Find the retention period for your message tracking logs in Exchange 2010

Today I was faced with tracing an email from over 3 months ago.

I wasn't sure  if this was possible. So I checked the retention period for my message tracking logs.

Get-ExchangeServer | where {$_.isHubTransportServer -eq $true} | Get-TransportServer | select Name, *MessageTracking* | ft -AutoSize

Shortly I realize that I have 6 months worth of message logs however the fact that we only 

retain a certain amount of logs (10GB) of logs tells me that once this quota is met, I am no longer

 able to access 6 months of logs.

Exchange 2010, Outlook indexing not working

Key:

1)      When this issue occurs, you will see the following events in the application log:

Log Name: Application

Source: MSExchangeIS Mailbox Store

Event ID: 9877

Task Category: Content Indexing

Level: Error

Description:

Content Indexing function 'CISearch::EcGetRowsetAndAccessor' received an unusual and unexpected error code from MSSearch. Mailbox Database: <Database Name> Error Code: 0x80043629

Log Name: Application

Source: MSExchangeIS Mailbox Store

Event ID: 9842

Task Category: Content Indexing

Level: Error

Description:

Function CISearch::EcGetRowsetAndAccessor detected that content indexing was disabled for database '<Database Name>' because of error '0x80041820' from MSSearch.

22)      Content index state is failed for multiple databases. Rebuilding them does not bring them out of a failed state.

Solution

You will need to execute a script on the affected Mailbox servers that re-installs the symbolic links:

1. Download the script Repair-ExchangeSearchSymlinks.ps1 from the Script Center (http://gallery.technet.microsoft.com/scriptcenter/16afe88b-6c6d-49a3-8b03-2a2ece27f61a) .

2. Copy the Repair-ExchangeSearchSymlinks.ps1 script to the Scripts folder on the Mailbox server (default location is C:\Program Files\Microsoft\Exchange Server\v14\Scripts).

3. Within the Exchange Management Shell, navigate to the Exchange Scripts directory (default location is C:\Program Files\Microsoft\Exchange Server\v14\Scripts).

4. Within the Exchange Management Shell, run the following script:

.\Repair-ExchangeSearchSymlinks.ps1

5. Within the Exchange Management Shell, run the following script (without the symbols [] and substitute the database name(s) for any databases you wish to reset:

.\ResetSearchIndex.ps1 <-force> <dbname> [<dbname>]...

.\resetsearchindex.ps1 –force db001

6. In the event viewer on the mailbox server you will see Event ID 109 when the rebuilding of the index starts for each database and an Event ID 110 for each database when the index rebuild has completed.

8. After receiving Event ID 110 for each database, test to make sure search functions correctly with both OWA and Outlook operating in Online Mode.

Ref: https://blogs.technet.com/b/exchange/archive/2011/06/30/after-installing-exchange-2010-service-pack-1-searching-via-owa-or-outlook-online-mode-fails.aspx?Redirected=true

"Message tracking is currently unavailable” in Exchange 2010 management console.

In exchange 2010, you open the Exchange management console, go to Toolbox and open the Message tracking option. 

You then get the following error "Message tracking is currently unavailable”

This can be due to either lack of permissions or an unconfigured setting.

Solution:

1: Ensure message tracking is turned on

Open Exchange Management Shell and type in the following cmdlet

get-transportserver | fl *track*

If so, you should see this for each transport server you have in your organisation.

Make sure that MessageTrackingLogEnabled is "True"

2: Test Message tracking works in Exchange Powershell

Run a simple cmdlet for messagetracking which you know will return results. This will tell you whether you have a work around until the console is repaired.

ie:

get-messagetrackinglog -start "01/29/2012 09:00AM" -end "01/29/2012 09:30AM" -recipients sender@source.net

  

3: Test that the "Microsoft Exchange Transport Log Search" service is running.

Open Exchange Management Shell and type in the following cmdlet

get-ecpvirtualdirectory | fl

You want to get the "InternalURL" open a browser and put the InternalURL into 

eg:

https://<FQDN of your exchange server>/ecp

http://usa.exchangenetwork/ecp

If you get an error like below, it is more than likely you have a permission issue. ie: you need there correct RBAC settings and you should check to ensure you have the right administrative rights.

If the "InternalURL" field is empty or incorrect, then you need to set it using this cmdlet:

Set-ecpvirtualdirectory ecp* -InternalURL https://<fqdn of your exchange server>/ecp

Next try opening the messaging tracking in Exchange Management console again.

Open the Exchange management console, go to Toolbox and double click on the Message tracking option where you may be prompted for your admin credentials.