Exchange Server 2013 Message Tracking Log PowerShell help ?

Senior IT System Engineer
Senior IT System Engineer used Ask the Experts™
on
Hi People,

Can anyone here please assist me in modifying the PowerShell script below for Exchange Server 2013 Message tracking log ?

Get-TransportService | foreach { Get-Messagetrackinglog -Server $_.Server -Resultsize Unlimited -Start "18/04/2017 1:00:00 AM" -End "18/04/2017 11:00:00 PM" | Where {$_.MessageSubject -contains "*Payroll*" -and $_.Sender -contains "Sender@EmailDomain.com"} | Select @{Name='Recipients';Expression={[string]::join(";", ($_.Recipients))}}, Sender, ClientIp, ClientHostname, Timestamp, EventID, Source, ServerHostname, ServerIp, MessageSubject, TotalBytes, ConnectorId } | Export-Csv C:\TEMP\EmailTrackingLogs2013.csv -NoTypeInformation

Open in new window


The script above does not search through all of the Exchange Server deployed in my entire AD domain.
I need to see if anyone in the company has FW:, RE: or even change the email subject which contains Payroll.

Usually I run the three lines below in my PowerGUI console to connect to one of my Exchange Server 2013 SP1:

$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri http://PRODMBXCAS02-VM/PowerShell/ -Authentication Kerberos
Import-PSSession $Session -AllowClobber
Import-Module ActiveDirectory -ErrorAction STOP

Open in new window


Thanks,
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Dan McFaddenSystems Engineer

Commented:
Inside the foreach, the -Server attribute data, on the Get-MessageTrackingLog" cmdlt, is not referenced correctly.  This "$_.Server" does not reference a field in the object returned by the Get-TransportService cmdlt.

The Get-TransportService command returns 2 fields.  Name &  MessageTrackingLogEnabled.

I would just change the - Server attirbute to $_

Dan

Commented:
Try something like this instead:

Get-ExchangeServer | where {$_.isHubTransportServer -eq $true -or $_.isMailboxServer -eq $true} | Get-MessageTrackingLog -Sender xxx -Recipient xxx -Start xxx -End xxx | Sort-Object -Property Timestamp | Format-List | Out-File track.txt

Open in new window

Author

Commented:
I got this error repeated the for all of my Exchange server name:

Cannot process argument transformation on parameter 'Server'. Cannot convert value "PRODMBXCAS04-VM" to type "Microsoft.Exchange.Configuration.Tasks.ServerIdParameter". Error: "Cannot convert hashtable to 
an object of the following type: Microsoft.Exchange.Configuration.Tasks.ServerIdParameter. Hashtable-to-Object conversion is not supported in restricted language mode or a Data section."
    + CategoryInfo          : InvalidData: (:) [Get-MessageTrackingLog], ParameterBindin...mationException
    + FullyQualifiedErrorId : ParameterArgumentTransformationError,Get-MessageTrackingLog
    + PSComputerName        : PRODMBX02-VM

Open in new window


This is the script as per Dan suggestion:
Get-TransportService | foreach { Get-Messagetrackinglog -Server $_ -Resultsize Unlimited -Start "19/04/2017 1:00:00 AM" -End "19/04/2017 11:00:00 PM" | Where {$_.MessageSubject -contains "*Payroll*" -and $_.Sender -contains "ITHelpdesk@domain.com"} | Select @{Name='Recipients';Expression={[string]::join(";", ($_.Recipients))}}, Sender, ClientIp, ClientHostname, Timestamp, EventID, Source, ServerHostname, ServerIp, MessageSubject, TotalBytes, ConnectorId } | Export-Csv C:\TEMP\EmailTrackingLogs2013.csv -NoTypeInformation

Open in new window

Ensure you’re charging the right price for your IT

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

Author

Commented:
While Jason's suggested code is also not working:

The input object cannot be bound to any parameters for the command either because the command does not take pipeline input or the input and its properties do not match any of the parameters that take 
pipeline input.
    + CategoryInfo          : InvalidArgument: (PRODMBXCAS04-VM:PSObject) [Get-MessageTrackingLog], ParameterBindingException
    + FullyQualifiedErrorId : InputObjectNotBound,Get-MessageTrackingLog
    + PSComputerName        : PRODMBX02-VM

Open in new window


This is the code:
Get-ExchangeServer | where {$_.isHubTransportServer -eq $true -or $_.isMailboxServer -eq $true} | Get-MessageTrackingLog -Resultsize Unlimited -Start "04/18/2017 1:00:00 AM" -End "04/18/2017 11:00:00 PM" | Where {$_.MessageSubject -contains "*Payroll*" -and $_.Sender -contains "ITHelpdesk@domain.com"} | Select @{Name='Recipients';Expression={[string]::join(";", ($_.Recipients))}}, Sender, ClientIp, ClientHostname, Timestamp, EventID, Source, ServerHostname, ServerIp, MessageSubject, TotalBytes, ConnectorId } | Export-Csv C:\TEMP\EmailTrackingLogs2013.csv -NoTypeInformation

Open in new window

Dan McFaddenSystems Engineer

Commented:
I would try this:

Get-TransportService | foreach { Get-Messagetrackinglog -Server $_.PSComputerName -Resultsize Unlimited -Start "04/19/2017 1:00:00 AM" -End "04/19/2017 11:00:00 PM" | Where {$_.MessageSubject -match "Payroll" -and $_.Sender -match "ITHelpdesk@domain.com"} | Select @{Name='Recipients';Expression={[string]::join(";", ($_.Recipients))}}, Sender, ClientIp, ClientHostname, Timestamp, EventID, Source, ServerHostname, ServerIp, MessageSubject, TotalBytes, ConnectorId } | Export-Csv C:\TEMP\EmailTrackingLogs2013.csv -NoTypeInformation

Open in new window


A little more digging... Get-TransportService returns an object with a lot of data.  If you pipe this command into Get-Member, you can see the components of the results.  PSComputerName is a simple string which the Get-MessageTrackingLog command should take as the -Server attribute.

In the where clause, using -match is a better fit than -contains.  Also, your dates were in the wrong format.  They must be in the following format:  mm/dd/yyyy hh:mm:ss AM/PM

Reference link:  https://technet.microsoft.com/en-us/library/aa997573(v=exchg.150).aspx

Dan

Author

Commented:
Dan,

The reason I'd like to use -contain is so that I can get larger result where the subject is containing that keyword since the mail subject keeps on changing like

FW: Payroll
RE: Payroll
Draft: Payroll
....

Commented:
I've been using that one liner since Exchange 2007.  I know it works.  Log directly on to the Exchange server and run it with EMS instead if remoting

Author

Commented:
Jason, does it works for Exchange 2013 ?

Author

Commented:
Dan,

when running the script, I got:

Where : parsing "*Payroll*" - Quantifier {x,y} following nothing.
At line:2 char:168
+ Get-TransportService | foreach { Get-Messagetrackinglog -Server $_.PSComputerNam ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : OperationStopped: (:) [Where-Object], ArgumentException
    + FullyQualifiedErrorId : System.ArgumentException,Microsoft.PowerShell.Commands.WhereObjectCommand

Open in new window

Author

Commented:
I got this error:

The pipeline was not run because a pipeline is already running. Pipelines cannot be run concurrently.
    + CategoryInfo          : OperationStopped: (Microsoft.Power...tHelperRunspace:ExecutionCmdletHelperRunspace) [], PSInvalidOperationException
    + FullyQualifiedErrorId : RemotePipelineExecutionFailed
 
Get-MailboxFolderStatistics : The session Session for implicit remoting module at C:\Users\Admin\AppData\Local\Temp\tmp_4dj2xuk4.x5a\tmp_4dj2xuk4.x5a.psm1, 
6e8bae6f-8f9c-424c-aa35-cc88c316b1db, alexsvr-ex01 is not available to run commands.  The session availability is Busy.
At C:\Users\Admin\AppData\Local\Temp\99d25a74-942d-4cf9-b40e-6776ecd9f7c5.ps1:7 char:10
+          $si = $_ | Get-MailboxFolderStatistics -IncludeOldestAndNewe ...
+          ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: ([PSSession]Sess...j2xuk4.x5a.psm1:PSSession) [Invoke-Command], InvalidRunspaceStateException
    + FullyQualifiedErrorId : InvokeCommandCommandInvalidSessionAvailability,Microsoft.PowerShell.Commands.InvokeCommandCommand
 
No valid sessions were specified.  Ensure you provide valid sessions that are in the Opened state and are available to run commands.
At C:\Users\Admin\AppData\Local\Temp\99d25a74-942d-4cf9-b40e-6776ecd9f7c5.ps1:line:7 char:10
+          $ <<<< si = $_ | Get-MailboxFolderStatistics -IncludeOldestAndNewestItems -FolderScope SentItems 

Open in new window


Pipeline not run because a pipeline is already running. Pipelines cannot be run concurrently.
    + CategoryInfo          : OperationStopped: (Microsoft.Power...tHelperRunspace:ExecutionCmdletHelperRunspace) [], PSInvalidOperationException
    + FullyQualifiedErrorId : RemotePipelineExecutionFailed

Open in new window

Dan McFaddenSystems Engineer

Commented:
Are you running the command from an Exchange server or from a remote session?

Dan

Author

Commented:
From my laptop with PowerGUI IDE.

Commented:
Yes it absolutely works for 2013.  Alternately you can just run Get-TransportServer piped to Get-MessageTrackingLog
Systems Engineer
Commented:
The errors you posted seem to indicate that you tried to run the command while no session was setup.

As a side note:  Get-TransportServer and Get-TransportService return basically the same info.  Though the Get-TransportServer command is being depreciated by Microsoft.

I tested a modified command of the one I posted, it ran without errors.  This is the command I tested:

Get-TransportService | %{Write-Host $_.Name;Get-Messagetrackinglog -Server $_.Name -Resultsize Unlimited -Start "04/19/2017 1:00:00 AM" -End "04/19/2017 01:15:00 AM" | Where {$_.MessageSubject -match "Fehler"}}

Open in new window


I switched the -Server attribute again.  This $_.Name appears to properly ID the server data from the piped in object.  I verified emails with the word "Fehler" in the subject exist in my logs.

I setup a PSSession:

1. $s = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri http://servername.domain.com/PowerShell/ -Authentication Kerberos
2. Import-PSSession $s

Open in new window


Then run the MTL search.  I injected the Write-Host $_.Name to make sure the foreach loop ran thru all my Exchange servers.

Dan

Author

Commented:
Thanks Dan it works.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial