Exchange Server 2013 Message Tracking Log PowerShell help ?

Hi People,

Can anyone here please assist me in modifying the PowerShell script below for Exchange Server 2013 Message tracking log ?

Get-TransportService | foreach { Get-Messagetrackinglog -Server $_.Server -Resultsize Unlimited -Start "18/04/2017 1:00:00 AM" -End "18/04/2017 11:00:00 PM" | Where {$_.MessageSubject -contains "*Payroll*" -and $_.Sender -contains "Sender@EmailDomain.com"} | Select @{Name='Recipients';Expression={[string]::join(";", ($_.Recipients))}}, Sender, ClientIp, ClientHostname, Timestamp, EventID, Source, ServerHostname, ServerIp, MessageSubject, TotalBytes, ConnectorId } | Export-Csv C:\TEMP\EmailTrackingLogs2013.csv -NoTypeInformation

Open in new window


The script above does not search through all of the Exchange Server deployed in my entire AD domain.
I need to see if anyone in the company has FW:, RE: or even change the email subject which contains Payroll.

Usually I run the three lines below in my PowerGUI console to connect to one of my Exchange Server 2013 SP1:

$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri http://PRODMBXCAS02-VM/PowerShell/ -Authentication Kerberos
Import-PSSession $Session -AllowClobber
Import-Module ActiveDirectory -ErrorAction STOP

Open in new window


Thanks,
LVL 9
Senior IT System EngineerIT ProfessionalAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Dan McFaddenSystems EngineerCommented:
Inside the foreach, the -Server attribute data, on the Get-MessageTrackingLog" cmdlt, is not referenced correctly.  This "$_.Server" does not reference a field in the object returned by the Get-TransportService cmdlt.

The Get-TransportService command returns 2 fields.  Name &  MessageTrackingLogEnabled.

I would just change the - Server attirbute to $_

Dan
1
Jason CrawfordTransport NinjaCommented:
Try something like this instead:

Get-ExchangeServer | where {$_.isHubTransportServer -eq $true -or $_.isMailboxServer -eq $true} | Get-MessageTrackingLog -Sender xxx -Recipient xxx -Start xxx -End xxx | Sort-Object -Property Timestamp | Format-List | Out-File track.txt

Open in new window

1
Senior IT System EngineerIT ProfessionalAuthor Commented:
I got this error repeated the for all of my Exchange server name:

Cannot process argument transformation on parameter 'Server'. Cannot convert value "PRODMBXCAS04-VM" to type "Microsoft.Exchange.Configuration.Tasks.ServerIdParameter". Error: "Cannot convert hashtable to 
an object of the following type: Microsoft.Exchange.Configuration.Tasks.ServerIdParameter. Hashtable-to-Object conversion is not supported in restricted language mode or a Data section."
    + CategoryInfo          : InvalidData: (:) [Get-MessageTrackingLog], ParameterBindin...mationException
    + FullyQualifiedErrorId : ParameterArgumentTransformationError,Get-MessageTrackingLog
    + PSComputerName        : PRODMBX02-VM

Open in new window


This is the script as per Dan suggestion:
Get-TransportService | foreach { Get-Messagetrackinglog -Server $_ -Resultsize Unlimited -Start "19/04/2017 1:00:00 AM" -End "19/04/2017 11:00:00 PM" | Where {$_.MessageSubject -contains "*Payroll*" -and $_.Sender -contains "ITHelpdesk@domain.com"} | Select @{Name='Recipients';Expression={[string]::join(";", ($_.Recipients))}}, Sender, ClientIp, ClientHostname, Timestamp, EventID, Source, ServerHostname, ServerIp, MessageSubject, TotalBytes, ConnectorId } | Export-Csv C:\TEMP\EmailTrackingLogs2013.csv -NoTypeInformation

Open in new window

0
Determine the Perfect Price for Your IT Services

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden with our free interactive tool and use it to determine the right price for your IT services. Download your free eBook now!

Senior IT System EngineerIT ProfessionalAuthor Commented:
While Jason's suggested code is also not working:

The input object cannot be bound to any parameters for the command either because the command does not take pipeline input or the input and its properties do not match any of the parameters that take 
pipeline input.
    + CategoryInfo          : InvalidArgument: (PRODMBXCAS04-VM:PSObject) [Get-MessageTrackingLog], ParameterBindingException
    + FullyQualifiedErrorId : InputObjectNotBound,Get-MessageTrackingLog
    + PSComputerName        : PRODMBX02-VM

Open in new window


This is the code:
Get-ExchangeServer | where {$_.isHubTransportServer -eq $true -or $_.isMailboxServer -eq $true} | Get-MessageTrackingLog -Resultsize Unlimited -Start "04/18/2017 1:00:00 AM" -End "04/18/2017 11:00:00 PM" | Where {$_.MessageSubject -contains "*Payroll*" -and $_.Sender -contains "ITHelpdesk@domain.com"} | Select @{Name='Recipients';Expression={[string]::join(";", ($_.Recipients))}}, Sender, ClientIp, ClientHostname, Timestamp, EventID, Source, ServerHostname, ServerIp, MessageSubject, TotalBytes, ConnectorId } | Export-Csv C:\TEMP\EmailTrackingLogs2013.csv -NoTypeInformation

Open in new window

0
Dan McFaddenSystems EngineerCommented:
I would try this:

Get-TransportService | foreach { Get-Messagetrackinglog -Server $_.PSComputerName -Resultsize Unlimited -Start "04/19/2017 1:00:00 AM" -End "04/19/2017 11:00:00 PM" | Where {$_.MessageSubject -match "Payroll" -and $_.Sender -match "ITHelpdesk@domain.com"} | Select @{Name='Recipients';Expression={[string]::join(";", ($_.Recipients))}}, Sender, ClientIp, ClientHostname, Timestamp, EventID, Source, ServerHostname, ServerIp, MessageSubject, TotalBytes, ConnectorId } | Export-Csv C:\TEMP\EmailTrackingLogs2013.csv -NoTypeInformation

Open in new window


A little more digging... Get-TransportService returns an object with a lot of data.  If you pipe this command into Get-Member, you can see the components of the results.  PSComputerName is a simple string which the Get-MessageTrackingLog command should take as the -Server attribute.

In the where clause, using -match is a better fit than -contains.  Also, your dates were in the wrong format.  They must be in the following format:  mm/dd/yyyy hh:mm:ss AM/PM

Reference link:  https://technet.microsoft.com/en-us/library/aa997573(v=exchg.150).aspx

Dan
1
Senior IT System EngineerIT ProfessionalAuthor Commented:
Dan,

The reason I'd like to use -contain is so that I can get larger result where the subject is containing that keyword since the mail subject keeps on changing like

FW: Payroll
RE: Payroll
Draft: Payroll
....
0
Jason CrawfordTransport NinjaCommented:
I've been using that one liner since Exchange 2007.  I know it works.  Log directly on to the Exchange server and run it with EMS instead if remoting
1
Senior IT System EngineerIT ProfessionalAuthor Commented:
Jason, does it works for Exchange 2013 ?
0
Senior IT System EngineerIT ProfessionalAuthor Commented:
Dan,

when running the script, I got:

Where : parsing "*Payroll*" - Quantifier {x,y} following nothing.
At line:2 char:168
+ Get-TransportService | foreach { Get-Messagetrackinglog -Server $_.PSComputerNam ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : OperationStopped: (:) [Where-Object], ArgumentException
    + FullyQualifiedErrorId : System.ArgumentException,Microsoft.PowerShell.Commands.WhereObjectCommand

Open in new window

0
Senior IT System EngineerIT ProfessionalAuthor Commented:
I got this error:

The pipeline was not run because a pipeline is already running. Pipelines cannot be run concurrently.
    + CategoryInfo          : OperationStopped: (Microsoft.Power...tHelperRunspace:ExecutionCmdletHelperRunspace) [], PSInvalidOperationException
    + FullyQualifiedErrorId : RemotePipelineExecutionFailed
 
Get-MailboxFolderStatistics : The session Session for implicit remoting module at C:\Users\Admin\AppData\Local\Temp\tmp_4dj2xuk4.x5a\tmp_4dj2xuk4.x5a.psm1, 
6e8bae6f-8f9c-424c-aa35-cc88c316b1db, alexsvr-ex01 is not available to run commands.  The session availability is Busy.
At C:\Users\Admin\AppData\Local\Temp\99d25a74-942d-4cf9-b40e-6776ecd9f7c5.ps1:7 char:10
+          $si = $_ | Get-MailboxFolderStatistics -IncludeOldestAndNewe ...
+          ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: ([PSSession]Sess...j2xuk4.x5a.psm1:PSSession) [Invoke-Command], InvalidRunspaceStateException
    + FullyQualifiedErrorId : InvokeCommandCommandInvalidSessionAvailability,Microsoft.PowerShell.Commands.InvokeCommandCommand
 
No valid sessions were specified.  Ensure you provide valid sessions that are in the Opened state and are available to run commands.
At C:\Users\Admin\AppData\Local\Temp\99d25a74-942d-4cf9-b40e-6776ecd9f7c5.ps1:line:7 char:10
+          $ <<<< si = $_ | Get-MailboxFolderStatistics -IncludeOldestAndNewestItems -FolderScope SentItems 

Open in new window


Pipeline not run because a pipeline is already running. Pipelines cannot be run concurrently.
    + CategoryInfo          : OperationStopped: (Microsoft.Power...tHelperRunspace:ExecutionCmdletHelperRunspace) [], PSInvalidOperationException
    + FullyQualifiedErrorId : RemotePipelineExecutionFailed

Open in new window

0
Dan McFaddenSystems EngineerCommented:
Are you running the command from an Exchange server or from a remote session?

Dan
1
Senior IT System EngineerIT ProfessionalAuthor Commented:
From my laptop with PowerGUI IDE.
0
Jason CrawfordTransport NinjaCommented:
Yes it absolutely works for 2013.  Alternately you can just run Get-TransportServer piped to Get-MessageTrackingLog
1
Dan McFaddenSystems EngineerCommented:
The errors you posted seem to indicate that you tried to run the command while no session was setup.

As a side note:  Get-TransportServer and Get-TransportService return basically the same info.  Though the Get-TransportServer command is being depreciated by Microsoft.

I tested a modified command of the one I posted, it ran without errors.  This is the command I tested:

Get-TransportService | %{Write-Host $_.Name;Get-Messagetrackinglog -Server $_.Name -Resultsize Unlimited -Start "04/19/2017 1:00:00 AM" -End "04/19/2017 01:15:00 AM" | Where {$_.MessageSubject -match "Fehler"}}

Open in new window


I switched the -Server attribute again.  This $_.Name appears to properly ID the server data from the piped in object.  I verified emails with the word "Fehler" in the subject exist in my logs.

I setup a PSSession:

1. $s = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri http://servername.domain.com/PowerShell/ -Authentication Kerberos
2. Import-PSSession $s

Open in new window


Then run the MTL search.  I injected the Write-Host $_.Name to make sure the foreach loop ran thru all my Exchange servers.

Dan
1

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Senior IT System EngineerIT ProfessionalAuthor Commented:
Thanks Dan it works.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Powershell

From novice to tech pro — start learning today.