Exchange: Exporting and Querying Message Tracking Logs Using Log Parser

Summary:

Exchange Message Tracking utility is a great feature which enables administrators to track message flow for troubleshooting or verification. To enable message tracking, you must go into the properties of the server in Exchange System Manager. In ESM (Exchange System Manager) expand your administrative group, servers, highlight your server, right click properties. Here, you see the option to enable message tracking. In Exchange 2003 you can specify the directory on this pane as to where you want to store these message tracking log files. For 2000 these logs are stored in your Program Files\Exchsrvr\ExServer1.log directory. If you wish to change the location, follow the KB article at the end of this article. When using this tool from ESM, the information is gathered from these message tracking logs. If you were to open these log files, you can see that it is very difficult to read and the message tracking tool in ESM does not give you the option to pipe the results in a file. This article will go over how to export the contents of the message tracking log file to a more friendly text file using Log Parser utility.


Export Exchange Message Tracking Log to a CSV File using Log Parser

1. Download LogParser 2.2

http://www.microsoft.com/downloads/details.aspx?FamilyID=890cd06b-abf8-4c25-91b2-f8d975cf8c07&displaylang=en

Note: You can also use the Log Parser GUI but is very limited. You can download the GUI version from: http://www.logparser.com/simpleLPview00.zip

If you wish to use the GUI version, copy all DLLs and EXE files to the your system32 folder and run the LPview00.exe from the system32 folder. (The following steps below assume that you are working with the CLI version.

2. Once you have download Logparser 2.2, go to Start Menu, Programs, Log Parser 2.2, Log Parser 2.2. This will launch a command prompt.

3. Now you can run SQL statements against the message tracking log file. The example below will query any entry where the recipient address is user1@company.com and export it to a text file called export.txt

C:\Program Files\Log Parser 2.2>logparser -q -i:w3c "SELECT* FROM c:\temp2\log.log
WHERE Recipient-Address like `user1@company'" > c:\export.txt

I will have more sample SQL queries soon so check back! If you wish to request a specific SQL query, you can email from.

References:

LogParser References
www.logparser.com
http://www.securityfocus.com/infocus/1712.

How to change the location of the message tracking logs in Exchange 2000 Server
http://support.microsoft.com/kb/317700/



James Chong
MCSE M+, S+, MCTS, Security+
msexchangetips.blogspot.com


How useful was this article? Want to see a tip not listed? Please leave a comment.