下面介紹了Exchange 2013裏Get-MessageTrackingLog常用的各種Powershell，
Get-MessageTrackingLog -resultsize unlimited -Start "06/01/2014 4:30:00 PM" -End "06/04/2014 5:17:00 PM" |where-object {$_.Recipients -like "*@contoso.com" -AND $_.EventId -eq "Send"} | where {$_.recipients -like "*@ contoso.com"} | Select @{Name='Recipients';Expression={[string]::join(";", ($_.Recipients))}}, Sender, EventId, Timestamp, Source, MessageSubject | Export-CSV "C:EmailAddress_Statistics_Send.csv"
Get-MessageTrackingLog -resultsize unlimited -Start "12/02/2014 4:20:00 PM" -End "12/02/2014 07:30:00 PM" |where-object {$_.EventId -eq "Send"} | Select @{Name='Recipients';Expression={[string]::join(";", ($_.Recipients))}}, Sender, EventId, Timestamp, Source, MessageSubject | Export-CSV "C: Dec2_Email_Statistics_Send.csv"
Get-Messagetrackinglog -Resultsize Unlimited | Where {$_.Sender -match "@contoso.com"} -EventID "Send" -Start "12/02/2014 4:20:00 PM" -End "12/02/2014 07:30:00 PM" | Select @{Name='Recipients';Expression={[string]::join(";", ($_.Recipients))}}, Sender, EventId, Timestamp, Source, MessageSubject | Export-CSV "C: Dec2_Email_Statistics.csv"
To find Received Emails:
Get-MessageTrackingLog -resultsize unlimited -Start "12/02/2014 4:20:00 PM" -End "12/02/2014 07:30:00 PM" |where-object {$_.Recipients -like "*@ contoso.com" -AND $_.EventId -eq "RECEIVE"} | where {$_.recipients -like "*@contoso.com"} | Select @{Name='Recipients';Expression={[string]::join(";", ($_.Recipients))}}, Sender, EventId, Timestamp, Source, MessageSubject | Export-CSV "C:EmailAddress_Statistics_Receive.csv"
Get-MessageTrackingLog -resultsize unlimited -Start "12/02/2014 4:20:00 PM" -End "12/02/2014 07:30:00 PM" |where-object {$_.EventId -eq "RECEIVE"} | Select @{Name='Recipients';Expression={[string]::join(";", ($_.Recipients))}}, Sender, EventId, Timestamp, Source, MessageSubject | Export-CSV "C: Dec2_Email_Statistics_Receive.csv"
Get-MessageTrackingLog -resultsize unlimited |where {$_.MessageSubject -like "Win a Lottery"} >> "C:UsersusernameDesktopoutput.txt"
Get-MessageTrackingLog -resultsize unlimited -Start "6/3/2013 12:29:00 PM" -End "6/6/2013 12:39:00 PM" |where {$_.MessageSubject -like "Update your Social Security Number"} >> "C:UsersusernameDesktopoutput.txt"
Get-MessageTrackingLog -Server HUBServerName -resultsize unlimited |where-object {$_.Recipients -like "*@contoso.com" -AND $_.EventId -eq "Send"} | where {$_.recipients -like "*@contoso.com"} | ft EventId,Timestamp,Sender,recipients,MessageSubject,@{label="size";Expression={$_.Totalbytes/1mb}} >>c: @contoso_emails.csv
Get-Messagetrackinglog -Server HubServerName -resultsize unlimited -Sender "[email protected]" -EventID "SEND" -Start "5/10/2012 12:29:00 PM" -End "6/4/2012 12:39:00 PM" |ft Timestamp, Source, EventID, Recipients, MessageSubject, RecipientStatus, @{label="size";Expression={$_.Totalbytes/1mb}}
Get-Messagetrackinglog -Server HubServerName -resultsize unlimited -Start "12/01/2012 12:29:00 PM" -End "12/06/2012 12:39:00 PM" |where {$_.MessageSubject -like "Click Here to be SOX Compliant"} |ft Timestamp, Source, EventID, Recipients, MessageSubject, RecipientStatus, @{label="size";Expression={$_.Totalbytes/1mb}}
Domain based search: To find all emails from a specific domain in Exchange server (基於域名的查詢)
Get-MessageTrackingLog -Server hub1 -resultsize unlimited -Start "2/24/2013 12:29:00 AM" -End "2/26/2013 12:29:00 PM" |where-object {$_.Sender -match "contoso.com" -AND $_.EventId -eq "Receive"} | ft EventId,Timestamp,Sender,recipients,MessageSubject,@{label="size";Expression={$_.Totalbytes/1mb}}
Get-MessageTrackingLog -resultsize unlimited -Start "9/10/2014 12:29:00 PM" -End "9/12/2014 12:39:00 PM" |where {$_.MessageSubject -like "Pay off your Mortgage"} |fl Recipients, MessageSubject, Sender, ReturnPath, EventID
Get-Messagetrackinglog -Recipients:[email protected] -EventID "RECEIVE" -Start "05/25/2014 4:30:00 PM" -End "05/30/2014 5:17:00 PM"
Get-Messagetrackinglog -Recipients:[email protected] -EventID "RECEIVE" -Start "05/25/2014 4:30:00 PM" -End "05/30/2014 5:17:00 PM" | Select @{Name='Recipients';Expression={[string]::join(";", ($_.Recipients))}}, Sender, EventId, Timestamp, Source, MessageSubject | Export-CSV "C:EmailAddress_Statistics_forUser.csv"
謝謝！
歡迎關注老英的的微軟博客http://zyliday.blog.51cto.com/ ，致力於爲大家提供更多優質的IT博文.謝謝！
交流QQ：759147273
本文出自 “老英的微軟博客” 博客，請務必保留此出處http://zyliday.blog.51cto.com/760700/1723225