[E2010] Message tracking - catch events RRS feed

  • Question

  • I need to get events like in Get-MessagetrackingLog (RECEIVED,DELIVERED, ...) but parsing log is not acceptable.

    How to do that?

    Monday, August 29, 2011 12:43 PM

All replies

  • There are no events as such that fire when message tracking logs are written that you can subscribe to but here are a few options i can think of

    1. Use a file watch on the Message Tracking logs directory and anytime you detect a change to then use the Get-MessagetrackingLog cmdlet to read the most recent entries
    2. Create your own logging service using a custom transport Agent have a look at http://msdn.microsoft.com/en-us/library/bb421488%28v=exchg.80%29.aspx for a sample this can be a little more useful if you need to for instance capture information that doesn't get captured in the message tracking logs.


    Tuesday, August 30, 2011 4:19 AM
  • Thanks for response.

    I thought of the option 1., but I'm afraid it'd work too slow. 

    Unfortunately the option 2. doesn't satisfy me need of having events such as DELIVER, DEFER, RECEIVE, FAIL, REDIRECT etc.

    Any other ideas?


    Tuesday, August 30, 2011 7:44 AM
  • 1. What are basing this on ? what are trying achieve logs are logs they aren't meant to be exactly real-time AFIAK the commits to disk aren't real time for the tracking logs or verbose protocol logs.

    2. The Tracking logs are written by a System level Transport Agent be it a very complex one that hooks all the necessary events so the events that cause all these are accessible using a Transport but again it depends what your trying to achieve and level of complexity and effort you want to go to.



    Wednesday, August 31, 2011 2:35 AM
  • I'm just looking a way to know  from where (SMTP, local Mailbox) it's coming, and where (Mailbox, SMTP), if there are any FAIL's, REDIRECT etc. This information is in message tracking log.

    I need this for own mail tracking system where every email is tracked.

    I don't need real real-time logs, delay is acceptable.

    The main problem is: parsing log or using cmdlet Get-MesageTrackingLog could take too much time (I mean when you do it for every mail).

    Wednesday, August 31, 2011 7:54 AM
  • What's the objective, and what's the acceptable response time window?
    [string](0..33|%{[char][int](46+("686552495351636652556262185355647068516270555358646562655775 0645570").substring(($_*2),2))})-replace " "
    Wednesday, August 31, 2011 2:11 PM
  • You can read the raw messagetracking logs and parse those.

      Also while it is not recommended, if you're an on-premise environment you can load the snapin direclty into a generic PS session and get-messagetrackinglog will run about twice as fast as it does running it through the remoting environment of the EMS.

    How are you populating these events into your custom message tracking application? 

    If you're searching the logs per message, then that's going take a long time. 

    I'd run get-messagetrackinglog periodically, retrieving all the events types you want in your custom tracking system for a given time frame at once, and then sort them by messageid after that.

    [string](0..33|%{[char][int](46+("686552495351636652556262185355647068516270555358646562655775 0645570").substring(($_*2),2))})-replace " "
    Wednesday, August 31, 2011 2:28 PM
  • Something like LogParser might be useful as well http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=24659 its more optimized at reading large text files quickly. Otherwise something that tails the file http://www.baremetalsoft.com/baretail/ is another method you just need to watchout that your process doesn't lock the file and restrict new entries being written this is why most of the time you would recommend Get-MessagetrackingLog as this is always going to be a safe method I've always found that using -Start and -End give acceptable performance for polling but generally the sites i use this on are smaller volumes.


    Thursday, September 1, 2011 4:44 AM
  • Thanks for responses.

    I didn't mention that I implement this in C#, but i think it doesn't change anything.

    My choice is PS session to local computer and Get-MessageTrackingLog. 

    I'm going to write a service which will run Get-MessageTrackingLog (-Start -End) periodically.

    Thursday, September 1, 2011 7:26 AM