This information is useful for scenarios such as checking whether your outbound mail may experiencing a high rate of failure, or discovering whether someone is continually trying to relay through your email server (in which case you could then look at the top sender IP addresses to investigate further).

Remember that protocol logging is not enabled by default on Exchange 2010, and must be enabled on a per-connector basis if you want to use it.

For SMTP error statistics we can use Log Parser to check the protocol logs for instances of SMTP status codes starting with “5″ (which are permanent failures). The Log Parser query for this is as follows:

SELECT data as [Status Code],
	Count(*) as Hits
FROM *.log
WHERE data LIKE '5%'
GROUP BY data
ORDER BY Hits DESC

When run from the folder containing the protocol logs it will be as follows:

"C:\Program Files (x86)\Log Parser 2.2\logparser.exe" "SELECT data as [Status Code],Count(*) as Hits FROM *.log WHERE data LIKE '5%' GROUP BY data ORDER BY Hits DESC" -i:CSV -nSkipLines:4 -rtp:-1

This will give you output similar to this:

Status Code                                       Hits
------------------------------------------------- ----
500 5.3.3 Unrecognized command                    3632
501 5.1.3 Invalid address                         1411
501 5.1.7 Invalid address                         200
554 5.4.6 Hop count exceeded - possible mail loop 100
503 5.5.2 Send hello first                        20
503 5.5.2 Sender already specified                4
501 5.5.4 Unrecognized parameter                  2
504 5.7.4 Unrecognized authentication type        1

Statistics:
-----------
Elements processed: 13113294
Elements output:    8
Execution time:     150.15 seconds (00:02:30.15)

You can also report on the number of SMTP errors occurring each day to get a baseline, which will help when you need to identify whether a sudden spike in SMTP errors has occurred. This Log Parser query will be as follows:

SELECT TO_LOCALTIME(TO_TIMESTAMP(EXTRACT_PREFIX(TO_STRING([#Fields: date-time]),0,'T'), 'yyyy-MM-dd')) AS Date,
	COUNT(*) AS Hits
FROM *.log
WHERE (data LIKE '5%')
GROUP BY Date
ORDER BY Date ASC

When run from the protocol log directory it will be as follows:

"C:\Program Files (x86)\Log Parser 2.2\logparser.exe" "SELECT TO_LOCALTIME(TO_TIMESTAMP(EXTRACT_PREFIX(TO_STRING([#Fields: date-time]),0,'T'), 'yyyy-MM-dd')) AS Date, COUNT(*) AS Hits from *.log where (data LIKE '5%') GROUP BY Date ORDER BY Date ASC" -i:CSV -nSkipLines:4 -rtp:-1

And of course, provided you have the Office Web Components installed, you can generate a graph of this same data.

"C:\Program Files (x86)\Log Parser 2.2\logparser.exe" "SELECT TO_LOCALTIME(TO_TIMESTAMP(EXTRACT_PREFIX(TO_STRING([#Fields: date-time]),0,'T'), 'yyyy-MM-dd')) AS Date, COUNT(*) AS [SMTP Errors] INTO DailySMTPErrors.gif from *.log where (data LIKE '5%') GROUP BY Date ORDER BY Date ASC" -i:CSV -nSkipLines:4 -chartType:Column3D

Which will give you a graph similar to this:

Related posts:

• The Case of the Hub Transport Server Load Imbalance
• Report Top Sender IP’s on Exchange Server 2010 using Log Parser
• Calculate Hourly Email Traffic using Message Tracking Logs and Log Parser
• Calculate Daily Email Traffic using Message Tracking Logs and Log Parser
• Reporting Exchange Server 2010 Message Tracking Event IDs with Log Parser

This article Generate SMTP Error Statistics using Log Parser and Exchange Server 2010 Protocol Logs is © 2012 ExchangeServerPro.com

Get more Exchange Server tips at ExchangeServerPro.com

To be able to identify this type of problem you should first know what your normal email traffic patterns look like. You can find this information by using Log Parser to search through your Exchange server’s message tracking logs.

There are two ways to look at this traffic.

• As a total of the traffic per hour for all days combined
• As the traffic per hour for each separate day

Total Email Traffic Per Hour for All Days Combined

First let’s look at the Log Parser query to calculate the total email traffic per hour for all days combined.

SELECT QUANTIZE(TO_LOCALTIME(TO_TIMESTAMP(EXTRACT_PREFIX(TO_STRING(EXTRACT_SUFFIX([#Fields: date-time],0,'T')),0,'.'), 'hh:mm:ss')),3600) AS Hour,
	COUNT(*) AS Messages
FROM *.log
WHERE (event-id='RECEIVE')
GROUP BY Hour
ORDER BY Hour ASC

When run from the folder where the message tracking logs are located the full syntax is:

"C:\Program Files (x86)\Log Parser 2.2\logparser.exe" "SELECT QUANTIZE(TO_LOCALTIME(TO_TIMESTAMP(EXTRACT_PREFIX(TO_STRING(EXTRACT_SUFFIX([#Fields: date-time],0,'T')),0,'.'), 'hh:mm:ss')),3600) AS Hour, COUNT(*) AS Messages from *.log where (event-id='RECEIVE') GROUP BY Hour ORDER BY Hour ASC" -i:CSV -nSkipLines:4 -rtp:-1

This will return results similar to these:

Hour     Messages
-------- --------
00:00:00 408
01:00:00 415
02:00:00 363
03:00:00 347
04:00:00 273
05:00:00 327
06:00:00 403
07:00:00 450
08:00:00 590
09:00:00 574
10:00:00 637
11:00:00 810
12:00:00 612
13:00:00 597
14:00:00 700
15:00:00 789
16:00:00 821
17:00:00 448
18:00:00 396
19:00:00 527
20:00:00 346
21:00:00 476
22:00:00 348
23:00:00 448

Statistics:
-----------
Elements processed: 106823
Elements output:    24
Execution time:     0.58 seconds

You can also generate graphs straight from Log Parser (if you have the required Office Web Components installed) with slightly different syntax like this:

"C:\Program Files (x86)\Log Parser 2.2\logparser.exe" "SELECT QUANTIZE(TO_LOCALTIME(TO_TIMESTAMP(EXTRACT_PREFIX(TO_STRING(EXTRACT_SUFFIX([#Fields: date-time],0,'T')),0,'.'), 'hh:mm:ss')),3600) AS Hour, COUNT(*) AS [Messages per Hour] INTO HourlyTraffic.gif from *.log where (event-id='RECEIVE') GROUP BY Hour ORDER BY Hour ASC" -i:CSV -nSkipLines:4 -chartType:Column3D

That Log Parser query will generate a column graph for you similar to this.

Total Email Traffic Per Hour for Each Separate Day

If you’d rather see the hourly traffic for each separate day you can use the following Log Parser query that handles the timestamps slightly differently.

SELECT TO_LOCALTIME(QUANTIZE(TO_TIMESTAMP(TO_STRING(EXTRACT_PREFIX([#Fields: date-time],0,'.')), 'yyyy-MM-ddThh:mm:ss'),3600)) AS Hour,
	COUNT(*) AS Messages
FROM *.log
WHERE event-id='RECEIVE'
GROUP BY Hour
ORDER BY Hour ASC

The full Log Parser command when run from the folder containing the message tracking logs is as follows:

"C:\Program Files (x86)\Log Parser 2.2\logparser.exe" "SELECT TO_LOCALTIME(QUANTIZE(TO_TIMESTAMP(TO_STRING(EXTRACT_PREFIX([#Fields: date-time],0,'.')), 'yyyy-MM-ddThh:mm:ss'),3600)) AS Hour, COUNT(*) AS Messages from *.log where event-id='RECEIVE' GROUP BY Hour ORDER BY Hour ASC" -i:CSV -nSkipLines:4 -rtp:-1

This will generate a lot of output depending on the amount of log retention you have configured.

Hour                Messages
------------------- --------
2012-04-05 10:00:00 48
2012-04-05 11:00:00 77
2012-04-05 12:00:00 35
2012-04-05 13:00:00 74
2012-04-05 14:00:00 84
2012-04-05 15:00:00 86
2012-04-05 16:00:00 79
2012-04-05 17:00:00 35
2012-04-05 18:00:00 44
2012-04-05 19:00:00 24
2012-04-05 20:00:00 41
2012-04-05 21:00:00 19
2012-04-05 22:00:00 40
2012-04-05 23:00:00 59
2012-04-06 00:00:00 28
2012-04-06 01:00:00 42
2012-04-06 02:00:00 22
2012-04-06 03:00:00 31
2012-04-06 04:00:00 16
2012-04-06 05:00:00 31
2012-04-06 06:00:00 40
2012-04-06 07:00:00 22
2012-04-06 08:00:00 84
2012-04-06 09:00:00 77
2012-04-06 10:00:00 46
2012-04-06 11:00:00 84
....

As with other Log Parser results you can output this one to a graph as well (again, providing that you have the Office Web Components installed).

Because of the amount of data a line graph seems more appropriate than a column graph. The default size of a graph generated by Log Parser is 640×480, but you can use the -groupsize parameter to set a custom width x height that suits the amount of data being included.

"C:\Program Files (x86)\Log Parser 2.2\logparser.exe" "SELECT TO_LOCALTIME(QUANTIZE(TO_TIMESTAMP(TO_STRING(EXTRACT_PREFIX([#Fields: date-time],0,'.')), 'yyyy-MM-ddThh:mm:ss'),3600)) AS Hour, COUNT(*) AS Messages INTO DailyTrafficPerHour.gif from *.log where event-id='RECEIVE' GROUP BY Hour ORDER BY Hour ASC" -i:CSV -nSkipLines:4 -chartType:Line -groupsize:1024x480

Related posts:

• Calculate Daily Email Traffic using Message Tracking Logs and Log Parser
• Reporting Exchange Server 2010 Message Tracking Event IDs with Log Parser
• The Case of the Hub Transport Server Load Imbalance
• Generate SMTP Error Statistics using Log Parser and Exchange Server 2010 Protocol Logs
• Report Top Sender IP’s on Exchange Server 2010 using Log Parser

This article Calculate Hourly Email Traffic using Message Tracking Logs and Log Parser is © 2012 ExchangeServerPro.com

Get more Exchange Server tips at ExchangeServerPro.com

I run this report almost every day (we retain up to 30 days of message tracking logs so running every day is not required) to look for any patterns or trends that may concern us.

The report can be quickly generated using Log Parser. Install it on the server and run the following query from the folder where the message tracking logs are stored.

SELECT TO_LOCALTIME(TO_TIMESTAMP(EXTRACT_PREFIX(TO_STRING([#Fields: date-time]),0,'T'), 'yyyy-MM-dd')) AS Date,
       COUNT(*) AS Hits
from *.log
where (event-id='RECEIVE')
GROUP BY Date
ORDER BY Date ASC

As a single command line it will be as follows:

"C:\Program Files (x86)\Log Parser 2.2\logparser.exe" "SELECT TO_LOCALTIME(TO_TIMESTAMP(EXTRACT_PREFIX(TO_STRING([#Fields: date-time]),0,'T'), 'yyyy-MM-dd')) AS Date, COUNT(*) AS Hits from *.log where (event-id='RECEIVE') GROUP BY Date ORDER BY Date ASC" -i:CSV -nSkipLines:4 -rtp:-1

This will give you output similar to this:

Date       Hits
---------- ----
2012-03-17 5311
2012-03-18 2575
2012-03-19 6296
2012-03-23 283
2012-03-24 1
2012-03-25 1
2012-03-26 5
2012-03-27 1
2012-03-29 635
2012-03-30 255
2012-03-31 883
2012-04-01 856
2012-04-02 1051
2012-04-03 1178
2012-04-04 1145
2012-04-05 1138
2012-04-06 1203
2012-04-07 866
2012-04-08 1016
2012-04-09 1210
2012-04-10 1171
2012-04-11 833
2012-04-12 26
2012-04-14 21
2012-04-15 1

Statistics:
-----------
Elements processed: 106917
Elements output:    25
Execution time:     2.66 seconds

Pretty useful on its own, but if you plan to create graphical reports using this data you can save yourself a bit of time and let Log Parser generate the chart for you, as long as you have Office or the Office Web Components installed on the computer running Log Parser.

"C:\Program Files (x86)\Log Parser 2.2\logparser.exe" "SELECT TO_LOCALTIME(TO_TIMESTAMP(EXTRACT_PREFIX(TO_STRING([#Fields: date-time]),0,'T'), 'yyyy-MM-dd')) AS Date, COUNT(*) AS [Daily Email Traffic] INTO DailyTraffic.gif from *.log where (event-id='RECEIVE') GROUP BY Date ORDER BY Date ASC" -i:CSV -nSkipLines:4 -chartType:Column3D

Related posts:

• Calculate Hourly Email Traffic using Message Tracking Logs and Log Parser
• Reporting Exchange Server 2010 Message Tracking Event IDs with Log Parser
• The Case of the Hub Transport Server Load Imbalance
• Generate SMTP Error Statistics using Log Parser and Exchange Server 2010 Protocol Logs
• Report Top Sender IP’s on Exchange Server 2010 using Log Parser

This article Calculate Daily Email Traffic using Message Tracking Logs and Log Parser is © 2012 ExchangeServerPro.com

Get more Exchange Server tips at ExchangeServerPro.com

From the Microsoft Exchange Team Blog:

Earlier today the Exchange CXP team released Update Rollup 7 for Exchange Server 2007 SP3 to the Download Center.

This update contains a number of customer-reported and internally found issues since the release of SP3 RU6. See KB2655203: Description of Update Rollup 7 for Exchange Server 2007 Service Pack 3 for more details.

Note: Some of the following KB articles may not be available at the time of publishing this post.

We would like to specifically call out the following fixes which are included in this release:

• KB2617514 Include updated version of Portuguese-Brazil speller.
• KB2696649 Exchange 2007sp3/2010 OWA CSRF via Cookie Tossing.
• KB2696628 Read Receipt is still duplicated when connecting IMAP.

Of particular note is this fix:

Note that this fix will resolve the CAS to CAS OWA proxying incompatibility with Exchange 2010 SP2 RU1 as discussed here.

Update Rollup 7 can be downloaded from Microsoft here.

Related posts:

• Microsoft Releases Update Rollup 5 for Exchange Server 2007 SP3
• Microsoft Releases Exchange 2007 SP3 Update Rollup 4
• Generate SMTP Error Statistics using Log Parser and Exchange Server 2010 Protocol Logs
• Calculate Hourly Email Traffic using Message Tracking Logs and Log Parser
• Dealing with Exchange Server Update Rollups and Forefront Protection for Exchange

This article Update Rollup 7 for Exchange 2007 Service Pack 3 is © 2012 ExchangeServerPro.com

Get more Exchange Server tips at ExchangeServerPro.com

In some cases these types of summary reports are faster and easier to extract using Log Parser instead of PowerShell. Let’s take a look at the Log Parser query to generate the same report as in the other article.

SELECT
   event-id AS Event,
   COUNT(*) As HITS
from *.log
GROUP BY Event
ORDER BY HITS DESC

This query will select the event-id field, a count of total log entries, grouped by event-id, and sort them in order of most to least hits.

The complete query, when executed from the directory containing the message tracking logs, is as follows:

"C:\Program Files (x86)\Log Parser 2.2\logparser.exe" "SELECT event-id AS Event, COUNT(*) As HITS from *.log GROUP BY Event ORDER BY HITS DESC" -i:CSV -nSkipLines:4 -rtp:-1

That query will produce a report similar to this:

Event       HITS
----------- -----
RECEIVE     58679
DELIVER     47496
NOTIFYMAPI  20812
SUBMIT      20806
SEND        19863
RESUBMIT    8679
HAREDIRECT  6826
TRANSFER    351
DSN         96
FAIL        95
SUBMITDEFER 6
BADMAIL     2

Statistics:
-----------
Elements processed: 183756
Elements output:    13
Execution time:     9.24 seconds

Aside from the speed benefits of Log Parser over Get-MessageTrackingLog you can also save time by generating graphical reports directly out of Log Parser if you have the Office Web Components also installed.

Column Chart from Log Parser

That query is as follows:

"C:\Program Files (x86)\Log Parser 2.2\logparser.exe" "SELECT event-id AS Event, COUNT(*) As HITS INTO Events.gif from *.log GROUP BY Event ORDER BY HITS DESC" -i:CSV -nSkipLines:4 -chartType:Column3D

This type of information would be useful to see on a regular basis, so you could simply schedule this Log Parser query to run at certain intervals and use an HTML page or an automatic email to view the results each time.

Related posts:

• Calculate Hourly Email Traffic using Message Tracking Logs and Log Parser
• Calculate Daily Email Traffic using Message Tracking Logs and Log Parser
• The Case of the Hub Transport Server Load Imbalance
• Generate SMTP Error Statistics using Log Parser and Exchange Server 2010 Protocol Logs
• Report Top Sender IP’s on Exchange Server 2010 using Log Parser

This article Reporting Exchange Server 2010 Message Tracking Event IDs with Log Parser is © 2012 ExchangeServerPro.com

Get more Exchange Server tips at ExchangeServerPro.com

Each message tracking log entry records an event ID from the following list:

• BADMAIL
• DELIVER
• DSN
• EXPAND
• FAIL
• POISONMESSAGE
• RECEIVE
• REDIRECT
• RESOLVE
• SEND
• SUBMIT
• TRANSFER

Each event means different things. Healthy messages may record multiple receive, send, transfer, submit or deliver events, depending on your environment. Unhealthy messages may record badmail or fail events.

While there is no hard and fast rules about what percentage of each event you should see, it is still useful to take a look at a summary of the different events IDs in case you notice something that may warrant further investigation.

You can generate this summary using PowerShell and the Get-MessageTrackingLog cmdlet.

[PS] C:\>Get-MessageTrackingLog -ResultSize Unlimited | Group-Object -Property:EventId | Sort-Object Count -Desc | Select Name,Count

Name        Count
----        -----
RECEIVE     58679
DELIVER     47496
NOTIFYMAPI  20812
SUBMIT      20806
SEND        19863
RESUBMIT     8679
HAREDIRECT   6826
TRANSFER      351
DSN            96
FAIL           95
SUBMITDEFER     6
BADMAIL         2

For more tips and examples on searching message tracking logs with PowerShell check out this article.

Incidentally you may find this type of summary report to be faster to generate using Log Parser instead. In my tests the PowerShell command took almost 5 minutes to complete, whereas Log Parser took only 9 seconds on the same server. Your mileage may vary. You can check out the Log Parser query here.

Related posts:

• Searching Exchange Server 2010 Message Tracking Logs with PowerShell
• Calculate Hourly Email Traffic using Message Tracking Logs and Log Parser
• Calculate Daily Email Traffic using Message Tracking Logs and Log Parser
• Reporting Exchange Server 2010 Message Tracking Event IDs with Log Parser
• Get-MailboxReport.ps1 – PowerShell Script to Generate Mailbox Reports

This article Reporting Exchange Server 2010 Message Tracking Event IDs with PowerShell is © 2012 ExchangeServerPro.com

Get more Exchange Server tips at ExchangeServerPro.com

Although the message tracking log explorer is fine for simple searches on a single server, it doesn’t work so well when you want to do wildcard searches, search multiple servers at once, or export data for further analysis.

Message tracking log explorer

For those operations PowerShell is the way to go, and frankly once you’ve seen how powerful PowerShell is for message tracking log searches you’ll probably never use the explorer tool again.

Getting Started with Searching Message Tracking Logs Using PowerShell

Message tracking log searches are performed in the Exchange Management Shell by running the Get-MessageTrackingLog cmdlet. You can run this cmdlet with no parameters on any Edge Transport, Hub Transport or Mailbox server and it will return all of the log entries on that server.

[PS] C:\>Get-MessageTrackingLog

EventId    Source      Sender                                 Recipients                               MessageSubject
-------    ------      ------                                 ----------                               --------------
RECEIVE    SMTP        Ivana.Ferrary@exchangeserverpro.net    {Ana.Williams@exchangeserverpro.net}     Luminary asep...
DELIVER    STOREDRIVER John.Tilleray@exchangeserverpro.net    {Lucy.Spratley@exchangeserverpro.net}    Egress concor...
RECEIVE    STOREDRIVER Ambrine.Berry@exchangeserverpro.net    {Lorraine.Oza@exchangeserverpro.net}     Brazen
DELIVER    STOREDRIVER Ivana.Ferrary@exchangeserverpro.net    {Ana.Williams@exchangeserverpro.net}     Luminary asep...
RECEIVE    SMTP        Donna.A'Bear@exchangeserverpro.net     {Marc.Itoje@exchangeserverpro.net}       Garble expedi...
RECEIVE    SMTP        Priya.Smith@exchangeserverpro.net      {Melanie.Thomas@exchangeserverpro.net}   Enthral boorish
DELIVER    STOREDRIVER Donna.A'Bear@exchangeserverpro.net     {Marc.Itoje@exchangeserverpro.net}       Garble expedi...
RECEIVE    SMTP        Jane.Martin@exchangeserverpro.net      {Charlotte.Bonsey@exchangeserverpro.net} Palate causti...
DELIVER    STOREDRIVER Ambrine.Berry@exchangeserverpro.net    {Lorraine.Oza@exchangeserverpro.net}     Brazen
RECEIVE    SMTP        Yvette.Willis@exchangeserverpro.net    {Jan.Marway@exchangeserverpro.net}       Malign edible
DELIVER    STOREDRIVER Priya.Smith@exchangeserverpro.net      {Melanie.Thomas@exchangeserverpro.net}   Enthral boorish
RECEIVE    STOREDRIVER Joy.Singh@exchangeserverpro.net        {Mary.Friel@exchangeserverpro.net}       Obfuscate
HAREDIRECT ROUTING     Joy.Singh@exchangeserverpro.net        {Mary.Friel@exchangeserverpro.net}       Obfuscate
....

You can also search a remote server using the -Server parameter. This is useful when you are running the search from your own admin workstation or a separate management server.

[PS] C:\>Get-MessageTrackingLog -Server HO-EX2010-MB2

The Get-MessageTrackingLog cmdlet also accepts input from the pipeline. This is a very convenient way to perform searches on multiple servers at once. For example to search all Hub Transport servers at once:

[PS] C:\>Get-TransportServer | Get-MessageTrackingLog

Sometimes you may wish to search the transport servers only within a particular site. Because I might need to work with that list in a few different commands I’ll usually collect those into a variable first, for example all Hub Transport servers in the “HeadOffice” site:

[PS] C:\>$hubs = Get-ExchangeServer | Where {$_.Site -like "*HeadOffice" -and $_.IsHubTransportServer -eq $true}

I can then pipe that array of servers into the Get-MessageTrackingLog cmdlet.

[PS] C:\>$hubs | Get-MessageTrackingLog

Remember Default Resultsize of 1000

Often you will be running message tracking log searches that return a lot of results. However, by default the cmdlet will return only 1000 results.

Because of this you should try to get in to the habit of using the -Resultsize parameter to return unlimited results when running Get-MessageTrackingLog.

[PS] C:\>Get-TransportServer | Get-MessageTrackingLog -Resultsize unlimited

Run Long Queries Once by Collecting Results in a Variable

When you’re performing investigative searches of your message tracking logs, particularly across multiple servers, those queries can take a long time to return the results. If you then found you needed to adjust the query, for example to be more specific, or to format the results in a different way, you have to wait a long time for the query to run a second time as well.

So a good tip is to always collect your query results into a variable, particularly very broad queries that take a long time to run, so that you can pick apart the collected data without having to re-run the query.

For example, if I want to investigate reports of email problems sending to Alan Reid, I can run one broad query across all Hub Transport servers and collect the results in a variable I will call $msgs.

[PS] C:\>$msgs = Get-TransportServer | Get-MessageTrackingLog -Recipients "Alan.Reid@exchangeserverpro.net" -resultsize unlimited

I’ve now got thousands of records that I can begin to filter and dissect in different ways without having to re-run my query.

[PS] C:\>$msgs.count
13297

For example I can find the top 10 senders to Alan Reid within seconds, instead of re-running the entire Get-MessageTrackingLog search again.

[PS] C:\>$msgs | Group-Object -Property Sender | Select-Object name,count | sort count -desc | select -first 10 | ft -auto

Name                                  Count
----                                  -----
Andrea.Sharma@exchangeserverpro.net     110
Richard.Bennett@exchangeserverpro.net   108
Judy.Mollo@exchangeserverpro.net        104
Ferzana.King@exchangeserverpro.net      102
Debra.Lowe@exchangeserverpro.net        100
Nicola.Noad@exchangeserverpro.net       100
Diane.Hall@exchangeserverpro.net         96
Caroline.Ball@exchangeserverpro.net      96
Chris.Majumdar@exchangeserverpro.net     96
Hugh.Sharma@exchangeserverpro.net        96

According to Measure-Command the above command took 1.3 seconds to complete, whereas the re-running the full log search again would take 47.4 seconds. By collecting the results into a variable the first time all of the subsequent analysis of that data is able to be performed much faster.

Each Single Message is Multiple Log Entries

You’ll notice as you begin looking at message tracking logs that each individual email message generates multiple log entries. This is because each message goes through multiple events in the process of getting from sender to recipient, that the number of events will vary depending on how the message needs to be routed throughout your organization, as well as whether it is successfully delivered or not.

So a single email message may record a series of events such as:

EventId  Source   Sender                            Recipients                        MessageSubject
-------  ------   ------                            ----------                        --------------
RECEIVE  SMTP     Famida.Ghtoray@exchangeserverp... {Alan.Reid@exchangeserverpro.net} Prolix apropos embellish
DEFER    STORE... Famida.Ghtoray@exchangeserverp... {Alan.Reid@exchangeserverpro.net} Prolix apropos embellish
DUPLI... STORE... Famida.Ghtoray@exchangeserverp... {Alan.Reid@exchangeserverpro.net} Prolix apropos embellish
RECEIVE  STORE... Famida.Ghtoray@exchangeserverp... {Alan.Reid@exchangeserverpro.net} Prolix apropos embellish
DELIVER  STORE... Famida.Ghtoray@exchangeserverp... {Alan.Reid@exchangeserverpro.net} Prolix apropos embellish
RESUBMIT DUMPSTER Famida.Ghtoray@exchangeserverp... {Alan.Reid@exchangeserverpro.net} Prolix apropos embellish
TRANSFER STORE... Famida.Ghtoray@exchangeserverp... {Alan.Reid@exchangeserverpro.net} Prolix apropos embellish
SEND     SMTP     Famida.Ghtoray@exchangeserverp... {Alan.Reid@exchangeserverpro.net} Prolix apropos embellish

Dealing with System.String[] in Exported Message Tracking Log Data

At some stage you will want to export some message tracking log data to CSV for further analysis in Excel. If you were to pipe the output above into the Export-CSV cmdlet you will notice that some of the fields, such as Recipients, will appear as System.String[] in the output file.

problem”]

The Export-CSV System.String problem

To resolve this issue you need to first pipe your Get-MessageTrackingLog results into Select-Object and select the Recipients and RecipientStatus fields like this:

... | Select-Object eventid,sender,timestamp,@{Name="Recipients";Expression={$_.recipients}},@{Name="RecipientStatus";Expression={$_.recipientstatus}},messagesubject | Export-CSV filename.csv

This will give you the correct exported data.

Correct Recipients and RecipientStatus output

Examples of Message Tracking Log Searches

In the next part of this article series I’ll cover some specific examples of message tracking log searches using PowerShell.

Related posts:

• Reporting Exchange Server 2010 Message Tracking Event IDs with PowerShell
• Calculate Hourly Email Traffic using Message Tracking Logs and Log Parser
• Calculate Daily Email Traffic using Message Tracking Logs and Log Parser
• Reporting Exchange Server 2010 Message Tracking Event IDs with Log Parser
• Get-MailboxReport.ps1 – PowerShell Script to Generate Mailbox Reports

This article Searching Exchange Server 2010 Message Tracking Logs with PowerShell is © 2012 ExchangeServerPro.com

Get more Exchange Server tips at ExchangeServerPro.com

If you’ve been using public folders in your Exchange organization and decided to get rid of them completely then you may run into this particular issue.

In this scenario I have gone ahead and prepared to remove the public folder database by:

• Removing all of the public folder content
• Ensured OAB distribution is set to web only
• Ensured all my clients are Outlook 2007 and above

When I attempt to remove the public folder database I receive this error.

The public folder database cannot be deleted

The public folder database ‘PF-BR-01′ cannot be deleted.

PF-BR-01

Failed

Error:

Public folder database “PF-BR-01″ is the default public folder database for the following mailbox database(s):

MB-BR-01

. Before deleting the public folder database, assign a new default public folder database to the mailbox database(s).

The solution seems logical. All I need to do is modify that mailbox database so it no longer uses the public folder database.

It is simple enough to change the public folder database configured for a mailbox database to some other public folder database, but in this situation I’m trying to get rid of public folders entirely. So instead I want to set the mailbox database to have no default public folder database.

Here is what happens if I try to use Set-MailboxDatabase to set the value to $null.

[PS] C:\>Set-MailboxDatabase MB-BR-01 -PublicFolderDatabase $null
Cannot validate argument on parameter 'PublicFolderDatabase'. The argument is null or empty. Supply an argument that is
 not null or empty and then try the command again.
    + CategoryInfo          : InvalidData: (:) [Set-MailboxDatabase], ParameterBindingValidationException
    + FullyQualifiedErrorId : ParameterArgumentValidationError,Set-MailboxDatabase

It doesn’t work. However all is not lost, there is another way, using ADSIEdit.msc.

Open ADSIEdit.msc and connect to the Configuration naming context.

Connect to the Configuration naming context with ADSIEdit

Navigate to the container that holds the Exchange databases. For Exchange 2010 you’ll find this in CN=Services -> CN=Microsoft Exchange -> CN=(your organization name) -> CN=Administrative Groups -> CN=Exchange Administrative Group (FYDIBOHF23SPDLT) -> CN=Databases.

Right-click the mailbox database you want to remove the default public folder database from and choose Properties.

Scroll down until you find the msExchHomePublicMDB attribute. Highlight it and then click Edit.

Click the Clear button so that the value changes to “not set”.

Click OK, and OK again to commit the change.

Depending on the size of your network you may need to wait for that change to replicate throughout your Active Directory.

When you try to remove the public folder database again you should find that it now removes without error.

Public folder database successfully removed

Related posts:

• Poll: Do You Still Use Public Folders in Your Exchange Environment?
• Exchange 2007/2010 Public Folder Store in an Inconsistent State
• PowerShell: Configuring Settings on Multiple Exchange Mailbox Databases
• Public Folders Not Replicating Between Exchange 2007 and 2010
• Error “Object is Read Only” During Exchange Server 2007 Public Folder Database Removal

This article How to Remove the Default Public Folder Database for an Exchange Mailbox Database is © 2012 ExchangeServerPro.com

Get more Exchange Server tips at ExchangeServerPro.com

Now it is pretty easy to get the sizes for Exchange mailboxes and to handle the formatting of the Exchange 2010 mailbox statistics so that they are easier to perform calculations on, but it gets a bit boring running those commands day after day.

Even worse, after running the commands to create a CSV report I still had to open that in Excel, remove the unwanted details, use Excel formulas to convert the values from bytes to megabytes, sort them into order, and so on. Again not difficult, just boring after doing it hundreds of times.

So I created a PowerShell script, Get-MailboxReport.ps1, to do all of the heavy lifting for me, and I’m sharing that script with you here.

Download the script file here: Get-MailboxReport.ps1 (downloaded 3586 times so far)

Let’s take a look at how the script works. Here if a video to demonstrate:

I’ve included help information within the script itself so you can use Get-Help to discover how to run the script.

[PS] C:\Scripts\demo>Get-Help .\Get-MailboxReport.ps1

NAME
    C:\Scripts\demo\Get-MailboxReport.ps1

SYNOPSIS
    Get-MailboxReport.ps1 - Mailbox report generation script.

SYNTAX
    C:\Scripts\demo\Get-MailboxReport.ps1 [-database ] []

    C:\Scripts\demo\Get-MailboxReport.ps1 [-file ] []

    C:\Scripts\demo\Get-MailboxReport.ps1 [-server ] []

    C:\Scripts\demo\Get-MailboxReport.ps1 [-mailbox ] []

    C:\Scripts\demo\Get-MailboxReport.ps1 [-all] []

DESCRIPTION
    Generates a report of useful information for
    the specified server, database, mailbox or list of mailboxes.
    Use only one parameter at a time depending on the scope of
    your mailbox report.

RELATED LINKS
    For more script details, a video demo, or to give feedback please go to:

http://exchangeserverpro.com/powershell-script-create-mailbox-size-report-exchange-server-2010

REMARKS
    To see the examples, type: "get-help C:\Scripts\demo\Get-MailboxReport.ps1 -examples".
    For more information, type: "get-help C:\Scripts\demo\Get-MailboxReport.ps1 -detailed".
    For technical information, type: "get-help C:\Scripts\demo\Get-MailboxReport.ps1 -full".

Depending on which parameter you use the output will vary.

• If you use the -mailbox parameter to query a single mailbox, then the output will appear in the console window. I don’t really see the need to output a single mailbox’s details to a CSV file.
• If you use any of the other parameters, -server, -database, -file, or -all, the output will be written to a CSV file in the same folder you’re running the script from.
• You can use the optional -filename parameter to specify your own output file name

Once you’ve generated the CSV report you can open it with Excel and begin to analyze the data.

Download the script file here: Get-MailboxReport.ps1 (downloaded 3586 times so far)

Change Log:

• 6/02/2012 – V1.0 – Initial version
• 27/02/2012 – V1.1 - Improved recipient scope settings, exception handling, and custom file name parameter.

Related posts:

• How to Move Exchange Mailboxes in a Text File using PowerShell
• Reporting Exchange Server 2010 Message Tracking Event IDs with PowerShell
• Searching Exchange Server 2010 Message Tracking Logs with PowerShell
• The User Hasn’t Logged on to Mailbox So There is No Data to Return
• Using Test-Mailflow with Exchange 2003 Servers

This article Get-MailboxReport.ps1 – PowerShell Script to Generate Mailbox Reports is © 2012 ExchangeServerPro.com

Get more Exchange Server tips at ExchangeServerPro.com

From the Microsoft Exchange Team blog:

This update contains a number of customer-reported and internally found issues since the release of RU5. See KB 2608656: Description of Update Rollup 6 for Exchange Server 2007 Service Pack 3′ for more details.

We would like to specifically call out the following fixes which are included in this release:

• DST Cadence Release for Dec 2011 – Exchange 2007
• 22656040 An Exchange Server 2007 Client Access server may respond slowly or stop responding when users try to synchronize the Exchange ActiveSync devices with their mailboxes
• 2498852 ”0×80041606″ error message when you perform a prefix search by using Outlook in online mode in an Exchange Server 2007 environment
• 22653334 The reseed process is unsuccessful on the SCR passive node when the circular logging feature is enabled in an Exchange Server 2007 environment
• 22617784 Journal reports are expired or lost when the Microsoft Exchange Transport service is restarted in an Exchange Server 2007 environment
• 2289607 The week numbers displayed in OWA do not match the week numbers displayed in Outlook for English users and French users in an Exchange Server 2007 environment

Update Rollup 6 can be downloaded here.

Related posts:

• Serious Risk of Database Corruption with Exchange 2007 SP3 Update Rollup 3
• Update Rollup 3 for Exchange 2010 SP1 and Exchange 2007 SP3
• Exchange Server 2007 SP2 Update Rollup 2 Released
• Exchange Server 2007 SP1 Update Rollup 8 Released
• Exchange Server 2007 Update Rollup 6 (Critical)

This article Update Rollup 6 for Exchange 2007 SP3 Released is © 2012 ExchangeServerPro.com

Get more Exchange Server tips at ExchangeServerPro.com