Analyzing the protocol logs and Message tracking logs in Exchange 2013

gmdzxx

　　from:
　　http://social.technet.microsoft.com/wiki/contents/articles/23182.analyzing-the-protocol-logs-and-message-tracking-logs-in-exchange-2013.aspx

　　During the time of troubleshooting in mail delay and issues when users reporting emails being not received its little bit tougher part to isolate and>
　　Message tracking and protocol logs analysis is one of the best way to>　　In this article we will be looking at how to enable protocol logging and Message tracking in Exchange 2013 and analyzing the protocol and message tracking logs as well in a little bit different way through Excel.Earlier in Exchange 2007 & 2010 we used to turn on Message tracking in Hub transport servers.
　　Since in Exchange 2013 the hub transport servers have been removed the Message tracking logs are stored in the mailbox servers.
　　Steps to turn on Message tracking in Exchange 2013
　　Use EAC to configure Message tracking
　　1. In the EAC, navigate to Servers > Servers.
　　2. Select the Mailbox server you want to configure, and then click Edit .
　　3. On the server properties page, click Transport Logs.
　　4. In the Message tracking log section, select the following:
　　Enable message tracking
　　5. Click Save.
　　Steps to turn on Protocol Logs in Exchange 2013
　　Open EAC
　　Click on mail flow

　　Double click on receive connector tab and select the protocol logging level to verbose

　　Now we are going to send few test emails so that the logs get generated which would be>　　So we are sending test email with subject “Test Email for Message Tracking”
　　For analyzing the verbose logs it’s always better we can use the log parser tool.
　　If still we need to analyze the data without log parser for single transaction it’s possible with sender and recipient to check if the mail transaction has been successful.
　　Below is an example
　　For analyzing the logs in message tracking you can follow the below steps
　　Copy the message tracking logs from the below location from the mailbox server

　　Note: There will be 4 types of message tracking logs in Exchange 2013 unlike in Exchange 2010 we have only 2.
　　MSGTRK   These logs are associated with the Transport service.
　　MSGTRKMA   These logs are associated with the approvals and rejections used by moderated transport. For more information, see Moderated Transport.
　　MSGTRKMD   These logs are associated with messages delivered to mailboxes by the Mailbox Transport Delivery service.
　　MSGTRKMS   These logs are associated with messages sent from mailboxes by the Mailbox Transport Submission service
　　MSGTRKMS  is sufficient for us to calculate the message tracking in most of the situations.
　　We can use other logs in deep dive analysis of cases where we suspect the  mails being not delivered to mailbox server and in few cases where we are unable to find any transaction in MSGTRKMS logs to see if the mail is been delivered to the mailbox server from the CAS server.
　　But MSGTRKMS will give us the information 99 percent of the time.After copying the MSGTRKMS logs in the excel just filter the category column as shown below.

　　Now we have number of options to filter message transactions. In below example we are going to filter a particular transaction with Message subject and below is the output for successful transaction.
　　Just select the Message subject column drop down and uncheck select all as shown below.

　　Just select Test Email for Message Tracking as shown below

　　Below output is the successful transaction of the message transaction after the filter is applied for our example scenario.

　　The below screenshot is the important parameter which should be checked and for a successful transaction i.e column (source and event-id) as shown below

　　For a failure transaction we will not be having the receive status as shown above
　　We have multiple options like date time, Client ip, server ip , recipients through which we will be able to isolate a particular transaction very easily . Getting used to this will take some time but once after if you start analyzing the message tracking through this then you will feel comfortable with this type of message tracking Cook for situations like where you need to filter out multiple parameters.
　　Now we will look into how to analyze the receive connector protocol logs with help of Excel as we did for Message tracking.
　　First Copy the Logs from the below location

　　Note:
　　It is very clear we  will be getting confused to see where to find the receive connector protocol logs since the transport level architecture have been bifurcated in exchange 2013 and we have multiple folders like front end, hub , protocol log unlike Exchange 2010 we have only this location
　　“D:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs\ProtocolLog\SmtpReceive”

　　We just need to navigate to the below location alone in Exchange 2013 and copy the receive connector logs which will be>　　“C:\program files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Hub\ProtocolLog\SmtpReceive”
　　Open them in Excel
　　Unlike in Message tracking we do not have many items for us to filter here as shown below. But we can always filter them via sender or recipient address who reported to be a problem with mail flow.

　　Now we are going to>

　　Below is the successful transaction for the above search result

　　In the above screen it clearly mentions the mail from and the rcpt to . The final transaction result we can see is Transferred 3 resolved and 0 unresolved and 250 chunk received OK . This should be the output for a successful transaction.
　　Note:  All we need to look is only at the data and context part  in receive and send connector protocol logs which gives us info about the successful \failure transaction.

　　You can also use log parser to analyze the protocol logs. The above steps is  just an additional part of troubleshooting steps through deep dive into message tracking and protocol logs to narrow down  mail flow issues to>