Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm decommissioning a couple of Exchange 2010 CAS/HT servers that have a couple of weeks of message tracking logs on them. I'd like to move the logs somewhere where they can still be searched using the Get-MessageTrackingLogs cmdlet.

My first thought was to just move them to another CAS/HT server but apparently they are named exactly the same on all of the servers.

Are there any other options?

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

The "Search Message Tracking Logs" section from the documentation states:

You can't copy the message tracking log files from another Exchange server and then search them by using the Get-MessageTrackingLog cmdlet. Also, if you manually save an existing message tracking log file, the change in the file's date-time stamp breaks the query logic that Exchange uses to search the message tracking logs.

But as the logs are plain text files in a simplistic structure you would be able to rename the log files to integrate them with the existing ones on a different server. The file name is something along MSTRKyyymmdd-n.log where n is an increment with a maximum of 9999. If you have not used a copy method which would pertain the last write access time stamp, you probably would want to set the copied files' last write timestamps e.g. using the LastWriteTime property of the FileInfo object accordingly.

Events obviously would not be in a chronological order - this might impact searchability by time (not sure if it really is going to be the case). I simply would try it out with a couple of manually renamed log files and script a renaming function for the rest, if it works out.

You also could pull the data using Get-MessageTrackingLog and dump it to a file using Export-Clixml so you could reload it later and filter on the results using Powershell functions, if needed. This however would require you to use a different function to load the object and deprive you of Get-MessageTrackingLog-specific filters.

share|improve this answer
    
You were almost right about copying the log files, but there is one more step: you have to change the log files filesystem timestamps because Exchange uses them to choose which ones to search. There's a script here to do that: technet.microsoft.com/en-us/library/bb124926.aspx –  longneck Jun 19 '13 at 13:48
    
@longneck thanks for pointing this out. I'll add it to my answer for increased readability –  the-wabbit Jun 19 '13 at 15:42
    
You're right, that was the wrong link. But you found the right one. :) –  longneck Jun 19 '13 at 16:27
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.