6.13 Tracking messages | Monitoring and Managing Microsoft Exchange Server 2003 (HP Technologies)

< Day Day Up >

The Message Tracking Center is used to track the flow of system messages, interpersonal e-mail messages, and public folder messages, as well as status of messages in the Exchange organization. It can be used as a troubleshooting tool and also as a tool to gather data for statistical reporting. The Message Tracking Center also can track messages being sent to or received from other e-mail systems, such as X.400 mail systems or Lotus Notes. Although the Message Tracking Center cannot track messages before they enter the Exchange environment or after they leave the Exchange environment, it can at least confirm that a 'lost' message successfully traveled through the Exchange environment.

6.13.1 Enabling message tracking

Although the Message Tracking Center is always available, message tracking (i.e., collecting the data used by the Message Tracking Center) is turned off by default. Message tracking is set on each server. All messages that are routed through a server are added to the tracking logs if message tracking has been enabled for the server.

You can use the following procedure to enable message tracking for a server.

Start ESM from the Windows Start menu by selecting All Programs →Microsoft Exchange →System Manager.
Expand the Administrative Groups section.
Expand the administrative group (e.g., First Administrative Group) that contains your server.
Expand the Servers section.
Right-click on your server and select Properties.
General tab Select the General tab (Figure 6.39).

Figure 6.39: Enabling message tracking
Select the Enable message tracking check box to enable message tracking for the server. Exchange will log the sender, the time the message was sent or received, the message size, the message priority, and message recipients for each message that travels through this server.
Because the subject line often can contain sensitive information, the subject line is not logged by default. If you want to record the subject of messages, select the Enable subject logging and display check box. Tracking log files can be read by anyone with access to the file share. Therefore, if you choose to record subject lines, you should carefully control access to the log files to prevent curious people from reading the subject lines.
The logs used by the Message Tracking Center are stored in the \ Exchsrvr\ servername.log folder, where servername is the name of the Exchange server. A new log file is created each day for each server. Each daily log file includes the date in its name using the format yyyymmdd.log. The logs can consume considerable disk space if you allow them to accumulate on the server, therefore you should regularly remove old log files. To have Exchange automatically remove old log files, select the Remove log files check box and enter the number of days that log files should be kept before being removed.

6.13.2 Using the Message Tracking Center to view log files

Once you enable message tracking for a server, Exchange will record an entry for each message that is handled by the Exchange server. This can be a large number of messages. The Message Tracking Center makes it easier to find a specific message hidden among the thousands of messages recorded in one of the many log files.

You can use the following procedure to search the message tracking log files.

Start ESM from the Windows Start menu by selecting All Programs →Microsoft Exchange →System Manager.
Expand the Tools section.
Select Message Tracking Center (Figure 6.40).

Figure 6.40: Message Tracking Center
Select Server to enter the Exchange server that the message was sent from. If you do not know the sender's server, you can specify one of the servers that the message may have been routed through. This will give you a partial history of the message covering the time it arrived at the specified server until it was delivered to the recipient or until it was routed outside of the Exchange organization.
Messages can be searched using any combination of sender ID, recipient ID, date and time period, or message ID:
- To search for a message sent by a specific user, select Sender to enter the sender's e-mail address.
- To search for a message sent to a specific user, select Recipients to enter the recipient's e-mail address.
- To search for messages that traveled through the server during a specific time period, enter the time period into the Logged Between date and time fields.
- To search for a specific message using its message ID, enter the complete message ID in the Message ID field.
Select Find Now to begin the search. The Message Tracking Center will display the set of messages matching the search criteria in the lower half of the pane.
Double-click any of the listed messages to view the routing history of the message.

6.13.3 Using a text editor to view log files

In addition to using the Message Tracking Center to view the logs, you can manually search using a text editor, such as Notepad. The message tracking logs are stored in the \Exchsrvr\ servername.log folder, where servername is the name of the Exchange server. A new log file is created each day for each server. Each daily log file includes the date in its name using the format yyyymmdd.log.

< Day Day Up >