We help IT Professionals succeed at work.

Tracking outbound messages in Exchange 2010

Muhajreen asked
Hello experts,

We have Exchange 2010 SP1. It uses an SMTP relay server to send messages through. That server allows us to send 300 messages per day. We usually send about 70 messages of them.

Suddenly today, 300 messages were sent so we can't send anymore messages. I have increased the quota to 450 to solve this. But in less than an hour, those 150 messages were used !

I think there is some computer infected with a virus inside the network.

The question: How to track which users have sent messages through exchange in the last 24 hours?
Watch Question

You can use the 'Tracking Log Explorer' from Exchange Management Console -> Toolbox

Just set SEND as the EventID and the timeframe required.

Andor OudtHybrid Cloud Infrastructure Consultant

Get-TransportServer | Get-MessageTrackingLog -Start "12/06/2011 12:00AM" -ResultSize Unlimited | Where {$_.EventId -match "<Send>"} | Select-Object Timestamp,SourceContext,Source,EventId,MessageSubject,Sender,{$_.Recipients} | export-csv <path to desired output-file\name of output file.extension>

Is this something you can work with?


Your solution is great and is better than using gui. Thank you for it. I am sorry that I have already assigned all the 500 points.
Andor OudtHybrid Cloud Infrastructure Consultant

no worries and your welcome....perhaps next time wait a bit longer for the best/correct answer?!