RE: Exchange 2010 message tracking tool alternative?

2010-12-09 Thread Wright, Seth - wrightst 
Argh.  Okay, so I was correct:  I do use *some form* of that command almost 
every day, but the command below won't actually work (haven't had my coffee yet 
this morning).  The "-Date" parameter should have been "-Start".  There is also 
a corresponding "-End" param, if you want to put upper and / or lower bounds on 
your query.

---
Seth

From: Wright, Seth - wrightst [mailto:wrigh...@jmu.edu]
Sent: Thursday, December 09, 2010 9:30 AM
To: MS-Exchange Admin Issues
Subject: RE: Exchange 2010 message tracking tool alternative?

More specifically, the Get-MessageTrackingLog cmdlet 
(http://technet.microsoft.com/en-us/library/aa997573.aspx) is what you're 
looking for.  Something like the following would do what you want for the last 
24 hours:

Get-MessageTrackingLog -Server  -Sender 
a...@internetdomain.com<mailto:a...@internetdomain.com> -Date 
(Get-Date).AddDays(-1)

That command has quite a few options to it-check out the TechNet article linked 
above.  I use some form of it almost every day.

Also useful is the Get-AgentLog cmdlet 
(http://technet.microsoft.com/en-us/library/aa996044.aspx) on an edge transport 
or a hub transport with the anti-spam agents installed:  "Use the Get-AgentLog 
cmdlet to parse log files that you specify as parameters and collect raw 
statistics from the filtering that anti-spam agents apply during a time period 
that you specify."

Note that you may want to up max file size / max directory size for message 
tracking logs if you notice that your data doesn't go back far enough.  Check 
out the {Get,Set}-TransportServer cmdlets and look for the MessageTrackingLog* 
properties:

[PS] >Get-TransportServer | fl Name,MessageTracking*

MessageTrackingLogEnabled   : True
MessageTrackingLogMaxAge: 30.00:00:00
MessageTrackingLogMaxDirectorySize  : 8 GB (8,589,934,592 bytes)
MessageTrackingLogMaxFileSize   : 250 MB (262,144,000 bytes)
MessageTrackingLogPath  : E:\Program Files\Microsoft\Exchange 
Server\V14\TransportRoles\Logs\MessageTracking
MessageTrackingLogSubjectLoggingEnabled : True

---
seth wright (wrigh...@jmu.edu<mailto:wrigh...@jmu.edu>)
lead exchange administrator
540.568.2912 (office)
james madison university

From: Michael B. Smith [mailto:mich...@smithcons.com]
Sent: Wednesday, December 08, 2010 5:42 PM
To: MS-Exchange Admin Issues
Subject: RE: Exchange 2010 message tracking tool alternative?

Drop to the command prompt (Exchange Management Shell).

You can do darn near anything.

Regards,

Michael B. Smith
Consultant and Exchange MVP
http://TheEssentialExchange.com

From: Nelson Siqueiros [mailto:nsiquei...@escalate.com]
Sent: Wednesday, December 08, 2010 5:31 PM
To: MS-Exchange Admin Issues
Subject: Exchange 2010 message tracking tool alternative?

We recently upgraded from Exchange 2003 to 2010.  Everything is fine but the 
message tracking tool is very limited compared to Exchange 2003.  For 
example... if we want to find any messages that came from 
a...@internetdomain.com<mailto:a...@internetdomain.com> to any internal users 
it's not possible since you have to select a single specific mailbox to search 
at and there is no option to change the server name.  I'm not sure why MS did 
this but do you guys know of any alternatives to the built in tracking tool?  
Any input would be appreciated.

Thanks

This email and the information included in this transmission are privileged and 
confidential and intended only for the recipient listed above. If you are not 
the intended recipient, please advise the sender immediately by reply e-mail 
and delete this message and any attachments without retaining a copy. If you 
are not the intended recipient, you are hereby notified that any disclosure, 
copying or distribution of this message, or the taking of any action based upon 
it, is strictly prohibited. Although this email and any attachments are 
believed to be free of any virus or other defects which might affect any 
computer or IT system into which they are received, neither Escalate Retail nor 
any of its affiliates shall be liable for any loss or damage arising in any way 
from the receipt or use thereof.

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com<mailto:listmana...@lyris.sunbeltsoftware.com>
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com<mailto:listmana...@lyris.sunbeltsoftware.com>
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com<mailto:listmana...@lyris.sunbeltsoftware.com>
with the body: unsubscribe exchangelist

-

RE: Exchange 2010 message tracking tool alternative?

2010-12-09 Thread Wright, Seth - wrightst 
More specifically, the Get-MessageTrackingLog cmdlet 
(http://technet.microsoft.com/en-us/library/aa997573.aspx) is what you're 
looking for.  Something like the following would do what you want for the last 
24 hours:

Get-MessageTrackingLog -Server  -Sender a...@internetdomain.com 
-Date (Get-Date).AddDays(-1)

That command has quite a few options to it-check out the TechNet article linked 
above.  I use some form of it almost every day.

Also useful is the Get-AgentLog cmdlet 
(http://technet.microsoft.com/en-us/library/aa996044.aspx) on an edge transport 
or a hub transport with the anti-spam agents installed:  "Use the Get-AgentLog 
cmdlet to parse log files that you specify as parameters and collect raw 
statistics from the filtering that anti-spam agents apply during a time period 
that you specify."

Note that you may want to up max file size / max directory size for message 
tracking logs if you notice that your data doesn't go back far enough.  Check 
out the {Get,Set}-TransportServer cmdlets and look for the MessageTrackingLog* 
properties:

[PS] >Get-TransportServer | fl Name,MessageTracking*

MessageTrackingLogEnabled   : True
MessageTrackingLogMaxAge: 30.00:00:00
MessageTrackingLogMaxDirectorySize  : 8 GB (8,589,934,592 bytes)
MessageTrackingLogMaxFileSize   : 250 MB (262,144,000 bytes)
MessageTrackingLogPath  : E:\Program Files\Microsoft\Exchange 
Server\V14\TransportRoles\Logs\MessageTracking
MessageTrackingLogSubjectLoggingEnabled : True

---
seth wright (wrigh...@jmu.edu)
lead exchange administrator
540.568.2912 (office)
james madison university

From: Michael B. Smith [mailto:mich...@smithcons.com]
Sent: Wednesday, December 08, 2010 5:42 PM
To: MS-Exchange Admin Issues
Subject: RE: Exchange 2010 message tracking tool alternative?

Drop to the command prompt (Exchange Management Shell).

You can do darn near anything.

Regards,

Michael B. Smith
Consultant and Exchange MVP
http://TheEssentialExchange.com

From: Nelson Siqueiros [mailto:nsiquei...@escalate.com]
Sent: Wednesday, December 08, 2010 5:31 PM
To: MS-Exchange Admin Issues
Subject: Exchange 2010 message tracking tool alternative?

We recently upgraded from Exchange 2003 to 2010.  Everything is fine but the 
message tracking tool is very limited compared to Exchange 2003.  For 
example... if we want to find any messages that came from 
a...@internetdomain.com<mailto:a...@internetdomain.com> to any internal users 
it's not possible since you have to select a single specific mailbox to search 
at and there is no option to change the server name.  I'm not sure why MS did 
this but do you guys know of any alternatives to the built in tracking tool?  
Any input would be appreciated.

Thanks

This email and the information included in this transmission are privileged and 
confidential and intended only for the recipient listed above. If you are not 
the intended recipient, please advise the sender immediately by reply e-mail 
and delete this message and any attachments without retaining a copy. If you 
are not the intended recipient, you are hereby notified that any disclosure, 
copying or distribution of this message, or the taking of any action based upon 
it, is strictly prohibited. Although this email and any attachments are 
believed to be free of any virus or other defects which might affect any 
computer or IT system into which they are received, neither Escalate Retail nor 
any of its affiliates shall be liable for any loss or damage arising in any way 
from the receipt or use thereof.

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com<mailto:listmana...@lyris.sunbeltsoftware.com>
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com<mailto:listmana...@lyris.sunbeltsoftware.com>
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

RE: Exchange 2010 message tracking tool alternative?

2010-12-08 Thread Michael B. Smith 
Drop to the command prompt (Exchange Management Shell).

You can do darn near anything.

Regards,

Michael B. Smith
Consultant and Exchange MVP
http://TheEssentialExchange.com

From: Nelson Siqueiros [mailto:nsiquei...@escalate.com]
Sent: Wednesday, December 08, 2010 5:31 PM
To: MS-Exchange Admin Issues
Subject: Exchange 2010 message tracking tool alternative?

We recently upgraded from Exchange 2003 to 2010.  Everything is fine but the 
message tracking tool is very limited compared to Exchange 2003.  For 
example... if we want to find any messages that came from 
a...@internetdomain.com to any internal users 
it's not possible since you have to select a single specific mailbox to search 
at and there is no option to change the server name.  I'm not sure why MS did 
this but do you guys know of any alternatives to the built in tracking tool?  
Any input would be appreciated.

Thanks

This email and the information included in this transmission are privileged and 
confidential and intended only for the recipient listed above. If you are not 
the intended recipient, please advise the sender immediately by reply e-mail 
and delete this message and any attachments without retaining a copy. If you 
are not the intended recipient, you are hereby notified that any disclosure, 
copying or distribution of this message, or the taking of any action based upon 
it, is strictly prohibited. Although this email and any attachments are 
believed to be free of any virus or other defects which might affect any 
computer or IT system into which they are received, neither Escalate Retail nor 
any of its affiliates shall be liable for any loss or damage arising in any way 
from the receipt or use thereof.

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist