Avatar of Albert Widjaja
Albert Widjaja
Flag for Australia asked on

Exchange Server 2013 Message Tracking Log PowerShell help ?

Hi People,

Can anyone here please assist me in modifying the PowerShell script below for Exchange Server 2013 Message tracking log ?

Get-TransportService | foreach { Get-Messagetrackinglog -Server $_.Server -Resultsize Unlimited -Start "18/04/2017 1:00:00 AM" -End "18/04/2017 11:00:00 PM" | Where {$_.MessageSubject -contains "*Payroll*" -and $_.Sender -contains "Sender@EmailDomain.com"} | Select @{Name='Recipients';Expression={[string]::join(";", ($_.Recipients))}}, Sender, ClientIp, ClientHostname, Timestamp, EventID, Source, ServerHostname, ServerIp, MessageSubject, TotalBytes, ConnectorId } | Export-Csv C:\TEMP\EmailTrackingLogs2013.csv -NoTypeInformation

Open in new window


The script above does not search through all of the Exchange Server deployed in my entire AD domain.
I need to see if anyone in the company has FW:, RE: or even change the email subject which contains Payroll.

Usually I run the three lines below in my PowerGUI console to connect to one of my Exchange Server 2013 SP1:

$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri http://PRODMBXCAS02-VM/PowerShell/ -Authentication Kerberos
Import-PSSession $Session -AllowClobber
Import-Module ActiveDirectory -ErrorAction STOP

Open in new window


Thanks,
PowershellExchange

Avatar of undefined
Last Comment
Albert Widjaja

8/22/2022 - Mon
Dan McFadden

Inside the foreach, the -Server attribute data, on the Get-MessageTrackingLog" cmdlt, is not referenced correctly.  This "$_.Server" does not reference a field in the object returned by the Get-TransportService cmdlt.

The Get-TransportService command returns 2 fields.  Name &  MessageTrackingLogEnabled.

I would just change the - Server attirbute to $_

Dan
Jason Crawford

Try something like this instead:

Get-ExchangeServer | where {$_.isHubTransportServer -eq $true -or $_.isMailboxServer -eq $true} | Get-MessageTrackingLog -Sender xxx -Recipient xxx -Start xxx -End xxx | Sort-Object -Property Timestamp | Format-List | Out-File track.txt

Open in new window

Albert Widjaja

ASKER
I got this error repeated the for all of my Exchange server name:

Cannot process argument transformation on parameter 'Server'. Cannot convert value "PRODMBXCAS04-VM" to type "Microsoft.Exchange.Configuration.Tasks.ServerIdParameter". Error: "Cannot convert hashtable to 
an object of the following type: Microsoft.Exchange.Configuration.Tasks.ServerIdParameter. Hashtable-to-Object conversion is not supported in restricted language mode or a Data section."
    + CategoryInfo          : InvalidData: (:) [Get-MessageTrackingLog], ParameterBindin...mationException
    + FullyQualifiedErrorId : ParameterArgumentTransformationError,Get-MessageTrackingLog
    + PSComputerName        : PRODMBX02-VM

Open in new window


This is the script as per Dan suggestion:
Get-TransportService | foreach { Get-Messagetrackinglog -Server $_ -Resultsize Unlimited -Start "19/04/2017 1:00:00 AM" -End "19/04/2017 11:00:00 PM" | Where {$_.MessageSubject -contains "*Payroll*" -and $_.Sender -contains "ITHelpdesk@domain.com"} | Select @{Name='Recipients';Expression={[string]::join(";", ($_.Recipients))}}, Sender, ClientIp, ClientHostname, Timestamp, EventID, Source, ServerHostname, ServerIp, MessageSubject, TotalBytes, ConnectorId } | Export-Csv C:\TEMP\EmailTrackingLogs2013.csv -NoTypeInformation

Open in new window

I started with Experts Exchange in 2004 and it's been a mainstay of my professional computing life since. It helped me launch a career as a programmer / Oracle data analyst
William Peck
Albert Widjaja

ASKER
While Jason's suggested code is also not working:

The input object cannot be bound to any parameters for the command either because the command does not take pipeline input or the input and its properties do not match any of the parameters that take 
pipeline input.
    + CategoryInfo          : InvalidArgument: (PRODMBXCAS04-VM:PSObject) [Get-MessageTrackingLog], ParameterBindingException
    + FullyQualifiedErrorId : InputObjectNotBound,Get-MessageTrackingLog
    + PSComputerName        : PRODMBX02-VM

Open in new window


This is the code:
Get-ExchangeServer | where {$_.isHubTransportServer -eq $true -or $_.isMailboxServer -eq $true} | Get-MessageTrackingLog -Resultsize Unlimited -Start "04/18/2017 1:00:00 AM" -End "04/18/2017 11:00:00 PM" | Where {$_.MessageSubject -contains "*Payroll*" -and $_.Sender -contains "ITHelpdesk@domain.com"} | Select @{Name='Recipients';Expression={[string]::join(";", ($_.Recipients))}}, Sender, ClientIp, ClientHostname, Timestamp, EventID, Source, ServerHostname, ServerIp, MessageSubject, TotalBytes, ConnectorId } | Export-Csv C:\TEMP\EmailTrackingLogs2013.csv -NoTypeInformation

Open in new window

Dan McFadden

I would try this:

Get-TransportService | foreach { Get-Messagetrackinglog -Server $_.PSComputerName -Resultsize Unlimited -Start "04/19/2017 1:00:00 AM" -End "04/19/2017 11:00:00 PM" | Where {$_.MessageSubject -match "Payroll" -and $_.Sender -match "ITHelpdesk@domain.com"} | Select @{Name='Recipients';Expression={[string]::join(";", ($_.Recipients))}}, Sender, ClientIp, ClientHostname, Timestamp, EventID, Source, ServerHostname, ServerIp, MessageSubject, TotalBytes, ConnectorId } | Export-Csv C:\TEMP\EmailTrackingLogs2013.csv -NoTypeInformation

Open in new window


A little more digging... Get-TransportService returns an object with a lot of data.  If you pipe this command into Get-Member, you can see the components of the results.  PSComputerName is a simple string which the Get-MessageTrackingLog command should take as the -Server attribute.

In the where clause, using -match is a better fit than -contains.  Also, your dates were in the wrong format.  They must be in the following format:  mm/dd/yyyy hh:mm:ss AM/PM

Reference link:  https://technet.microsoft.com/en-us/library/aa997573(v=exchg.150).aspx

Dan
Albert Widjaja

ASKER
Dan,

The reason I'd like to use -contain is so that I can get larger result where the subject is containing that keyword since the mail subject keeps on changing like

FW: Payroll
RE: Payroll
Draft: Payroll
....
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
Jason Crawford

I've been using that one liner since Exchange 2007.  I know it works.  Log directly on to the Exchange server and run it with EMS instead if remoting
Albert Widjaja

ASKER
Jason, does it works for Exchange 2013 ?
Albert Widjaja

ASKER
Dan,

when running the script, I got:

Where : parsing "*Payroll*" - Quantifier {x,y} following nothing.
At line:2 char:168
+ Get-TransportService | foreach { Get-Messagetrackinglog -Server $_.PSComputerNam ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : OperationStopped: (:) [Where-Object], ArgumentException
    + FullyQualifiedErrorId : System.ArgumentException,Microsoft.PowerShell.Commands.WhereObjectCommand

Open in new window

Experts Exchange has (a) saved my job multiple times, (b) saved me hours, days, and even weeks of work, and often (c) makes me look like a superhero! This place is MAGIC!
Walt Forbes
Albert Widjaja

ASKER
I got this error:

The pipeline was not run because a pipeline is already running. Pipelines cannot be run concurrently.
    + CategoryInfo          : OperationStopped: (Microsoft.Power...tHelperRunspace:ExecutionCmdletHelperRunspace) [], PSInvalidOperationException
    + FullyQualifiedErrorId : RemotePipelineExecutionFailed
 
Get-MailboxFolderStatistics : The session Session for implicit remoting module at C:\Users\Admin\AppData\Local\Temp\tmp_4dj2xuk4.x5a\tmp_4dj2xuk4.x5a.psm1, 
6e8bae6f-8f9c-424c-aa35-cc88c316b1db, alexsvr-ex01 is not available to run commands.  The session availability is Busy.
At C:\Users\Admin\AppData\Local\Temp\99d25a74-942d-4cf9-b40e-6776ecd9f7c5.ps1:7 char:10
+          $si = $_ | Get-MailboxFolderStatistics -IncludeOldestAndNewe ...
+          ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: ([PSSession]Sess...j2xuk4.x5a.psm1:PSSession) [Invoke-Command], InvalidRunspaceStateException
    + FullyQualifiedErrorId : InvokeCommandCommandInvalidSessionAvailability,Microsoft.PowerShell.Commands.InvokeCommandCommand
 
No valid sessions were specified.  Ensure you provide valid sessions that are in the Opened state and are available to run commands.
At C:\Users\Admin\AppData\Local\Temp\99d25a74-942d-4cf9-b40e-6776ecd9f7c5.ps1:line:7 char:10
+          $ <<<< si = $_ | Get-MailboxFolderStatistics -IncludeOldestAndNewestItems -FolderScope SentItems 

Open in new window


Pipeline not run because a pipeline is already running. Pipelines cannot be run concurrently.
    + CategoryInfo          : OperationStopped: (Microsoft.Power...tHelperRunspace:ExecutionCmdletHelperRunspace) [], PSInvalidOperationException
    + FullyQualifiedErrorId : RemotePipelineExecutionFailed

Open in new window

Dan McFadden

Are you running the command from an Exchange server or from a remote session?

Dan
Albert Widjaja

ASKER
From my laptop with PowerGUI IDE.
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
Jason Crawford

Yes it absolutely works for 2013.  Alternately you can just run Get-TransportServer piped to Get-MessageTrackingLog
ASKER CERTIFIED SOLUTION
Dan McFadden

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
Albert Widjaja

ASKER
Thanks Dan it works.