Exchange 2010 - Getting report on local internal email RRS feed

  • General discussion

  • Hi,

    I am trying t get one particular stat out of my Exchange 2010 server using Powershell and could use some help.  I simply want the total number of emails sent internally within my single exchange server. 

    Below is the Powershell command I have tried.

    get-messagetrackinglog -ResultSize unlimited -Start “05/14/2013 00:00:00″ -End “06/10/2013 23:59:00″ | where {$_.Sender -like “*@domain.com“} | where {$_.Recipients -like “*@domain.com“} > “C:\internalmail.txt

    The internalmail.txt file is empty.  I have made a couple attempts to get this information from the messagetrackinglog, but haven't gotten any results.  I was able to get the total number of RECEIVED and SENT emails from and to external addresses, but nothing internal.

    Does the messagetrackinglog keep a record of internal emails within the Exchange server?

    Thanks for any help you can give.


    Monday, June 10, 2013 7:34 PM

All replies

  • Exchange 2010 message tracking keeps a record of all emails that pass through the Hub Transport server.  Internal or external.

    What happens if you run the cmdlet without the >"c:\internalmail.txt"      Do you see any output to the screen?

    Jim McBee - MVP, MCT, MCSE Using Exchange since the v4.0 beta in 1995 - Blog http://mostlyexchange.blogspot.com

    Tuesday, June 11, 2013 12:31 AM
  • Hi Jim,  Thanks for the reply.  Actually the results without piping it to a file are the same.  It runs, but after a few minutes returns with no results.  It is as if in only sees external sending and receiving emails, but not internal.  That's why I'm a little confused.  I've run several other scripts against the messagetrackinglog and the only email addresses I see are non-internal addresses.  I know I'm missing something here.  If you have a suggestion of another script I could run to look at the entire contents (say or a single day or so) of the messagetrackinglog that would be helpful. 

    Thanks Jim!!

    Terry Brewer

    Tuesday, June 11, 2013 1:58 PM
  • Your command should work, but there's no need for a double 'where{}' and using ">file.txt" makes a not so useful file:

    get-messagetrackinglog -ResultSize unlimited -Start “06/10/2013 00:00:00" -End “06/10/2013 00:59:00" | where {$_.Sender -like “*@rotterdam.nl“ -AND $_.Recipients -like “*@rotterdam.nl“} > “C:\internalmail.txt"

    Also, you did not specify a server, so you will have to run this command on a transportserver and it will only return results from that perticular server.

    Try the following:

    get-transportserver| get-messagetrackinglog -ResultSize unlimited -Start $(get-date).addhours(-1) -End $(get-date) | where {$_.Sender -like "*@org.nl" -AND $_.Recipients -like "*@org.nl"} | select EventId,Source,Sender,@{name="Recipient";expression={[system.String]::Join(";",$_.Recipients)}},MessageSubject| export-csv -noTypeInformation  "C:\internalmail.txt"

    you should be able to run it from any of you servers and it should get you the logs from all transport servers over the last hour. I've used $(get-date) here to see if it is an issue with your date format (it uses locale settings, an "issue" that has been fixed in Exch 2010).





    This parameter returns message tracking log entries up to, but not including, the specified End date and time byusing the regional format of the computer on which the cmdlet is run.

    (you can expect an error on edge server query ... ignore these)

    • Edited by Milan Gajic Thursday, June 13, 2013 7:24 AM
    Thursday, June 13, 2013 7:22 AM
  • To get total number of emails sent internally within your single exchange server:

    # last hour
    (get-messagetrackinglog -ResultSize unlimited -Start $(get-date).addhours(-1) -End $(get-date) | where {$_.Sender -like "*@domain.com" -AND $_.EventID -eq "DELIVER"}).count
    # last day
    (get-messagetrackinglog -ResultSize unlimited -Start $(get-date).adddays(-1) -End $(get-date) | where {$_.Sender -like "*@domain.com" -AND $_.EventID -eq "DELIVER"}).count

    • Edited by Milan Gajic Thursday, June 13, 2013 11:28 AM
    Thursday, June 13, 2013 11:27 AM
  • I'm having the same issue.  When I run the command above it only returns emails sent by the system mailbox.  I've tried several different scripts from technet and nothing is returning internal email.
    Thursday, January 9, 2014 12:50 AM
  • I don't think Message Tracking returns internal email.

    If I search for ALL email from/to an internal user in Exchange 2010 Message Tracking it doesn't display any internal emails.

    If I search for email from an internal sender to an internal recipient nothing is found even though I know email was sent/received.

    I prefer Exchange 2003 Track and Trace to Exchange 2010 Message Tracking as the older system displayed ALL email and was far easier to use.

    Wednesday, January 15, 2014 1:36 PM
  • What command are you using? "get-transportserver| get-messagetrackinglog ... " ?

    I would expect no internal messages if I was looking at the MTL on a EDGE server. Are you absolutely sure you are getting the logs from your (internal) HUB transport servers?

    Wednesday, January 15, 2014 1:58 PM
  • What happens if you remove the filter "where {$_.Sender -like “*@domain.com“} | where {$_.Recipients -like “*@domain.com“} "?

    Wednesday, January 15, 2014 2:56 PM