Get FAIL and DSN Emails using Message Tracking Logs

The other day I was doing some searches using Message Tracking Logs when I came across a few emails with and EventID of FAIL and DSN (delivery status notification), so I wanted to look further into these. It is very easy to return all the FAIL emails by running something like this:

Get-MessageTrackingLog -ResultSize Unlimited -EventID FAIL

But it is important to get all the other events that lead into this FAIL. As such, the following basic script will look for any FAIL or DSN events, check the message’s ID and return all the events for that message ID:

Param (
       [Parameter(Position = 0, Mandatory =$False)]
       [String] $From= $(Get-Date"12/20/2015")
(Get-TransportService) | Get-MessageTrackingLog -ResultSize Unlimited -Start $From | Where {$_.EventID -eq"FAIL"-OR$_.EventID -eq"DSN"} | ForEach {
       Get-MessageTrackingLog -ResultSize Unlimited -MessageID $_.MessageID -Start $From | ? {$_.EventID -notlike"HA*"-and$_.EventID -ne"PROCESSMEETINGMESSAGE"-and$_.EventID -ne"NOTIFYMAPI"} | Select Timestamp, EventId, Source, Sender, {$_.Recipients}, {$_.RecipientStatus}, MessageSubject, TotalBytes, RecipientCount, MessageId, ClientIp, ClientHostname, OriginalClientIp, ServerIp, ServerHostname, MessageInfo, MessageLatency, MessageLatencyType, {$_.EventData}, SourceContext, ConnectorId | Export-CsvFailDSN.csv-NoTypeInformation-Append

At the end, we have all the information for all these emails from the moment they were received by Exchange until after the FAIL or DSN. Hope this helps!


2 thoughts on “Get FAIL and DSN Emails using Message Tracking Logs”

    1. Hi JJ,

      Get-TransportService is replacing Get-TransportServer. In Exchange 2010 you only have Get-TransportServer, while in Exchange 2013 you can use both (but should use Get-TransportService).


Leave a Comment

Your email address will not be published.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Scroll to Top