Summery report for SendSizeLimit
A customer wants a report where he can see which mail has been blocked because of reached Mail size limit (in- and outgoing).
Is this possible with the Exchange server (without extra tools)?
The customer does not specify which information the report should contain. He just said he want a protocol with declined (because of to large mail size) mails.
Thanks for hints.
Answers
Hi,
I would like to explain that we should be able to get information by analyzing Message tracking log regarding which message is blocked because of reached mail size limit.
For example (I captured on my lab “Exchange 2007”):
When a message reach the send mail size/receive mail size limit, it will be recorded in message tracking log like below:
#Fields: date-time,client-ip,client-hostname,server-ip,server-hostname,source-context,connector-id,source,event-id,internal-message-id,message-id,recipient-address,recipient-status,total-bytes,recipient-count,related-recipient-address,reference,message-subject,sender-address,return-path,message-info
2009-09-23T09:20:45.311Z,,DC,,,,,ROUTING,FAIL,7,<52B34CF3B57EEE449CDB46A54453450202BCDAE69C20@mb.lab.com>,Administrator@lab.com,'550 5.2.3 RESOLVER.RST.RecipSizeLimit; message too large for this recipient',333812,1,,<f5d0269f-62b2-4d30-b3a4-8e07cea57fd0>,,pwd@lab.com,pwd@lab.com,
2009-09-23T09:20:45.311Z,,DC,,,,,ROUTING,FAIL,7,<52B34CF3B57EEE449CDB46A54453450202BCDAE69C21@mb.lab.com>,Administrator@lab.com,'550 5.2.3 RESOLVER.RST.SendSizeLimit; message too large for this sender,333812,1,,<f5d0269f-62b2-4d30-b3a4-8e07cea57fd0>,,pwd@lab.com,pwd@lab.com,
To export the required information from the message tracking log, we can use LogParser tool.
For example, you can run command like below:
logparser "select date-time, message-id, sender-address, recipient-address, total-bytes from C:\Program Files\Microsoft\Exchange Server\TransportRoles\Logs\Messagetracking\MSGTRK*.log where recipient-status= '550 5.2.3 RESOLVER.RST.RecipSizeLimit; message too large for this recipient' or recipient-status='550 5.2.3 RESOLVER.RST.SendSizeLimit; message too large for this sender' order by date-time" -i:w3c -o:csv >report.csv
Note: I have not tested the command on my lab. Just for your reference.
Regarding logparser, you can refer to following articles:
Advanced Exchange 2007 Transport Logs Troubleshooting using Log Parser - Part 1
http://msexchangeteam.com/archive/2007/11/12/447515.aspx
More fun with Logparser and Exchange logs
http://msexchangeteam.com/archive/2007/09/12/446982.aspx
Mike Shen
TechNet Subscriber Support in forum
If you have any feedback on our support, please contact tngfb@microsoft.com
- Marked As Answer byMarkus Schuhmacher Wednesday, September 23, 2009 11:53 AM
- Hi Markus,
Sorry for delay in response.
After some local test on my lab, I suggest you refer to following method:
Note: I performed the test on Exchange 2007:
1. Create a header file by copying following texts to a txt file and save it as header.txt (I saved it on my desktop):
date-time,client-ip,client-hostname,server-ip,server-hostname,source-context,connector-id,source,event-id,internal-message-id,message-id,recipient-address,recipient-status,total-bytes,recipient-count,related-recipient-address,reference,message-subject,sender-address,return-path,message-info
2. Run following command (I have tested on my lab) to parse the message tracking log:
logparser "select date-time, message-id, sender-address, recipient-address, recipient-status, total-bytes from C:\Program Files\Microsoft\Exchange Server\TransportRoles\Logs\Messagetracking\MSGTRK*.log where recipient-status like '%message too large for%' order by date-time" -i:csv -nskiplines 5 -iheaderfile C:\Users\v-mishen\Desktop\header.txt -o:csv >C:\Users\v-mishen\Desktop\report.csv
Thanks,
Mike- Marked As Answer byMarkus Schuhmacher Thursday, October 08, 2009 9:33 AM
All Replies
Hi,
I would like to explain that we should be able to get information by analyzing Message tracking log regarding which message is blocked because of reached mail size limit.
For example (I captured on my lab “Exchange 2007”):
When a message reach the send mail size/receive mail size limit, it will be recorded in message tracking log like below:
#Fields: date-time,client-ip,client-hostname,server-ip,server-hostname,source-context,connector-id,source,event-id,internal-message-id,message-id,recipient-address,recipient-status,total-bytes,recipient-count,related-recipient-address,reference,message-subject,sender-address,return-path,message-info
2009-09-23T09:20:45.311Z,,DC,,,,,ROUTING,FAIL,7,<52B34CF3B57EEE449CDB46A54453450202BCDAE69C20@mb.lab.com>,Administrator@lab.com,'550 5.2.3 RESOLVER.RST.RecipSizeLimit; message too large for this recipient',333812,1,,<f5d0269f-62b2-4d30-b3a4-8e07cea57fd0>,,pwd@lab.com,pwd@lab.com,
2009-09-23T09:20:45.311Z,,DC,,,,,ROUTING,FAIL,7,<52B34CF3B57EEE449CDB46A54453450202BCDAE69C21@mb.lab.com>,Administrator@lab.com,'550 5.2.3 RESOLVER.RST.SendSizeLimit; message too large for this sender,333812,1,,<f5d0269f-62b2-4d30-b3a4-8e07cea57fd0>,,pwd@lab.com,pwd@lab.com,
To export the required information from the message tracking log, we can use LogParser tool.
For example, you can run command like below:
logparser "select date-time, message-id, sender-address, recipient-address, total-bytes from C:\Program Files\Microsoft\Exchange Server\TransportRoles\Logs\Messagetracking\MSGTRK*.log where recipient-status= '550 5.2.3 RESOLVER.RST.RecipSizeLimit; message too large for this recipient' or recipient-status='550 5.2.3 RESOLVER.RST.SendSizeLimit; message too large for this sender' order by date-time" -i:w3c -o:csv >report.csv
Note: I have not tested the command on my lab. Just for your reference.
Regarding logparser, you can refer to following articles:
Advanced Exchange 2007 Transport Logs Troubleshooting using Log Parser - Part 1
http://msexchangeteam.com/archive/2007/11/12/447515.aspx
More fun with Logparser and Exchange logs
http://msexchangeteam.com/archive/2007/09/12/446982.aspx
Mike Shen
TechNet Subscriber Support in forum
If you have any feedback on our support, please contact tngfb@microsoft.com
- Marked As Answer byMarkus Schuhmacher Wednesday, September 23, 2009 11:53 AM
- Thanks a lot! I will look at this as soon as possible.
For which time period can I look at the logs? - Hi,
I would like to when the message is delivered, the information will be recorded in Message Tracking log immediately. Therefore, if you would like to test the method, you could run the command immediately after sending test message which exceeding the recipient/send size limit.
Thanks,
Mike - OK, I took a closer look at the log parser. I corrected some grammar in the command line and I was wondering why there where no results (taking the windows search on the file content did found some entries).
I used following command now:
logparser "SELECT 'date-time', 'message-id', 'sender-address', 'recipient-address', 'total-bytes' FROM 'D:\Program Files\Microsoft\Exchange Server\TransportRoles\Logs\Messagetracking\MSGTRK*.log' WHERE 'recipient-status' LIKE '%' ORDER BY 'date-time'" -i:w3c -o:csv >report.csv"
I used LIKE '%' to look what is in the file but the content was allways the same. The report.csv has got:
'date-time','message-id','sender-address','recipient-address','total-bytes'
date-time,message-id,sender-address,recipient-address,total-bytes
date-time,message-id,sender-address,recipient-address,total-bytes
date-time,message-id,sender-address,recipient-address,total-bytes
date-time,message-id,sender-address,recipient-address,total-bytes
date-time,message-id,sender-address,recipient-address,total-bytes
date-time,message-id,sender-address,recipient-address,total-bytes
...and so on
What is goeing wrong? Maybe the "\MSGTRK*.log" is not working here correctly? I can not see any mistakes here.
Remark:
I am a little confused about the SQL syntax. Every example is like:
logparser "SELECT field1, field2, field3 WHERE ..."
What I don't understand why the log parser is throwing an error that there are no valid fields. So I corrected the date-time, xxx to 'date-time', 'xx' - Anyone further hints?
- Hi Markus,
Sorry for delay in response.
After some local test on my lab, I suggest you refer to following method:
Note: I performed the test on Exchange 2007:
1. Create a header file by copying following texts to a txt file and save it as header.txt (I saved it on my desktop):
date-time,client-ip,client-hostname,server-ip,server-hostname,source-context,connector-id,source,event-id,internal-message-id,message-id,recipient-address,recipient-status,total-bytes,recipient-count,related-recipient-address,reference,message-subject,sender-address,return-path,message-info
2. Run following command (I have tested on my lab) to parse the message tracking log:
logparser "select date-time, message-id, sender-address, recipient-address, recipient-status, total-bytes from C:\Program Files\Microsoft\Exchange Server\TransportRoles\Logs\Messagetracking\MSGTRK*.log where recipient-status like '%message too large for%' order by date-time" -i:csv -nskiplines 5 -iheaderfile C:\Users\v-mishen\Desktop\header.txt -o:csv >C:\Users\v-mishen\Desktop\report.csv
Thanks,
Mike- Marked As Answer byMarkus Schuhmacher Thursday, October 08, 2009 9:33 AM
- Hello Mike,
this looks great this time. Maybe using the header file did the trick.
Edit:
Maybe you can tell me how long I can look back in the Tracking Logs?
2nd edit:
I configured a test account with a limited receipt size.
I send a test mail from my office and as expected I got a message with the 5.2.3 information. The log parser works. I could see the message I tried to send. But the field 'total-bytes' has got the value 0. Is this normal?
