Search for EMails sent to list of users during the last 4 hours
I'm trying to generate a query to search a users mailbox for any new messages sent to them over the last 4 hours. the list would be need to have the sender and the subject for each message.
It would be nice to have in HTML format so it would be nice and pretty.
So far I have
June 9th, 2011 3:42pm
Not sure if using the Message Tracking logs or trying to make a direct connection to the users mailbox would be the best method for accomplishing the goal. but I'm leaning toward the tracking logs.
Free Windows Admin Tool Kit Click here and download it now
June 9th, 2011 3:50pm
Do you have more than one hub transport server?[string](0..33|%{[char][int](46+("686552495351636652556262185355647068516270555358646562655775 0645570").substring(($_*2),2))})-replace " "
June 9th, 2011 4:31pm
Hiya,
This script I've written might be useful. It should be fairly easy to change it to just do 4 hours.
SteveSteve Goodman
Check out my Blog for more Exchange info or find me on
Twitter
Free Windows Admin Tool Kit Click here and download it now
June 10th, 2011 9:12am
Yes we have 5 Hub servers.
June 14th, 2011 1:51pm
Hi Rancehood,
Have a look for these documents, hope can give you some help:
Advanced Exchange 2007 Transport Logs Troubleshooting using Log Parser - Part 1
http://blogs.technet.com/b/exchange/archive/2007/11/12/3404342.aspx
Advanced Exchange 2007 Transport Logs Troubleshooting using Log Parser - Part 2
http://blogs.technet.com/b/exchange/archive/2007/11/28/3404414.aspx
Process Tracking Log tool for Exchange Server 2007
http://blogs.technet.com/b/exchange/archive/2008/02/07/3404839.aspx
Thanks,
Evan
Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
Free Windows Admin Tool Kit Click here and download it now
June 16th, 2011 3:17am
I am still such a NOOB with powershell, I was able to run this but it pulled ALL of the mail for the mailbox, any idea on how to limit this to just the last four hours?
June 16th, 2011 4:59pm
Hi Rancehood,
I test in my lab (Exchange 2007 SP3 with only one Hub Server), I can use these commands to achieve the goal:
$EndDate=Get-Date
$StartDate=$EndDate.AddHours(-4)
get-messagetrackinglog -Start $StartDate -End $EndDate
–EventId DELIVER –ResultSize Unlimited | select-object sender, messagesubject | ConvertTo-HTML | out-file c:\reports\messagetracking.html
Note: you need to create a folder (reports) under the out-file path.
some related documents for you:
Get-MessageTrackingLog
http://technet.microsoft.com/en-us/library/aa997573(EXCHG.80).aspx
How to Easily Export Message Tracking Results in Exchange Server 2007
http://blogs.technet.com/b/exchange/archive/2008/12/01/3406581.aspx
Windows PowerShell Tip of the Week
http://technet.microsoft.com/en-us/library/ff730960.aspx
Windows PowerShell Tip of the Week
http://technet.microsoft.com/en-us/library/ff730936.aspx
Thanks,
Evan
Free Windows Admin Tool Kit Click here and download it now
July 7th, 2011 1:07am
Hi Rancehood,
Since now I didn’t have the environment (which have several Hub Servers), but maybe you can run this to have a try:
$HubServers=Get-ExchangeServer | Where {$_.ServerRole -like "*Hub*"}
foreach($HubTransport in $HubServers)
{
$EndDate=Get-Date
$StartDate=$EndDate.Addhours(-4)
$logs=Get-MessageTrackingLog -Server $HubTransport -Start $StartDate -End $EndDate -EventId DELIVER -ResultSize Unlimited
$FileName=$HubTransport.Name
$logs|select-object sender, messagesubject | ConvertTo-HTML | out-file c:\reports\$FileName.html
}
Thanks,
Evan
July 7th, 2011 3:48am