Powershell – Searching MessageTrackingLog using Email Subject


Hi All,

As a Microsoft Exchange Administrator, I often get requests to find information regarding emails that have been sent, received or stuck. Basically I need to find out what is happening with the mail flow within the Exchange environment.

So today, we will be making use MessageTrackingLog to get that information for us using Exchange Management Shell.

Microsoft provides the Message Tracking tools to be able to do this from the Exchange Management Console in Exchange 2010 as well, but I am more comfortable using the Shell.

Let’s assume that you have got an request from a client stating that you need to provide information regarding the emails sent between a time period with a specific subject line.

In our case, let us say that the Subject line of the Email is “Important information needed” and the time period is 16th June 10:00 AM to 2:30 PM.

Get-TransportServer | Get-MessageTrackingLog -ResultSize Unlimited -Start 16/06/2015 10:00:00 -End 16/06/2015 14:30:00 -MessageSubject "Important information needed" | select TimeStamp, MessageSubject, Sender, @{Name='Recipients`;Expression={[string]::join(";", ($_.recipients))}}

Let us see what we are doing here. At first, we are using the cmdlet Get-TransportServer, you will using this if you are not using the Exchange Management on the Hub Transport Server as you all the mail flow happens with the help of the Hub Transport Server. If you are running this command from the Hub Transport, then you don’t need to add this cmdlet.

Next we are using Get-MessageTrackingLog which is actual meat of this article. This cmdlet takes parameters like Start, End, MessageSubject and a lot more, which you can find in the above link.

After this, we wre selecting the information that we want to output using the select cmdlet like TimeStamp, Sender email address, recipient email address.

Notice the section where we use the below.

@{Name='Recipients`;Expression={[string]::join(";", ($_.recipients))}}

The reason we use this is because at times you will have multiple recipient emails separated by a semi-colon, this will help us present the output in a neat manner.

I have wrote a very handy which you can use in your environment by just providing the Start Date, End Date, Email Subject, and the path where you want to store the csv file as an output.

$StartDate = Read-Host "Kindly provide the Start date in the 24 hour format MM/DD/YYYY HH:MM:SS"
$EndDate = Read-Host "Kindly provide the End date in the 24 hour format MM/DD/YYYY HH:MM:SS"
$MessageSubject = Read-Host "Kindly provide the subject line of the Email"
$SaveAs = Read-Host "Provide the path that you to the save the file to along with the File Name"

Get-TransportServer | Get-MessageTrackingLog -ResultSize Unlimited -Start $StartDate -End $EndDate -MessageSubject $MessageSubject | select TimeStamp, MessageSubject, Sender, @{Name='Recipients`;Expression={[string]::join(";", ($_.recipients))}} | Export-Csv "$SaveAs"-NoType

That’s all I have for today, happy scripting!

I hope you find this informative and thank you for reading!


About Author

I am Adil Arif, working as a Technical Support Engineer at VMware as well as an independent blogger and founder of Enterprise Daddy. In my current role, I am supporting infrastructure related to Windows and VMware datacenters.


Leave A Reply

If so, please join the community.  I’d love to send you exclusive content right to your email, and I’ll send you a free copy of my book, VMware vSphere 6.0 Lab on Workstation too!
Enter your name and email below, and I’ll see you on the inside!