Rafael Pfister

Seguimiento de mensajes

Buscar en el registro de seguimiento y demostrar la ruta de entrega: Exchange on-prem, Exchange Online y Postfix.

Buscar por remitente y destinatario

La búsqueda estándar: todos los eventos de un par remitente/destinatario en el periodo elegido, en orden cronológico.

Letzte 48 Stunden

Exchange on-prem

Get-MessageTrackingLog (Exchange) Integrado 

Get-TransportService | Get-MessageTrackingLog -WarningAction 0 `
  -Sender "sender@example.com" -Recipients "empfaenger@example.com" `
  -Start (Get-Date).AddHours(-48) -End (Get-Date) -ResultSize Unlimited |
  Where-Object { $_.Sender -notmatch "HealthMailbox" -and $_.Recipients -notmatch "Health" } |
  Sort-Object Timestamp |
  Format-Table Timestamp, EventId, Source, Sender, @{N="Recipients";E={$_.Recipients -join ","}}, MessageSubject -AutoSize

journalctl / grep (Postfix) Integrado 

journalctl -u postfix --since "48 hours ago" | grep -iE "from=<sender@example.com>|to=<empfaenger@example.com>" | tail -40
# Ohne systemd-Journal direkt im Log, dann aber ohne Zeitfilter:
grep -iE "from=<sender@example.com>|to=<empfaenger@example.com>" /var/log/mail.log | tail -40

Exchange Online

Get-MessageTraceV2 Herramienta adicional 

Connect-ExchangeOnline
Get-MessageTraceV2 -SenderAddress "sender@example.com" -RecipientAddress "empfaenger@example.com" `
  -StartDate (Get-Date).AddHours(-48) -EndDate (Get-Date) |
  Sort-Object Received |
  Format-Table Received, SenderAddress, RecipientAddress, Subject, Status -AutoSize

Get-MessageTrace (alt) Herramienta adicional 

# Vor der Umstellung auf V2; identische Parameter, kleinere Ergebnisgrenzen.
Get-MessageTrace -SenderAddress "sender@example.com" -RecipientAddress "empfaenger@example.com" `
  -StartDate (Get-Date).AddHours(-48) -EndDate (Get-Date)

Fenster am Vormittag

Exchange on-prem

Get-MessageTrackingLog (Exchange) Integrado 

Get-TransportService | Get-MessageTrackingLog -WarningAction 0 `
  -Sender "sender@example.com" -Recipients "empfaenger@example.com" `
  -Start (Get-Date "2026-08-09 08:00") -End (Get-Date "2026-08-09 12:00") -ResultSize Unlimited |
  Where-Object { $_.Sender -notmatch "HealthMailbox" -and $_.Recipients -notmatch "Health" } |
  Sort-Object Timestamp |
  Format-Table Timestamp, EventId, Source, Sender, @{N="Recipients";E={$_.Recipients -join ","}}, MessageSubject -AutoSize

journalctl / grep (Postfix) Integrado 

journalctl -u postfix --since "2026-08-09 08:00" --until "2026-08-09 12:00" | grep -iE "from=<sender@example.com>|to=<empfaenger@example.com>" | tail -40
# Ohne systemd-Journal direkt im Log, dann aber ohne Zeitfilter:
grep -iE "from=<sender@example.com>|to=<empfaenger@example.com>" /var/log/mail.log | tail -40

Exchange Online

Get-MessageTraceV2 Herramienta adicional 

Connect-ExchangeOnline
Get-MessageTraceV2 -SenderAddress "sender@example.com" -RecipientAddress "empfaenger@example.com" `
  -StartDate (Get-Date "2026-08-09 08:00") -EndDate (Get-Date "2026-08-09 12:00") |
  Sort-Object Received |
  Format-Table Received, SenderAddress, RecipientAddress, Subject, Status -AutoSize

Get-MessageTrace (alt) Herramienta adicional 

# Vor der Umstellung auf V2; identische Parameter, kleinere Ergebnisgrenzen.
Get-MessageTrace -SenderAddress "sender@example.com" -RecipientAddress "empfaenger@example.com" `
  -StartDate (Get-Date "2026-08-09 08:00") -EndDate (Get-Date "2026-08-09 12:00")

Los dos campos de fecha fijan el intervalo al minuto; si se dejan vacíos, el comando usa las últimas 48 horas. Get-TransportService consulta todos los servidores de transporte, no solo el local. Las líneas de HealthMailbox (mensajes de supervisión propios de Microsoft) se filtran; de lo contrario, los resultados reales se pierden entre ellas. Exchange Online requiere el módulo ExchangeOnlineManagement; allí Get-MessageTraceV2 ha sustituido a Get-MessageTrace.

Buscar por asunto

Encuentra mensajes por una parte del asunto: la vía habitual cuando el usuario solo puede decir "mi factura de ayer".

Exchange on-prem

Get-MessageTrackingLog (Exchange) Integrado 

Get-TransportService | Get-MessageTrackingLog -WarningAction 0 `
  -MessageSubject "Rechnung" `
  -Start (Get-Date).AddHours(-48) -End (Get-Date) -ResultSize Unlimited |
  Where-Object { $_.Sender -notmatch "HealthMailbox" } |
  Sort-Object Timestamp |
  Format-Table Timestamp, EventId, Sender, @{N="Recipients";E={$_.Recipients -join ","}}, MessageSubject -AutoSize

journalctl / grep (Postfix) Integrado 

journalctl -u postfix --since "48 hours ago" | grep -i "Rechnung" | tail -40
grep -i "Rechnung" /var/log/mail.log | tail -40

Exchange Online

Get-MessageTraceV2 Herramienta adicional 

# V2 kennt keinen Betreff-Parameter, darum nachträglich filtern.
Get-MessageTraceV2 -StartDate (Get-Date).AddHours(-48) -EndDate (Get-Date) |
  Where-Object { $_.Subject -like "*Rechnung*" } |
  Format-Table Received, SenderAddress, RecipientAddress, Subject, Status -AutoSize

En on-prem, -MessageSubject busca una subcadena. En Exchange Online el comando filtra a posteriori, porque Get-MessageTraceV2 no tiene parámetro de asunto.

Rastrear un mensaje

Muestra todas las etapas de un mensaje concreto por su Message-ID, en todos los servidores de transporte.

Message-ID aus dem Kopf

Exchange on-prem

Get-MessageTrackingLog (Exchange) Integrado 

Get-TransportService | Get-MessageTrackingLog -WarningAction 0 `
  -MessageId "<a1b2c3@example.com>" `
  -Start (Get-Date).AddHours(-48) -End (Get-Date) -ResultSize Unlimited |
  Sort-Object Timestamp |
  Format-Table Timestamp, ServerHostname, EventId, Source, SourceContext, @{N="Recipients";E={$_.Recipients -join ","}} -AutoSize

grep (Postfix) Integrado 

qid=$(grep -F "<a1b2c3@example.com>" /var/log/mail.log | grep -oE "[A-F0-9]{8,}" | head -1)
echo "Queue-ID: $qid"
grep "$qid" /var/log/mail.log

Exchange Online

Get-MessageTraceV2 Herramienta adicional 

Get-MessageTraceV2 -MessageId "<a1b2c3@example.com>" `
  -StartDate (Get-Date).AddHours(-48) -EndDate (Get-Date) |
  Format-List Received, SenderAddress, RecipientAddress, Subject, Status, MessageTraceId

El Message-ID está en la cabecera del mensaje (nuestro analizador de cabeceras de correo lo muestra). Incluya los corchetes angulares exactamente como en la cabecera.

Ruta de entrega con desfase temporal

La ruta de entrega como cadena con los segundos transcurridos desde el primer evento: muestra qué etapa perdió el tiempo.

Exchange on-prem

Get-MessageTrackingLog (Exchange) Integrado 

$log = Get-TransportService | Get-MessageTrackingLog -WarningAction 0 `
  -MessageId "<a1b2c3@example.com>" -Start (Get-Date).AddHours(-48) -End (Get-Date) -ResultSize Unlimited |
  Sort-Object Timestamp
$first = $log[0].Timestamp
$log | Select-Object @{N="+Sek";E={[math]::Round(($_.Timestamp - $first).TotalSeconds,1)}},
  Timestamp, ServerHostname, EventId, Source, @{N="Detail";E={$_.RecipientStatus -join " "}} |
  Format-Table -AutoSize
# Kette: RECEIVE -> SUBMIT -> TRANSFER -> SEND (nach aussen) bzw. DELIVER (ins Postfach).

grep / awk (Postfix) Integrado 

qid=$(grep -F "<a1b2c3@example.com>" /var/log/mail.log | grep -oE "[A-F0-9]{8,}" | head -1)
grep "$qid" /var/log/mail.log | awk '{ print $1, $2, $3, $6, $7, $8, $9, $10 }'

Exchange Online

Get-MessageTraceDetailV2 Herramienta adicional 

$m = Get-MessageTraceV2 -MessageId "<a1b2c3@example.com>" -StartDate (Get-Date).AddHours(-48) -EndDate (Get-Date)
$m | ForEach-Object {
  Get-MessageTraceDetailV2 -MessageTraceId $_.MessageTraceId -RecipientAddress $_.RecipientAddress |
    Format-Table Date, Event, Action, Detail -AutoSize
}

La cadena de EventId se lee RECEIVE, SUBMIT, TRANSFER y finalmente SEND (saliente) o DELIVER (al buzón). FAIL o DEFER marcan el punto de ruptura.

Entregas fallidas

Agrupa los eventos FAIL por motivo, los más frecuentes primero: encuentra el patrón detrás de una caída en lugar de casos aislados.

Letzte 48 Stunden

Exchange on-prem

Get-MessageTrackingLog (Exchange) Integrado 

Get-TransportService | Get-MessageTrackingLog -WarningAction 0 -EventId FAIL `
  -Start (Get-Date).AddHours(-48) -End (Get-Date) -ResultSize Unlimited |
  Where-Object { $_.Sender -notmatch "HealthMailbox" } |
  Group-Object { $_.RecipientStatus -join " " } -NoElement |
  Sort-Object Count -Descending | Select-Object -First 15 Count, Name

grep (Postfix) Integrado 

grep "status=bounced" /var/log/mail.log |
  grep -oE "said: [0-9]{3}[ -][0-9.]* [^)]*" | sort | uniq -c | sort -rn | head -15

Exchange Online

Get-MessageTraceV2 Herramienta adicional 

Get-MessageTraceV2 -Status Failed -StartDate (Get-Date).AddHours(-48) -EndDate (Get-Date) |
  Group-Object RecipientAddress -NoElement | Sort-Object Count -Descending | Select-Object -First 15

Encontrar entregas lentas

Calcula por mensaje el tiempo entre recepción y entrega y muestra los más lentos: la respuesta fundamentada a "el correo va muy lento".

Exchange on-prem

Get-MessageTrackingLog (Exchange) Integrado 

$log = Get-TransportService | Get-MessageTrackingLog -WarningAction 0 `
  -Start (Get-Date).AddHours(-48) -End (Get-Date) -ResultSize Unlimited |
  Where-Object { $_.Sender -notmatch "HealthMailbox" }
$log | Group-Object MessageId | ForEach-Object {
  $recv = ($_.Group | Where-Object EventId -eq "RECEIVE" | Sort-Object Timestamp | Select-Object -First 1).Timestamp
  $done = ($_.Group | Where-Object { $_.EventId -in "DELIVER", "SEND" } | Sort-Object Timestamp | Select-Object -Last 1).Timestamp
  if ($recv -and $done) {
    [pscustomobject]@{ Sekunden = [math]::Round(($done - $recv).TotalSeconds, 1); Betreff = $_.Group[0].MessageSubject }
  }
} | Sort-Object Sekunden -Descending | Select-Object -First 15

grep (Postfix) Integrado 

grep -oE "delay=[0-9.]+" /var/log/mail.log | cut -d= -f2 | sort -rn | head -15
# delay = Gesamtzeit von der Annahme bis zur Zustellung in Sekunden.

Exchange Online

Get-MessageTraceV2 Herramienta adicional 

# EXO liefert keine Laufzeit je Nachricht; die Detailansicht zeigt die Stationen mit Zeitstempel.
Get-MessageTraceV2 -StartDate (Get-Date).AddHours(-48) -EndDate (Get-Date) |
  Sort-Object Received -Descending | Select-Object -First 25 Received, SenderAddress, RecipientAddress, Subject, Status

Principales remitentes y destinatarios

Cuenta el volumen por remitente y destinatario: útil para cuestiones de carga y cuando se sospecha que un buzón está comprometido.

Exchange on-prem

Get-MessageTrackingLog (Exchange) Integrado 

$log = Get-TransportService | Get-MessageTrackingLog -WarningAction 0 -EventId RECEIVE `
  -Start (Get-Date).AddHours(-48) -End (Get-Date) -ResultSize Unlimited |
  Where-Object { $_.Sender -notmatch "HealthMailbox" }
"--- Top-Absender ---"
$log | Group-Object Sender -NoElement | Sort-Object Count -Descending | Select-Object -First 10
"--- Top-Empfaenger ---"
$log | ForEach-Object { $_.Recipients } | Group-Object -NoElement | Sort-Object Count -Descending | Select-Object -First 10

grep (Postfix) Integrado 

grep -oE "from=<[^>]+>" /var/log/mail.log | sort | uniq -c | sort -rn | head -10
grep -oE "to=<[^>]+>" /var/log/mail.log | sort | uniq -c | sort -rn | head -10

Exchange Online

Get-MessageTraceV2 Herramienta adicional 

$t = Get-MessageTraceV2 -StartDate (Get-Date).AddHours(-48) -EndDate (Get-Date)
"--- Top-Absender ---"
$t | Group-Object SenderAddress -NoElement | Sort-Object Count -Descending | Select-Object -First 10
"--- Top-Empfaenger ---"
$t | Group-Object RecipientAddress -NoElement | Sort-Object Count -Descending | Select-Object -First 10

Filtrar por EventId

Muestra todos los eventos de un tipo, por ejemplo solo FAIL, DEFER o DELIVER.

Exchange on-prem

Get-MessageTrackingLog (Exchange) Integrado 

Get-TransportService | Get-MessageTrackingLog -WarningAction 0 -EventId FAIL `
  -Start (Get-Date).AddHours(-48) -End (Get-Date) -ResultSize Unlimited |
  Sort-Object Timestamp |
  Format-Table Timestamp, ServerHostname, Sender, @{N="Recipients";E={$_.Recipients -join ","}}, MessageSubject -AutoSize
# Gaengige EventIds: RECEIVE SEND DELIVER FAIL DEFER RESOLVE EXPAND REDIRECT DROP SUBMIT TRANSFER

grep (Postfix) Integrado 

grep -oE "status=[a-z]+" /var/log/mail.log | sort | uniq -c | sort -rn

Exchange Online

Get-MessageTraceV2 Herramienta adicional 

# EXO kennt keine EventIds, sondern einen Status:
# Delivered, Failed, Pending, Quarantined, FilteredAsSpam, Expanded
Get-MessageTraceV2 -Status Failed -StartDate (Get-Date).AddHours(-48) -EndDate (Get-Date) |
  Format-Table Received, SenderAddress, RecipientAddress, Subject, Status -AutoSize

Exchange Online no tiene EventId sino un estado (Delivered, Failed, Pending, Quarantined, FilteredAsSpam).

Resumen del servidor

Cuenta los eventos de un servidor por tipo y muestra si el registro de seguimiento está activado y cuánto tiempo se conserva.

Exchange on-prem

Get-MessageTrackingLog (Exchange) Integrado 

Get-MessageTrackingLog -Server mbx01.example.com -WarningAction 0 `
  -Start (Get-Date).AddHours(-48) -End (Get-Date) -ResultSize Unlimited |
  Where-Object { $_.Sender -notmatch "HealthMailbox" } |
  Group-Object EventId -NoElement | Sort-Object Count -Descending

Get-TransportService Integrado 

Get-TransportService | Select-Object Name, MessageTrackingLogEnabled, MessageTrackingLogPath, MessageTrackingLogMaxAge

Exchange Online

Get-ConnectionByClientTypeReport Herramienta adicional 

# EXO hat keine einzelnen Server; die Auswertung laeuft ueber Mandant-Berichte.
Get-MailTrafficATPReport -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) | Format-Table Date, EventType, MessageCount

Por defecto, Exchange conserva los registros de seguimiento 30 días; los incidentes más antiguos ya no se pueden demostrar.

Exportar para tickets

Escribe el resultado como CSV con punto y coma y UTF-8: se abre directamente en Excel y se adjunta a un ticket.

Exchange on-prem

Export-Csv (Exchange) Integrado 

Get-TransportService | Get-MessageTrackingLog -WarningAction 0 -Sender "sender@example.com" `
  -Start (Get-Date).AddHours(-48) -End (Get-Date) -ResultSize Unlimited |
  Where-Object { $_.Sender -notmatch "HealthMailbox" } |
  Select-Object Timestamp, ServerHostname, EventId, Source, Sender,
    @{N="Recipients";E={$_.Recipients -join ";"}}, MessageSubject,
    @{N="Status";E={$_.RecipientStatus -join " "}} |
  Sort-Object Timestamp |
  Export-Csv .\tracking.csv -NoTypeInformation -Encoding UTF8 -Delimiter ";"

grep / awk (Postfix) Integrado 

grep -iE "from=<sender@example.com>" /var/log/mail.log |
  awk '{ print $1" "$2" "$3";"$4";"$6" "$7" "$8 }' > tracking.csv
head -5 tracking.csv

Exchange Online

Export-Csv (Exchange Online) Herramienta adicional 

Get-MessageTraceV2 -SenderAddress "sender@example.com" `
  -StartDate (Get-Date).AddHours(-48) -EndDate (Get-Date) |
  Export-Csv .\trace.csv -NoTypeInformation -Encoding UTF8 -Delimiter ";"

La salida contiene remitente, destinatario y asunto. Compruebe si es aceptable para los destinatarios antes de compartirla.

Otras áreas