Maintaining a consistent message tracking configuration across all of your Exchange servers is important. Without it you’ll potentially miss out on important information during message tracking log searches.
Although message tracking is enabled by default on Exchange servers the default configuration that is applied is often not suitable. For example, the default log retention of 30 days is often too short for investigations, and the default maximum folder size of 1Gb is often too small for organizations with high volumes of email traffic.
I’ve published a PowerShell script, Get-MessageTrackingConfig.ps1, that will generate a CSV file showing the current message tracking configuration of your Exchange servers. The script currently supports Exchange Server 2013, with support for Exchange Server 2010 coming in the future.
A few important points to note about the CSV file that the script generates. On an Exchange 2013 server there are four types of message tracking logs generated:
- MSGTRK – tracking logs generated by the Transport service
- MSGTRKMA – tracking logs generated by moderated transport actions (ie, approvals and rejectsion)
- MSGTRKMD – tracking logs generated by the Mailbox Transport Delivery service
- MSGTRKMS – tracking logs generated by the Mailbox Transport Submission service
For more about those services you may like to read about Exchange 2013 mail flow.
Each of the logs files has the message tracking log retention max directory size settings applied individually. This means that if the max directory size is 1Gb (1000Mb), up to 3000Mb of log files will be stored in the directory. Why 3000 and not 4000? Microsoft says:
On Exchange 2013 Mailbox servers, the maximum size of the message tracking log directory is three times the specified value. Although the message tracking log files that are generated by the four different services have four different name prefixes, the amount and frequency of data written to the MSGTRKMA log files is negligible compared to the three other log file prefixes.
As such, the script assumes a 3x multiplier in the results that it outputs. In the example screenshot above the server MELEX1 has 38MB of Transport logs, 28Mb of Delivery logs, and 18Mb of Submission logs for a total of 84Mb of logs. This is well under the configured maximum directory size of 1000Mb, and the server can comfortably store the 30 days of logs if is configured to retain.
How to use this script in your Exchange Server 2013 environment:
- Run the script from a computer or server that has the Exchange Management Shell installed
- Review the CSV file to:
- Confirm that your message tracking log configuration is consistent across your servers
- Confirm that the max directory size is high enough to store the number of days of logs you want to retain
- Consider whether the server has sufficient storage to hold the estimated maximum amount of data that might be retained
This script is available for download from the TechNet Script Gallery and Github. Comments are welcome below. If you find a bug please consider raising it as an issue on Github.
This article PowerShell Script to Create Report of Exchange Server Message Tracking Log Configuration is © 2015 ExchangeServerPro.com
Get more Exchange Server tips at ExchangeServerPro.com
