Lesson 2: Managing Logging Chapter 10 525 tracking log les. You can use the EMS but not the EMC to change the maximum size of each message tracking log le on Edge Transport, Hub Transport, and Mailbox servers. To change the maximum size of each message tracking log le on Hub Transport and Edge Transport servers, you can use the MessageTrackingLogMaxFileSize parameter of the Set-TransportServer EMS cmdlet. For example, the following command changes maximum size of each message tracking log le on the Hub Transport server VAN-EX2 to 15 MB: Set-TransportServer –Identity VAN-EX2 -MessageTrackingLogMaxFileSize 15MB To change the maximum size of each message tracking log le on Mailbox servers, you can use the MessageTrackingLogMaxFileSize parameter of the Set-MailboxServer EMS cmdlet. For example, the following command changes the maximum size of each message tracking log le on the Mailbox server VAN-EX1 to 20 MB: Set-MailboxServer –Identity VAN-EX1 -MessageTrackingLogMaxFileSize 20MB Conguring the Maximum Size of the Message Tracking Log Directory By default, the maximum size of the message tracking log directory is 250 MB. Circular logging deletes the oldest message tracking log les when either a message tracking log le reaches its specied maximum age or the message tracking log directory reaches its specied maximum size. You can use the EMS but not the EMC to recongure the maximum size of the message tracking log directory on Edge Transport, Hub Transport, and Mailbox servers. For example, the following command changes the maximum size of the message tracking log directory to 300 MB on Hub Transport server VAN-EX2: Set-TransportServer –Identity VAN-EX2 -MessageTrackingLogMaxDirectorySize 300MB The following command changes the maximum size of the message tracking log directory to 400 MB on Mailbox server VAN-EX1: Set-MailboxServer –Identity VAN-EX1 -MessageTrackingLogMaxDirectorySize 400MB Quick Check n What command changes maximum size of each message tracking log le on the Hub Transport server VAN-HUB1 to 25 MB? Quick Check Answer n Set-TransportServer –Identity HUB-EX2 -MessageTrackingLogMaxFileSize 25MB Conguring the Maximum Age of Message Tracking Logs The maximum age for an individual message tracking log le is 30 days by default. Circular logging deletes the oldest message tracking log les if the message tracking log directory reaches its specied maximum size or a message tracking log le reaches its specied 526 Chapter 10 Logging and Reports maximum age. You can use the EMS but not the EMC to recongure the maximum age for message tracking log les on a Hub Transport, Edge Transport, or Mailbox server. For example, to change the maximum age of message tracking logs on the Hub Transport server VAN-EX2 to 25 days, you would enter the following command: Set-TransportServer –Identity VAN-EX2 -MessageTrackingLogMaxAge 25.00:00:00 To change the maximum age of message tracking logs on the Mailbox server VAN-EX1 to 40 days, you would enter the following command: Set-MailboxServer –Identity VAN-EX1 -MessageTrackingLogMaxAge 40.00:00:00 Conguring Message Subject Logging By default, the subject line of an SMTP email message is stored in the message tracking log. However, this setting can prove contentious. Some users might not want you to be able to see the subjects of their email messages, while others might ask you to nd a message that they can identify only by its subject. You may be required to disable message subject logging to comply with increased security or privacy requirements. This is a managerial decision, and you need to verify your organization’s policy about revealing subject-line information. You can enable or disable message subject logging on individual servers (but not on an individual user basis). However, organizational policy typically dictates that you use the same setting throughout an Exchange organization. You can use the EMS but not the EMC to enable or disable message subject logging in message tracking logs on Edge Transport, Hub Transport, and Mailbox servers. For example, to disable message subject logging in message tracking logs on the Hub Transport server VAN-EX2, you would enter the following command: Set-TransportServer –Identity VAN-EX2 -MessageTrackingLogSubjectLoggingEnabled $false To enable message subject logging in message tracking logs on the Mailbox server VAN-EX1 (assuming it had previously been enabled), you would enter the following command: Set-MailboxServer –Identity VAN-EX1 -MessageTrackingLogSubjectLoggingEnabled $true EXAM TIP It is important to know about message subject logging because it can be a contentious issue in a production organization. Viewing Message Activity and Tracking Messages The Tracking Log Explorer, part of the Troubleshooting Assistant, provides details of all message activity as messages are transferred to and from an Exchange server that has the Hub Transport server role, the Mailbox server role, or the Edge Transport server role installed. Exchange servers that have the Client Access server role or Unied Messaging server role installed (and none of the other three roles) do not have message tracking logs. Lesson 2: Managing Logging Chapter 10 527 You access the Tracking Log Explorer by opening the EMC, clicking Toolbox, and double-clicking Tracking Log Explorer. The Welcome screen is shown in Figure 10-34. By default, the RECEIVE EventID is enabled with a 10-minute interval specied, depending on when you opened the tool. You can specify parameters shown in the gure, such as Recipients, Sender, Server, and so on. If message subject logging is enabled, you can also specify Subject. FIGURE 10-34 The Welcome screen of the Tracking Log Explorer You can use the EMS to locate all messages with a RECEIVE EventID (there are likely to be a lot of them, so you would probably specify other parameters, such as Start, End, and Sender). The command to access the same messages as would be listed by the settings displayed in Figure 10-34 is as follows: Get-MessageTrackingLog –EventID RECEIVE –Start 3/18/2010 5:37:00 AM –End 3/18/2010 5:47:00 AM When you have specied all your search parameters on the Welcome screen, you click Next. An Executing Message Tracking Request screen appears, followed by a Message Tracking Results screen. If you want to repeat the request but change the search parameters, you can click Restart Current Task on the left pane, respecify your settings, and repeat the task. If the request highlights message tracking problems, you can select a symptom and obtain further information. When the Tracking Log Explorer successfully completes a tracking request, a result le is generated. You can view the results of previous tracking requests by clicking Select A Result File To View on the left pane. This aborts any tasks currently running (you receive a warning and click OK) and accesses the Select A Result File To View screen, shown in Figure 10-35. 528 Chapter 10 Logging and Reports FIGURE 10-35 The Select A Result File To View screen You can then double-click a report and either export it to a le for further analysis by reporting software or click View Results. The View Results screen lets you view List Reports, Tree Reports, or Other Reports. A Tree Report is illustrated in Figure 10-36. You can export the report, print it, or nd a text string in the report. FIGURE 10-36 A Tree Report Lesson 2: Managing Logging Chapter 10 529 MORE INFO GET-MESSAGETRACKINGLOG For more information about the Get-MessageTrackingLog cmdlet, see http://technet .microsoft.com/en-us/library/aa997573.aspx. Lesson Summary n Connectivity logs record connection activity of outgoing message delivery queues. Protocol logs record SMTP activity between messaging servers as part of messaging delivery. The Message Tracking log records message activity. Agent logs record activity by anti-spam and antivirus agents. Routing table logs record routing table data. Administrator Audit logs track the use of EMS cmdlets and parameters. Exchange store logs are central to the operation of Exchange databases. n Typically, you can congure the location of the various types of log les, the maximum size and maximum age of individual log les, and the maximum size of log le directories. n Log les in CSV format can be read by reporting software (typically based on Microsoft Ofce Excel or Microsoft SQL Server). You can open CSV les with a text editor such as Microsoft Notepad, but the result can be difcult to interpret. n The EMC provides a number of tools for viewing log les, such as the Tracking Log Explorer and the Routing Log Viewer. You can also use commands based on EMS cmdlets (for example, Get-MessageTrackingLog) to view the information in log les and generate reports. Lesson Review You can use the following questions to test your knowledge of the information in Lesson 2, “Managing Logging.” The questions are also available on the companion CD if you prefer to review them in electronic form. NOTE ANSWERS Answers to these questions and explanations of why each answer choice is correct or incorrect are located in the “Answers” section at the end of the book. 1. Written company policy requires that the facility to track messages by specifying message subject be disabled. You want to congure the relevant setting on the Edge Transport server DEN-EDGE01. What command do you enter? A. Set-TransportServer –Identity DEN-EDGE01- MessageTrackingLogSubjectLoggingEnabled $true B. Set-TransportServer –Identity DEN-EDGE01- MessageTrackingLogSubjectLoggingEnabled $false 530 Chapter 10 Logging and Reports C. Set-MailboxServer –Identity DEN-EDGE01- MessageTrackingLogSubjectLoggingEnabled $true D. Set-MailboxServer –Identity DEN-EDGE01- MessageTrackingLogSubjectLoggingEnabled $true 2. Which EMS command enables protocol logging for the intraorganization Send connector? A. Set-TransportServer –IntraOrgConnectorProtocolLoggingLevel Verbose B. Set-TransportServer –IntraOrgConnectorProtocolLoggingLevel None C. Set-MailboxServer –IntraOrgConnectorProtocolLoggingLevel Verbose D. Set-MailboxServer –IntraOrgConnectorProtocolLoggingLevel None 3. What type of log les record all activity by anti-spam and antivirus agents? A. Connectivity logs B. Protocol logs C. Message Tracking logs D. Agent logs 4. What command changes the maximum age of the connectivity log les on the Hub Transport server DEN-EX2 to 30 days? A. Set-MailboxServer DEN-EX2 –ConnectivityLogMaxAge 30.00:00:00 B. Set-MailboxServer DEN-EX2 –ConnectivityLogMaxAge 30 C. Set-TransportServer DEN-EX2 –ConnectivityLogMaxAge 30.00:00:00 D. Set-TransportServer DEN-EX2 –ConnectivityLogMaxAge 30 5. What EMS command sets the maximum size of the routing table log directory to 70 MB on the Edge Transport server DEN-EDGE01 A. Set-TransportServer –Server DEN-EDGE01 -RoutingTableLogMaxDirectorySize 70MB B. Set-TransportServer –Identity DEN-EDGE01 -RoutingTableLogMaxDirectorySize 70MB C. Set-TransportServer –Identity DEN-EDGE01 -RoutingTableLogMaxAge 14.00:00:00 D. Set-MailboxServer –Identity DEN-EDGE01 -RoutingTableLogMaxDirectorySize 70MB PR AC TI CE Using ExBPA to Generate a Health Report In this practice session, you will use ExBPA to run a best practices analyzer health scan. You will view the reports that the tool generates and export a report into a CSV le. Lesson 2: Managing Logging Chapter 10 531 EX ERC IS E Generating a Health Scan Report This exercise assumes that you have already opened ExBPA and have selected not to check for updates and not to join the Customer Experience Improvement Program. The tool will then open at the Welcome screen. If you have never opened the tool, congure these settings rst and then click Go To The Welcome Screen. If you have congured the tool differently and it starts to check for updates, cancel this action and go to the Welcome screen. 1. Log on to the Exchange Server 2010 server VAN-EX1 as Kim Akers. 2. Open the EMC and select Toolbox. 3. Click Best Practices Analyzer and then click Open Tool. 4. On the Welcome screen (shown previously in Figure 10-17), click Select Options For A New Scan. 5. In the Connect To Active Directory screen, shown in Figure 10-37, ensure that the Active Directory Server is VAN-DC1 and then click Connect To The Active Directory Server. FIGURE 10-37 Specifying an Active Directory server 6. On the Start A New Best Practices scan screen, specify VAN-EX1HealthScan as the identifying label, ensure that the VAN-EX1 server is the only server selected, select Health Scan, and ensure that the Performance Baseline [2 Hours] check box is not selected. Do not change the Select The Speed Of The Network To Judge The Estimated Time Value setting. Your screen should look similar to Figure 10-38. 532 Chapter 10 Logging and Reports FIGURE 10-38 Specifying an ExBPA health scan 7. Click Start Scanning. 8. When the scan completes, click View A Report Of This Best Practices Scan. 9. On the View Best Practices Report page, select List Reports and look in turn at the Critical Issues, All Issues, Non-Default Settings, Recent Changes, and Informational Items tabs. Note that depending on previous conguration (such as a decision to hide certain items), the Critical Issues tab might not be displayed. Figure 10-39 shows the Recent Changes tab. Your report might contain other items. 10. Click the All Issues tab. Select any issue and then click Tell Me More About This Setting. 11. Read the resulting Help screen and then close it. 12. Select Tree Reports and look in turn at the Detailed Review and Summary Review tabs. Figure 10-40 shows the Detailed Review tab. 13. Select Other Reports and view the Run-Time Log. 14. Return to the All Issues tab in List Reports. 15. Click Export Report. 16. Identify the path to saved les, for example, C:\Users\Kim Akers.ADATUM\AppData\ Roaming\Microsoft\ExBPA. Lesson 2: Managing Logging Chapter 10 533 FIGURE 10-39 The Recent Changes tab in the List Report in an ExBPA health scan FIGURE 10-40 Detailed Review tab in the Tree Report in an ExBPA health scan 534 Chapter 10 Logging and Reports 17. In the Export Report dialog box, click the report identied by ExBPA.VAN- EX1HealthScan and change the Save As Type to HTML, as shown in Figure 10-41. FIGURE 10-41 Specifying the report to export and the file type 18. Click Save. 19. Browse to the ExBPA folder you identied earlier. This contains les such as those shown in Figure 10-42. Identify the HTML le that starts with ExBPA.VAN- EX1HealthReport. Double-click this le to open it. FIGURE 10-42 Files in the ExBPA folder [...]... ew­ Retention-Policy to all mailboxes that currently have the policy Old-Retention-Policy applied to them: $OldPolicy={Get-RetentionPolicy "Old-Retention-Policy"}.distinguishedName | GetMailbox -Filter {RetentionPolicy -eq $OldPolicy} -Resultsize Unlimited | Set-Mailbox -RetentionPolicy "New-Retention-Policy" MORE INFO  GET-RETENTIONPOLICY AND GET-MAILBOX For more information about the Get-RetentionPolicy... Figure 1 0-4 6 shows the amended file FIGURE 1 0-4 6  Adding keys to the EdgeTransport.exe.config file 6 Open the Services Console on VAN-EX1 7 Locate the Microsoft Exchange Transport service Right-click this service, as shown in Figure 1 0-4 7, and click Restart FIGURE 1 0-4 7 Restarting the Microsoft Exchange Transport service 8 When the service restarts,... 20MB 4 Enter the following command: Set-TransportServer –Identity VAN-EX1 -SendProtocolLogMaxAge 35.00:00:00 Lesson 2: Managing Logging Chapter 10 535 5 Enter the following command: Set-TransportServer –Identity VAN-EX1 -SendProtocolLogMaxDirectorySize 350MB Figure 1 0-4 4 shows these commands FIGURE 1 0-4 4  Configuring protocol logs for a Send connector E XERCISE 2  Configuring Receive Connector Protocol... days: New-RetentionPolicyTag "Tag-PersonalArchive" -Type Personal -Comment "Tagged messages are moved to the archive after 365 days." -RetentionEnabled $true -AgeLimitForRetention 365 -RetentionAction MoveToArchive The following command amends the RPT Tag-EXAMPLE-DeletedItems so that items in the Deleted Items folder are permanently deleted after 30 days: Set-RetentionPolicyTag "Tag-EXAMPLE-DeletedItems"... -ReceiveProtocolLogMaxFileSize 10MB 4 Enter the following command: Set-TransportServer –Identity VAN-EX1 -ReceiveProtocolLogMaxAge 25.00:00:00 5 Enter the following command: Set-TransportServer –Identity VAN-EX1 -ReceiveProtocolLogMaxDirectorySize 200MB Figure 1 0-4 5 shows these commands FIGURE 1 0-4 5  Configuring protocol logs for a Receive connector E XERCISE 3  Configuring Agent Logging In this exercise, you will... named Corporate-Inbox with the comment “Messages are removed from the Inbox folder after 120 days.”: New-ManagedFolder -Name "Corporate-Inbox" -DefaultFolderType Inbox -Comment "Messages are removed from the Inbox folder after 120 days" -MustDisplayComment $true Figure 1 1 -7 shows the output from this command FIGURE 1 1 -7   Creating a managed default folder using the EMS EXAM TIP The New-ManagedFolder... syntax: New-RetentionPolicy -Name [-Confirm []] [-DomainController ] [-Organization ] [-RetentionPolicyTagLinks ] [-WhatIf []] For example, the following command creates a retention policy called Accounting that uses the RPT Tag-EXAMPLE-DeletedItems: New-RetentionPolicy –Name "Accounting" -RetentionPolicyTagLinks... Items folder after 180 days: New-RetentionPolicyTag "Tag-EXAMPLE-Default" -Type All -Comment "Items without a retention tag are deleted after 180 days." -RetentionEnabled $true -AgeLimitForRetention 180 -RetentionAction MoveToDeletedItems Figure 1 1-2 shows some of the output from this command FIGURE 1 1-2   Creating a DPT The following command creates a personal tag named Tag-PersonalArchive Items to which... permanently deleted in 45 days: New-RetentionPolicyTag "Tag-EXAMPLE-DeletedItems" -Type "DeletedItems" -Comment "Deleted Items purged in 45 days" -RetentionEnabled $true -AgeLimitForRetention 45 -RetentionAction PermanentlyDelete Figure 1 1-1 shows some of the output from this command FIGURE 1 1-1   Creating an RPT NOTE  THE MESSAGECLASS PARAMETER AND THE ISPRIMARY PARAMETER The New-RetentionPolicyTag cmdlet... action Move to ­ eleted Items: D New-ManagedContentSettings -FolderName Calendar -MessageClass CalendarItems -Name MyCalendarContentSettings -RetentionEnabled $true -RetentionAction MoveToDeletedItems -AgeLimitForRetention 30 MORE INFO  NEW-MANAGEDCONTENTSETTINGS For more information about the New-ManagedContentSettings cmdlet, see http://technet microsoft. com/en-us/library/bb124565.aspx As with creating . Set-TransportServer Server DEN-EDGE01 -RoutingTableLogMaxDirectorySize 70 MB B. Set-TransportServer –Identity DEN-EDGE01 -RoutingTableLogMaxDirectorySize 70 MB C. Set-TransportServer –Identity DEN-EDGE01. Transport server DEN-EX2 to 30 days? A. Set-MailboxServer DEN-EX2 –ConnectivityLogMaxAge 30.00:00:00 B. Set-MailboxServer DEN-EX2 –ConnectivityLogMaxAge 30 C. Set-TransportServer DEN-EX2 –ConnectivityLogMaxAge. Transport server DEN-EDGE01. What command do you enter? A. Set-TransportServer –Identity DEN-EDGE0 1- MessageTrackingLogSubjectLoggingEnabled $true B. Set-TransportServer –Identity DEN-EDGE0 1- MessageTrackingLogSubjectLoggingEnabled