the other Exchange Server 2007 applications are installed on this server.
0
 
LVL 6

Accepted Solution

by:
Froggy_chris earned 300 total points
ID: 24328597
Hi,

That probably means rthat you have other limitation.

Check the organisation settings:
get-transportconfig | FL MaxReceiveSize, MaxSendsize
=> settings apply for the whole organisation

then check
get-Receiveconnector | fl Name, MaxReceiveSize
=> setting apply on a given connector,

Chris
0

Featured Post

Office 365 Training for Admins - 7 Day Trial

Learn how to provision tenants, synchronize on-premise Active Directory, implement Single Sign-On, customize Office deployment, and protect your organization with eDiscovery and DLP policies.  Only from Platform Scholar.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Learn to move / copy / export exchange contacts to iPhone without using any software. Also see the issues in configuration of exchange with iPhone to migrate contacts.
A list of top three free exchange EDB viewers that helps the user to extract a mailbox from an unmounted .edb file and get a clear preview of all emails & other items with just a single click on mailboxes.
In this video we show how to create an Address List in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Organization >> Ad…
In this Micro Video tutorial you will learn the basics about Database Availability Groups and How to configure one using a live Exchange Server Environment. The video tutorial explains the basics of the Exchange server Database Availability grou…

739 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question