When I am using "get-messagetrackinglog," I sometimes don't get a complete set of information. For example, I'll get everything that I want especially recipients and totalbytes, and then there are email messages that come back without recipents and totalbytes. Ok. I figured out a pattern. Emails with EventID "SUBMIT" are the emails missing TotalBytes and Recipients. Do I need to enable something so that I always get a complete set of data when I get the returned results? Thanks Ron

On Mon, 24 Jan 2011 23:47:27 +0000, TrojansBaby wrote: > > >When I am using "get-messagetrackinglog," I sometimes don't get a complete set of information. For example, I'll get everything that I want especially recipients and totalbytes, and then there are email messages that come back without recipents and totalbytes. Ok. I figured out a pattern. Emails with EventID "SUBMIT" are the emails missing TotalBytes and Recipients. > >Do I need to enable something so that I always get a complete set of data when I get the returned results? "SUBMIT" events come from the tracking logs that begin with MSGTRKM and are produced by the mailbox role. Those events don't contain the information you're looking for. The tracking logs that begin with MSGTRK are the ones that the HT role creates. These log files contain message sizes and recipient details. Messages that have a SUBMIT event are those that are sent from a mailbox. When both log file types are combined you shold nave a corresponding RECEIVE event and, if the message was sent to another mailbox on the same server, a DELIVER event. It the message is going to another server there'll be a SEND event on this HT server (and a RECEIVE and DELIVER event on the HT that finally delivers the message to the mailbox role). --- Rich Matheisen MCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

Rich, I'm getting the info from a server that has both the HUB and Mailbox roles. Below is the Powershell script. get-messagetrackinglog -Start "12/1/2010 3:00:00 AM" -End "1/25/2011 8:49:00 AM" -ResultSize:Unlimited | ft timestamp,sender,MessageSubject,totalbytes Is get-messagetrackinglog the correct cmdlet? Thanks Ron

I share your frustration with message gtracking, while much more limited Ex2003 message tracking was easy to use and gave you accurate results evertime.

get-messagetrackinglog is the correct cmdlet. Whether or not those are the correct parameters depends on what it is you need for it to tell you.[string](0..33|%{[char][int](46+("686552495351636652556262185355647068516270555358646562655775 0645570").substring(($_*2),2))})-replace " "

On Tue, 25 Jan 2011 19:45:08 +0000, TrojansBaby wrote: >I'm getting the info from a server that has both the HUB and Mailbox roles. Below is the Powershell script. > >get-messagetrackinglog -Start "12/1/2010 3:00:00 AM" -End "1/25/2011 8:49:00 AM" -ResultSize:Unlimited | ft timestamp,sender,MessageSubject,totalbytes > >Is get-messagetrackinglog the correct cmdlet? Yes, it is, but the way you're using it is a bit odd. You're not including the message-id, so how are you getting all the events for a single message together? Also, as I said, the "SUBMIT" event won't have the message size --- Rich Matheisen MCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

Yes. I'm a bit odd.... Is there a good extenal solution to handle this type of job? MS MOM? Thanks Ron

What exactly is the job? Get-messagetracking log can probably do it, given the right parameters.[string](0..33|%{[char][int](46+("686552495351636652556262185355647068516270555358646562655775 0645570").substring(($_*2),2))})-replace " "

Ok. I just reran with messageid, and I see what you mean. Thanks Ron