Find Any Sent/Received Email over certain size?

I'm trying to find a way to track all either sent or received messages in Exchange that are over a certain size and see those message items. I have a Exchange Shell cmdlet to find all received/sent emails over X MB's but is there a way I can add it as a monitored component or a report in SW?

Find more posts tagged with

Accepted answers

All comments

tomiannelli

Being able to report that data during a period of time is easy enough. However, How do you want to report all the messages? Would a single list of message IDs be sufficient. Historically the limit on scripts is 10 pairs of Messages and Statistics, thus individual messages might exceed that limit in the polling cycle.

If you output the MESSAGE text as HTML - table or grid - it should display on the web console for you. What are the statistic you want to track specifically?

dan.obiedzinski

Thanks for quick reply. Basically I'm trying to just get more insight into large emails sent by internal senders within any given time period so we can go to those Senders and see if they can use a different method besides email. Currently I have a cmdlet that I ran on occasion that searches Exchange logs for anything sent over say 50MB within the past 7 days and give me the sender, recipients, subject, and timestamp.

What I'd like SW to be able to do either through an app monitor or a report that I can run/schedule as needed is to give me say.. Largest 10 (or maybe 25) unique messages sent the past day (or 7 days or whatever) and at least give me the size, sender, and timestamp of the mail. Of course more info like subject and recipients would be even better but I'd take whatever I can get without creating too much traffic or stress on either SW or Exchange.

I'm a SW newbie, just started monitoring my Exchange environment this week so I have no idea where to start. If you have an app monitor or report I can import right into SW that would be excellent!!

Thanks!!

tomiannelli

I assume this is a PowerShell script. If so and you are able to share it. I would be happy to help and engage some others as needed.

dan.obiedzinski

Correct, well it's a one liner cmdlet then I just export to csv and send the results as an email. I filter out my journal mailbox from the results since that would just be a copy of the actual emails. But here's the one liner:

$Servers = Get-ExchangeServer; $Servers | where {$_.isHubTransportServer -eq $true -or $_.isMailboxServer -eq $true} | get-messagetrackinglog -resultsize unlimited -eventid "receive" -Start (get-date).adddays(-7) | where {$_.recipients -notlike "journalmailbox"} | select @{label="Size in MB"; Expression={$_.Totalbytes/1mb}}, totalbytes,timestamp, messagesubject, sender, {$_.recipients}, recipientcount | where {$_.totalbytes -gt "52428800"} | sort totalbytes -descending

dan.obiedzinski

We want to be able to track down the Senders sending the largest email. I'd like to be able to have a single list that provides the sender and size. But if that's too much to poll and messageID is better than I could always look those up separately from Exchange.