Get FAIL and DSN Emails using Message Tracking Logs

The other day I was doing some searches using Message Tracking Logs when I came across a few emails with and EventID of FAIL and DSN (delivery status notification), so I wanted to look further into these. It is very easy to return all the FAIL emails by running something like this:

Get-MessageTrackingLog -ResultSize Unlimited -EventID FAIL

But it is important to get all the other events that lead into this FAIL. As such, the following basic script will look for any FAIL or DSN events, check the message’s ID and return all the events for that message ID:

[CmdletBinding()]

Param (

       [Parameter(Position = 0, Mandatory =$False)]

       [String] $From= $(Get-Date"12/20/2015")

)

(Get-TransportService) | Get-MessageTrackingLog -ResultSize Unlimited -Start $From | Where {$_.EventID -eq"FAIL"-OR$_.EventID -eq"DSN"} | ForEach {

       Get-MessageTrackingLog -ResultSize Unlimited -MessageID $_.MessageID -Start $From | ? {$_.EventID -notlike"HA*"-and$_.EventID -ne"PROCESSMEETINGMESSAGE"-and$_.EventID -ne"NOTIFYMAPI"} | Select Timestamp, EventId, Source, Sender, {$_.Recipients}, {$_.RecipientStatus}, MessageSubject, TotalBytes, RecipientCount, MessageId, ClientIp, ClientHostname, OriginalClientIp, ServerIp, ServerHostname, MessageInfo, MessageLatency, MessageLatencyType, {$_.EventData}, SourceContext, ConnectorId | Export-CsvFailDSN.csv-NoTypeInformation-Append

}

At the end, we have all the information for all these emails from the moment they were received by Exchange until after the FAIL or DSN. Hope this helps!