Exchange Server Message tracking log tuning ?

[albertwt]

Hi All,

 

What should be the configuration of Exchange Server Message tracking log ?

 

Get-ExchangeServer | where {$_.isHubTransportServer -eq $true} | Get-TransportServer | select Name, *MessageTracking* | ft -AutoSize

 

from the powershell above result here's the result:

 

Name        MessageTrackingLogEnabled MessageTrackingLogMaxAge MessageTrackingLogMaxDirectorySize MessageTrackingLogMaxFileSize MessageTrackingLogPat                                                                                                                                h                    
----        ------------------------- ------------------------ ---------------------------------- ----------------------------- ---------------------
ExHTServer1                      True 20.00:00:00              250MB                              10MB                          D:\Program Files\M...
ExHTServer2                      True 20.00:00:00              250MB                              10MB                          D:\Program Files\M...
ExHTServer3                      True 20.00:00:00              250MB                              10MB                          D:\Program Files\M...

 

what is the best practice if I want to have a retention of let say 6 months ?

 

I'm confused which parameter that is should/can be changes.

 

Thanks

[sukh]

Hi

 

It depends on the amount of traffic which goes through your email system

 

1. Why would you want to keep 6 months?

2. Normally, 30-40 days would be fine.

3. Tracking logs configured on HTS and MBS.

 

Regards

Sukh

[albertwt]

many thanks for your reply sukh, well in case I need to trackdown any email within that time then it would be handy to know.

[sukh]

Hi

 

I can understand that. If you have the disk space then you can configure this. Also, if you do need to track a message older than the configured threshold, then providing you have backups in place, you can always restore the logs and analyse them.

 

What would you do if a user says I sent a message 7 months ago?

Normally, in my experience, users tend to request confirmation of email if the intended recipient did not reply back or contact them when they were expecting an answer. This depends our your environment.

 

Set-TransportServer YourExchangeServerName -MessageTrackingLogMaxAge 180.00:00:00 (for HT)

 

Set-MailboxServer YourExchangeServerName -MessageTrackingLogMaxAge 180.00:00:00 (for MBS)

 

Regards

Sukh

[albertwt]

oh, is that simple :-) I thought that I must /can specify the filesize chunk ?

maybe few large size logs is better than thousands of smaller file due to fragmentation issue.

[sukh]

Hi

 

You can specify many parameters such as log file size, location, age, folder size etc..

 

From your config output, the "MessageTrackingLogMaxDirectorySize" is the default 250MB. Which means tracking logs will get deleted after this directory has reached this limit. Therefore if you want to keep logs for 6 months, you have to consider this limit too otherwise you logs will be deleted. In addition to this, you have to set the "MessageTrackingLogMaxAge" which I showed above.

 

Please see Configure Message Tracking: Exchange 2010 SP1 Help for further information.

 

Regards

Sukh

[albertwt]

ok, based on your suggestion then 6 months worth of log should then be sized approx 2 GB or 2048 MB ?

[tarquel]

sukh, just for info, some establishments / organisations / authority's have legal requirements to hold the data for much longer in case of some legal mumbo jumbo where a complaint comes in due to a email not being recieved months down the line.

 

Just so ya know

 

EDIT: thanks for sharing the how to's

 

Nath

[sukh]

Hi

 

It will depend on how many logs have been generated which is dependent on your mail flow in your Exchange Org. You need to have a baseline. Check the historical logs and see how many are generated per day. Allow some room for unexpected traffic and then set on all your HTS and MBS.

 

Are your HTS and MBS roles seperated?

 

Regards

Sukh

[tarquel]

albertwt, best checking how much space the logs current @ 20days have used, and then use that as a basis for how much space your gonna need.

 

Just maths really I guess and add 10% or more for growth and set yourself a reoccuring calendar entry to remember to check it or automate some reports of some description

 

HTH

[sukh]

Hi Nathan

 

I fully understand and thanks for highlighting. For this reason, backups should in place whereby you can restore tracking logs. However, this is where an archiving/journaling solution should be in place to comply with legal and compliance.

 

Message tracking will only show if the message was received or sent whereas archiving/journaling will actually keep the email in tact.

 

Regards

Sukh

[albertwt]

yes, that's true, many thanks guys for the reply and suggestion.

[tarquel]

indeed Sukh... was merely pointing out in case you didnt know :)

 

Nath.

[sukh]

Hi Nathan

 

Thanks, will be good information if someone else comes across this post.

 

Regards

Sukh