Searching Message Tracking Logs by Email Subject

We’ve looked at searching Exchange Server message tracking logs by time/date range, and by sender or recipient email address.

Now it is time to look at how to use the email message subject as the search criteria.

Enabling/Disabling Message Tracking Log Subject Logging

The first thing to be aware of is that the message subject is an optional item for message tracking logs. Although the default setting is for subject logging to be enabled, you should verify that it is still configured that way if you wish to be doing log searches using the subject line as the criteria.

You can check all of your Transport servers at once using the Get-TransportServer cmdlet in PowerShell:

[PS] C:\>Get-TransportServer | select name,*subject* | ft -auto

Name           MessageTrackingLogSubjectLoggingEnabled
----           ---------------------------------------
HO-EX2010-MB1                                     True
HO-EX2010-MB2                                     True
BR-EX2010-MB                                      True
HO-EX2010-EDGE                                    True
HO-EX2007-MB1                                     True

If any of the servers are disabled (ie “False”) you can re-enable them using Set-TransportServer.

[PS] C:\>Set-TransportServer ho-ex2010-mb1 -MessageTrackingLogSubjectLoggingEnabled $true

Searching Message Tracking Logs by Message Subject

One of the nice things about using the -MessageSubject parameter for the Get-MessageTrackingLog cmdlet is that it already returns partial match results, so there is no need to pipe to Where-Object for wildcard searches or partial matches.

[PS] C:\>Get-MessageTrackingLog -MessageSubject "payroll"

EventId  Source   Sender                            Recipients                        MessageSubject
-------  ------   ------                            ----------                        --------------
RECEIVE  SMTP     Alan.Reid@exchangeserverpro.net   {David.Gower@exchangeserverpro... Payroll report for September
DELIVER  STORE... Alan.Reid@exchangeserverpro.net   {Alex.Heyne@exchangeserverpro.... Payroll report for September
DELIVER  STORE... Alan.Reid@exchangeserverpro.net   {David.Gower@exchangeserverpro... Payroll report for September
SUBMIT   STORE... Alan.Reid@exchangeserverpro.net   {}                                Payroll report for September

However, if we want to search on multiple criteria with and/or conditions we still need to use Where-Object.

[PS] C:\>Get-MessageTrackingLog -ResultSize Unlimited | Where-Object {$_.MessageSubject -match "payroll" -or $_.MessageSubject -match "meeting"}

EventId  Source   Sender                            Recipients                        MessageSubject
-------  ------   ------                            ----------                        --------------
RECEIVE  SMTP     Alan.Reid@exchangeserverpro.net   {Alan.Reid@exchangeserverpro.net} A meeting #1
HARED... ROUTING  Alan.Reid@exchangeserverpro.net   {Alan.Reid@exchangeserverpro.net} A meeting #1
SEND     SMTP     Alan.Reid@exchangeserverpro.net   {Alan.Reid@exchangeserverpro.net} A meeting #1
RECEIVE  STORE... Mahera.Bawa@exchangeserverpro.net {homeetingroom1@exchangeserver... A meeting about paper
TRANSFER ROUTING  Mahera.Bawa@exchangeserverpro.net {homeetingroom1@exchangeserver... A meeting about paper
DELIVER  STORE... Mahera.Bawa@exchangeserverpro.net {homeetingroom1@exchangeserver... A meeting about paper
RECEIVE  STORE... homeetingroom1@exchangeserverp... {Mahera.Bawa@exchangeserverpro... Accepted: A meeting about paper
DELIVER  STORE... homeetingroom1@exchangeserverp... {Mahera.Bawa@exchangeserverpro... Accepted: A meeting about paper
RECEIVE  SMTP     Alan.Reid@exchangeserverpro.net   {David.Gower@exchangeserverpro... Payroll report for September
DELIVER  STORE... Alan.Reid@exchangeserverpro.net   {Alex.Heyne@exchangeserverpro.... Payroll report for September
DELIVER  STORE... Alan.Reid@exchangeserverpro.net   {David.Gower@exchangeserverpro... Payroll report for September
SUBMIT   STORE... Alan.Reid@exchangeserverpro.net   {}                                Meeting minutes
SUBMIT   STORE... Alan.Reid@exchangeserverpro.net   {}                                A meeting #1
SUBMIT   STORE... Alan.Reid@exchangeserverpro.net   {}                                A meeting #2
SUBMIT   STORE... Alan.Reid@exchangeserverpro.net   {}                                Payroll report for September

As you can see searching message tracking logs based on message subject is quite simple.

Comments

  1. Julie Stenabaugh says

    Is there software that would enable a company to read the content of an email on message tracking?
    Thank you for your help.

    • says

      Message tracking logs don’t store message contents.

      If you want to be able to search and read contents of email messages you can use Exchange’s built in eDiscovery and auditing features, or a third party eDiscovery/compliance product such as Enterprise Vault.

  2. Marco says

    when they are multiple recipients on a message I only get partial recipients with “…” at the end. I would like to see all the recipients. Is it possible to display all the recipients that received a message?

Leave a Reply

Your email address will not be published. Required fields are marked *