During the time of troubleshooting in mail delay and issues when users reporting emails being not received its little bit tougher part to isolate and identify the problem.
Message tracking and protocol logs analysis is one of the best way to identify whether the problem exists in exchange end or else to prove that exchange has successfully done its mail transaction on its end.
In this article we will be looking at how to enable protocol logging and Message tracking in Exchange 2013 and analyzing the protocol and message tracking logs as well in a little bit different way through Excel.Earlier in Exchange 2007 & 2010 we used to turn on Message tracking in Hub transport servers.
Since in Exchange 2013 the hub transport servers have been removed the Message tracking logs are stored in the mailbox servers.
Steps to turn on Message tracking in Exchange 2013
Use EAC to configure Message tracking
1. In the EAC, navigate to Servers > Servers.
2. Select the Mailbox server you want to configure, and then click Edit .
3. On the server properties page, click Transport Logs.
4. In the Message tracking log section, select the following:
◦Enable message tracking
5. Click Save.
Steps to turn on Protocol Logs in Exchange 2013
Click on mail flow
Double click on receive connector tab and select the protocol logging level to verbose
Now we are going to send few test emails so that the logs get generated which would be ideal for us to analyze the logs
So we are sending test email with subject “Test Email for Message Tracking”
For analyzing the verbose logs it’s always better we can use the log parser tool.
If still we need to analyze the data without log parser for single transaction it’s possible with sender and recipient to check if the mail transaction has been successful.
Below is an example
For analyzing the logs in message tracking you can follow the below steps
Copy the message tracking logs from the below location from the mailbox server
Note: There will be 4 types of message tracking logs in Exchange 2013 unlike in Exchange 2010 we have only 2.
•MSGTRK These logs are associated with the Transport service.
•MSGTRKMA These logs are associated with the approvals and rejections used by moderated transport. For more information, see Moderated Transport.
•MSGTRKMD These logs are associated with messages delivered to mailboxes by the Mailbox Transport Delivery service.
•MSGTRKMS These logs are associated with messages sent from mailboxes by the Mailbox Transport Submission service
MSGTRKMS is sufficient for us to calculate the message tracking in most of the situations.
We can use other logs in deep dive analysis of cases where we suspect the mails being not delivered to mailbox server and in few cases where we are unable to find any transaction in MSGTRKMS logs to see if the mail is been delivered to the mailbox server from the CAS server.
But MSGTRKMS will give us the information 99 percent of the time.After copying the MSGTRKMS logs in the excel just filter the category column as shown below.
Now we have number of options to filter message transactions. In below example we are going to filter a particular transaction with Message subject and below is the output for successful transaction.
Just select the Message subject column drop down and uncheck select all as shown below.
Just select Test Email for Message Tracking as shown below
Below output is the successful transaction of the message transaction after the filter is applied for our example scenario.
The below screenshot is the important parameter which should be checked and for a successful transaction i.e column (source and event-id) as shown below
For a failure transaction we will not be having the receive status as shown above
We have multiple options like date time, Client ip, server ip , recipients through which we will be able to isolate a particular transaction very easily . Getting used to this will take some time but once after if you start analyzing the message tracking through this then you will feel comfortable with this type of message tracking Cook for situations like where you need to filter out multiple parameters.
Now we will look into how to analyze the receive connector protocol logs with help of Excel as we did for Message tracking.
First Copy the Logs from the below location
It is very clear we will be getting confused to see where to find the receive connector protocol logs since the transport level architecture have been bifurcated in exchange 2013 and we have multiple folders like front end, hub , protocol log unlike Exchange 2010 we have only this location
“D:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs\ProtocolLog\SmtpReceive”
We just need to navigate to the below location alone in Exchange 2013 and copy the receive connector logs which will be identical to analyze the protocol logs via excel.
“C:\program files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Hub\ProtocolLog\SmtpReceive”
Open them in Excel
Unlike in Message tracking we do not have many items for us to filter here as shown below. But we can always filter them via sender or recipient address who reported to be a problem with mail flow.
Now we are going to identify a successful transaction for user id Sathish@exchangequery.com through receive connector protocol logs .For that we just need to open the receive connector logs in Excel and search for the above email id in the excel sheet.
Below is the successful transaction for the above search result
In the above screen it clearly mentions the mail from and the rcpt to . The final transaction result we can see is Transferred 3 resolved and 0 unresolved and 250 chunk received OK . This should be the output for a successful transaction.
Note: All we need to look is only at the data and context part in receive and send connector protocol logs which gives us info about the successful \failure transaction.
You can also use log parser to analyze the protocol logs. The above steps is just an additional part of troubleshooting steps through deep dive into message tracking and protocol logs to narrow down mail flow issues to identify the root cause.
Thanks a lot ChandraKumar
Got a query, can we identify TLS and Non TLS connection from receive connector logs. Can this be done through logpraser tool, if yes can you share me the command.
The best thing is you can analyse from the csv and if you see any TLS string they are using TLS connections
When analyzing, look for a string like TLS protocol SP_PROT_TLS1_0_SERVER (when receiving)
TLS protocol SP_PROT_TLS1_2_SERVER and TLS protocol SP_PROT-TLS1_2_CLIENT.
TLS version 1.0,1.1,1.2 depends on the number you are seeing after server.