We help IT Professionals succeed at work.

Tracking outbound messages in Exchange 2010

Muhajreen
Muhajreen asked
on
Hello experts,

We have Exchange 2010 SP1. It uses an SMTP relay server to send messages through. That server allows us to send 300 messages per day. We usually send about 70 messages of them.

Suddenly today, 300 messages were sent so we can't send anymore messages. I have increased the quota to 450 to solve this. But in less than an hour, those 150 messages were used !

I think there is some computer infected with a virus inside the network.

The question: How to track which users have sent messages through exchange in the last 24 hours?
Comment
Watch Question

Commented:
You can use the 'Tracking Log Explorer' from Exchange Management Console -> Toolbox

Just set SEND as the EventID and the timeframe required.

-Ninjatek
Andor OudtHybrid Cloud Infrastructure Consultant

Commented:
Get-TransportServer | Get-MessageTrackingLog -Start "12/06/2011 12:00AM" -ResultSize Unlimited | Where {$_.EventId -match "<Send>"} | Select-Object Timestamp,SourceContext,Source,EventId,MessageSubject,Sender,{$_.Recipients} | export-csv <path to desired output-file\name of output file.extension>

Is this something you can work with?

Author

Commented:
@no-rad
Your solution is great and is better than using gui. Thank you for it. I am sorry that I have already assigned all the 500 points.
Andor OudtHybrid Cloud Infrastructure Consultant

Commented:
no worries and your welcome....perhaps next time wait a bit longer for the best/correct answer?!