I recently came across an email routing issue in our environment where i had to track logs . I see that MessageTrackingLogMaxFileSize had a parameter set to 10 MB after which  a new log file is written. I need to connect back an old log file and perform search query against same from exchange management shell . Could someone please suggest me a way out to achieve this. Please suggest ?

As far as I know, it should do that automatically.

Correct Ed , new log file is created on its own....however I am not able to perform search query against log files that already reached its MessageTrackingLogMaxFileSize of 10 MB available on MessageTrackingLogPath . I am able to perform query against current log file until its 10 MB .Ideas was to really connect back these old dated files.  Please suggest.

No, I meant that I believe that message tracking should look across all the files.  Please explain in complete and excruciating detail exactly what you're doing and what you see.

Hi Ed,

Here is what is happening , as per the configurations 'MessageTrackingLogMaxAge' has certain number of days defined so are other parameters after which log files are saved to 'MessageTrackingLogPath' . So the issue  that i am facing is when i perform MessageTracking , the maximum i can lookup is up-to Maxage defined for these logs after which log files are archived  . Although I am able to see all other archived log files on 'MessageTrackingLogPath'   but really got no way to perform search query on those logs via EMS . Please suggest

 

Hi Aditya,

What do you mean by "archived log files on 'MessageTrackingLogPath' ", is it something like this Exchange message tracking log archiving.

By default, the maximum age for any message tracking log file is 30 days. Circular logging deletes the oldest message tracking log files if either of the following conditions is true:

• The message tracking log directory reaches its specified maximum size.
• A message tracking log file reaches its specified maximum age.

So, if you see some logs that is still there that would mean there is some issue with the cleanup process, but Exchange is still respecting the limit and hence unsearchable.

Incase you have a backup or true archive, then you might be intersted in the below blog.

Reviewing Message Tracking Logs from other Servers and/or Restored Backups:

http://blogs.technet.com/b/stuartp/archive/2008/09/30/reviewing-message-tracking-logs-from-other-servers-and-or-backups.aspx