Is there an Exchange Management shell command that will display the individual email message size of all emails sent during a particular period from an Exchange 2007 server?pajoryan123

Hi, You can use Get-MessageTrackingLog command Get-MessageTrackingLog -Start "03/13/2010 9:00AM" -End "03/15/2010 5:00PM" -Sender "senderr@domain.com" |FL *Subject,TotalByets Regards,Laeeq Qazi|Team Lead(Exchange + Sharepoint + BES + DynamicsCRM) www.HostingController.com

Something like this might be more appropriate to get all the emails from a given mailbox server: Get-MessageTrackingLog -Start "03/13/2010 9:00AM" -End "03/15/2010 5:00PM" -eventid "Receive" |? {$_.clienthostname -eq "<fqdn of mailbox server>"}| ft timestamp,sender,totalbytes

Something like this might be more appropriate to get all the emails from a given mailbox server: Get-MessageTrackingLog -Start "03/13/2010 9:00AM" -End "03/15/2010 5:00PM" -eventid "Receive" |? {$_.clienthostname -eq "<fqdn of mailbox server>"}| ft timestamp,sender,totalbytes does the above command just display total bytes of all email received? I need a break down of every single email and what size each one was? thanks,pajoryan123

Hi, TotalBytes will show size in bytes for an individual email. Regards,Laeeq Qazi|Team Lead(Exchange + Sharepoint + BES + DynamicsCRM) www.HostingController.com

That particular script will output the sender, timestamp, and totalbytes of each email sent from the specified mailbox server. You can add other details (recipients, subject, etc) that are available in the message tracking record if needed.

That particular script will output the sender, timestamp, and totalbytes of each email sent from the specified mailbox server. You can add other details (recipients, subject, etc) that are available in the message tracking record if needed. can i output the result to a txt file? pajoryan123

Yes, but it might be more useful as .csv Text: Get-MessageTrackingLog -Start "03/13/2010 9:00AM" -End "03/15/2010 5:00PM" -eventid "Receive" |? {$_.clienthostname -eq "<fqdn of mailbox server>"}| ft timestamp,sender,totalbytes | out-string | out-file c:\somedir\sent.txt CSV: Get-MessageTrackingLog -Start "03/13/2010 9:00AM" -End "03/15/2010 5:00PM" -eventid "Receive" |? {$_.clienthostname -eq "<fqdn of mailbox server>"}| select timestamp,sender,totalbytes | export-csv c:\somedir\sent.csv -notype

Get-MessageTrackingLog -Start "03/13/2010 9:00AM" -End "03/15/2010 5:00PM" -eventid "Receive" |? {$_.clienthostname -eq "<fqdn of mailbox server>"}| select timestamp,sender,totalbytes | export-csv c:\somedir\sent.csv -notype What is the difference in between events "Receive" and "Send"? I assumed "Receive" would display all emails received by the Exc server and "send" would display all emails sent from the server but this does not seem to be the case. thankspajoryan123

Hi, The EventID search field has many different choices, such as RECEIVE, which is used to search for messages received by the relevant server, or DELIVER, which is used to search for messages delivered to a mailbox. See the Exchange 2007 help file for a detailed breakdown of the remaining choices here Reference and Details: Exchange 2007 Message Tracking Log (Part 2) Regards,Laeeq Qazi|Team Lead(Exchange + Sharepoint + BES + DynamicsCRM) www.HostingController.com

"RECEIVE" and "SEND" events in a hub transport log are how those eventes are viewed from the context of that hub transport server. When a user sends an email in Exchange 2007, it originates from their mailbox server, which then submits it to the hub transport server for processing and delivery or relay. From the hub transports perspective, process starts with receiving the email from the mailbox server, and it considers that a RECEIVE event. An email being passes from one hub tranport server to another would be reflected as a SEND event on one and a RECEIVE event on the other, but it's that same email and the same transfer event.