Sunday, September 21, 2008

WizBang Exchange 2007 Message Tracking Powershell Gui Version 1

Unlocking the secrets from the depths of the Message Tracking Logs is an ever recurring theme on this blog and in general an important area of Exchange Server Management. In this latest incarnation we boldly go where no Message Tracking application has gone before as well as the normal aggregation, graphing and exports bits and pieces. The new functionality this script introduces expands on post I was talking about a couple of weeks ago which is Using Exchange Web Services to Enhance Exchange Message Tracking. So what we end up is a GUI that does aggregation and filtering and then the ability to look at the content of a particular message by using EWS to find the message based on its message-ID and then being able to see the Subject,Body and then export attachments or the whole message as an EML file. As this is version one i haven't quite go around to making the message search do a Deleted Item Scan (Dumpster Dive) and there is also an issue with Sent Items where the Clients in using Outlook in Cache mode. This is because when you are using Outlook in Cached Mode Items saved to the Sent Items receive a different MessageID which is described in this KB. So this mean you cant find messasges that where sent if the client is using Outlook in Cache mode (if the mesage was sent internally you would be able to get if from the Inbox of the recipient).

This script produces a Multi-Tabbed Winform with different functionality provided by each tab

  1. Tab1 - Setup tab this allows you to specify the parameter for the search of the message tracking logs
  2. Tab2 - Graphs and Summarised tables this tab shows some Google chart's graphs of the Last 6 hours of Message Tracking activity. Graphs of the total Aggregates of Internal/External and Sent/Received Messages. Last hour top 5 Message Sent/Receivers and Organization Totals
  3. Tab3 - Email Summaries per Internal User for Internal Sent/Receive, External Sent/Received and the ability to show the section of the Message Tracking logs for those particular messages. Also Find these message from these filtered Tracking logs via EWS and the Tab5 message Find function. (expot to csv for filtering and aggregated logs)
  4. Tab4 - Raw Message Tracking view
  5. Tab5 - EWS Message Find tab This use EWS to find messages based on message ID invoked from Tab 3 (show message button). Allows export of attachments and message to eml.
To do the search of the Message Tracking logs the script using the get-messagetrackinglogs Exchange powershell cmdlet to return all the Logs entries and then filters based on Send and Receive Entries. To ensure that a log entry is not counted twice the recipients of a message are expanded and a Hastable is used to ensure that the combination of MessageID-Sender and Recipient isn't counted more then once. Being version one this process hasn't been well test so there are probably lots of bugs with this method but so far it seems to work okay.

The graphing functions are provided using Google charts online service and a winform picture control which is the method I've described in the past. The one issue with the method is that it does require that you have a direct Internet connection from the client (eg NAT etc). If your going out through proxies then generally you may see that the graphs don't draw properly this is because the Picture control cant deal with Internet proxies.

The aggregate functions are all done through using a combination of hashtable and custom powershell objects.

The EWS Find functionality is done using the EWS powershell library which i've been using a fair bit and changing and adding more bits and pieces too. The library will handle Autodiscover and allow for both delegate and impersonation access method. The Form allows for all of these combinations and also allows you to specify overrides for both authentication and the URL for the CAS server to use (you need to use the full url to the EWS if you going to use eg https://servername/ews/exchange.asmx).

To use EWS find message function you need a copy of the EWSUtil.dll in c:\temp you can download this from here. You also need rights on the mailboxes you are searching either via delegation or Impersonation.

I've put a download of the script here the code itself is a little large to post.


Anonymous said...

Excellent Work !
Is there a way we can optimize this quesry when you have like about 2 mil. messages per day ?

Get-MessageTrackingLog -Server $snServerNameDrop.SelectedItem.ToString() -ResultSize Unlimited -Start $dtQueryDT -End $dtQueryDTf

Glen said...

I agonized over this one a little bit the underlying problem is that message tracking logs are written to files. You could try using a filter –EventID “RECEIVE” but I don’t know if this will actually make it any quicker because your just getting the cmdlet to do the filtering instead of the script. I didn't really have the ability to test this when there are large log file but I’d be interested to know if this helps


Mike said...

This script is just what i was looking for! I needed it to view the header information for internally posted emails from PeopleSoft.
We use a Barracuda SPAM filter as an SMTP server, but the PeopleSoft guys inisist on using our CAS/HUB as the SMTP server.
Is there any way you can view the hearder information without exporting the message?
Could this functionality be added?

Glen said...

You cant pull the header information from the Logs but its would be possible to add a button that accessed the information from mail that was stored in peoples mailboxes. This sounds like it would be a pretty usefull addition i'll see if i can add this maybe next week.


Glen said...

Okay i've updated the download there should now be a box in the findmessage form that will show you the headers of Message in a seperate popup form


Anonymous said...

I've made some updates to this script, if anyone is interested -