В качестве параметров задается email адрес (отправителя или получателя) и время в минутах (за сколько минут выбрать лог до текущего момента).
|
param($mb,$minutes) $trsrv = Get-TransportServer if ($mb -and $minutes){ write-host -ForegroundColor red "Send:" $trsrv | %{Get-MessageTrackingLog -server $_.name -ResultSize unlimited -Start (Get-Date).AddMinutes(0 - $minutes) -End (Get-Date) -Sender $mb | select source,timestamp,sender,recipients,totalbytes,messagesubject} write-host -ForegroundColor red "Receive" $trsrv | %{$n = $_.name; $_name; Get-MessageTrackingLog -server $_.name -ResultSize unlimited -Start (Get-Date).AddMinutes(0 - $minutes) -End (Get-Date) -Recipients $mb | select source,timestamp,sender,recipients,totalbytes,messagesubject} |
|---|
Варианты работы:
- $log = .\script.ps1
This email address is being protected from spambots. You need JavaScript enabled to view it. 60
- .\script.ps1
This email address is being protected from spambots. You need JavaScript enabled to view it. 60 | ft - .\script.ps1
This email address is being protected from spambots. You need JavaScript enabled to view it. 60 | ?{$_.source -eq "STOREDRIVER"}
Максимальная глубина журнала 30 дней (по умолчанию)
Description of Message Tracking Log Fields
General descriptions of the fields that are used to classify each message tracking event are explained in the table below.
Note
Fields that are marked with an asterisk (*) are never blank.
Table: Fields Used to Classify Each Message Tracking Event
|
Field name
|
Description
|
|---|---|
| date-time* | The date and time of the message tracking event. The value is formatted as yyyy-mm-ddhh:mm:ss.fffZ, where yyyy = year, mm = month, dd = day, hh = hour, mm = minute, ss = second, fff = fractions of a second, and Z signifies Zulu, which is another way to denote UTC. |
| client-ip | The TCP/IP address of the messaging server or messaging client that submitted the message. |
| client-hostname | The name of the messaging server or messaging client that submitted the message. |
| server-ip | The TCP/IP address of the source or destination server running Microsoft Exchange Server. |
| server-hostname | The name of the destination server. |
| source-context | Extra information associated with the source field. |
| connector-id | The name of source or destination Send connector or Receive connector. |
| source* | The Exchange transport component responsible for the message tracking event. The possible values for this field are as follows:
|
| event-id* | The message event type. These events are described fully in the table earlier in this topic. The possible values are BADMAIL, DELIVER, DSN, EXPAND, FAIL, POISONMESSAGE, RECEIVE, REDIRECT, RESOLVE, SEND, SUBMIT, and TRANSFER. |
| internal-message-id* | A message identifier that is assigned by the Exchange Server 2007 server that is currently processing the message. A specific message's value of internal-message-id is different in the message tracking log of every Exchange Server 2007 server that is involved in the delivery of the message. |
| message-id | The value of the Message-Id: field found in the message's header fields. If the Message-Id: header field does not exist or is blank, an arbitrary value is assigned. This value is constant for the lifetime of the message. |
| recipient-address* | A message was submitted by a server running Exchange Server 2007 computer that has the Mailbox server role installed to an Exchange 2007 computer that has the Hub Transport server role or Edge Transport server role installed. |
| recipient-status | The e-mail addresses of the message's recipients. Multiple e-mail addresses are separated by the semicolon character (;). |
| total-bytes* | The number of recipients in the message. |
| recipient-count* | The number of recipients in the message. |
| related-recipient-address | This field is used with EXPAND, REDIRECT, and RESOLVE events to display other recipient e-mail addresses associated with the message. |
| reference | This field contains additional information for specific types of events:
|
| message-subject | The message's subject found in the Subject: header field. The tracking of message subjects is controlled by the MessageTrackingLogSubjectLoggingEnabled parameter in the Set-TransportServer cmdlet for Hub Transport servers and Edge Transport servers, or in the Set-MailboxServer cmdlet for Mailbox servers. By default, message subject tracking is enabled. Message subject logging can be disabled by setting the value of the MessageTrackingLogSubjectLoggingEnabled parameter to $false. |
| sender-address | The e-mail address specified in the Sender: header field, or the From: header field if Sender: is not present. |
| return-path* | The return e-mail address specified by MAIL FROM: in the message envelope. Although this field is never empty, it can have the null sender address value represented as <>. |
| message-info | This field contains the message origination date-time for DELIVER and SEND events. The origination date-time is the time that the message first enters the Exchange organization. The value is formatted as yyyy-mm-ddhh:mm:ss.fffZ, where yyyy = year, mm= month, dd = day, hh = hour, mm = minute, ss = second, fff = fractions of a second, and Z signifies Zulu, which is another way to denote UTC. |
You can use The Get-MessageTrackingLog cmdlet in the Exchange Management Shell or the Message Tracking tool in the Exchange Management Console to search for messages by using specific message criteria.