Rafael Pfister

Tracciamento messaggi

Cercare nel log di tracciamento e documentare il percorso di consegna: Exchange on-prem, Exchange Online e Postfix.

Cercare per mittente e destinatario

La ricerca standard: tutti gli eventi di una coppia mittente/destinatario nel periodo scelto, in ordine cronologico.

Letzte 48 Stunden

Exchange on-prem

Get-MessageTrackingLog (Exchange) Integrato 

Get-TransportService | Get-MessageTrackingLog -WarningAction 0 `
  -Sender "sender@example.com" -Recipients "empfaenger@example.com" `
  -Start (Get-Date).AddHours(-48) -End (Get-Date) -ResultSize Unlimited |
  Where-Object { $_.Sender -notmatch "HealthMailbox" -and $_.Recipients -notmatch "Health" } |
  Sort-Object Timestamp |
  Format-Table Timestamp, EventId, Source, Sender, @{N="Recipients";E={$_.Recipients -join ","}}, MessageSubject -AutoSize

journalctl / grep (Postfix) Integrato 

journalctl -u postfix --since "48 hours ago" | grep -iE "from=<sender@example.com>|to=<empfaenger@example.com>" | tail -40
# Ohne systemd-Journal direkt im Log, dann aber ohne Zeitfilter:
grep -iE "from=<sender@example.com>|to=<empfaenger@example.com>" /var/log/mail.log | tail -40

Exchange Online

Get-MessageTraceV2 Strumento aggiuntivo 

Connect-ExchangeOnline
Get-MessageTraceV2 -SenderAddress "sender@example.com" -RecipientAddress "empfaenger@example.com" `
  -StartDate (Get-Date).AddHours(-48) -EndDate (Get-Date) |
  Sort-Object Received |
  Format-Table Received, SenderAddress, RecipientAddress, Subject, Status -AutoSize

Get-MessageTrace (alt) Strumento aggiuntivo 

# Vor der Umstellung auf V2; identische Parameter, kleinere Ergebnisgrenzen.
Get-MessageTrace -SenderAddress "sender@example.com" -RecipientAddress "empfaenger@example.com" `
  -StartDate (Get-Date).AddHours(-48) -EndDate (Get-Date)

Fenster am Vormittag

Exchange on-prem

Get-MessageTrackingLog (Exchange) Integrato 

Get-TransportService | Get-MessageTrackingLog -WarningAction 0 `
  -Sender "sender@example.com" -Recipients "empfaenger@example.com" `
  -Start (Get-Date "2026-08-09 08:00") -End (Get-Date "2026-08-09 12:00") -ResultSize Unlimited |
  Where-Object { $_.Sender -notmatch "HealthMailbox" -and $_.Recipients -notmatch "Health" } |
  Sort-Object Timestamp |
  Format-Table Timestamp, EventId, Source, Sender, @{N="Recipients";E={$_.Recipients -join ","}}, MessageSubject -AutoSize

journalctl / grep (Postfix) Integrato 

journalctl -u postfix --since "2026-08-09 08:00" --until "2026-08-09 12:00" | grep -iE "from=<sender@example.com>|to=<empfaenger@example.com>" | tail -40
# Ohne systemd-Journal direkt im Log, dann aber ohne Zeitfilter:
grep -iE "from=<sender@example.com>|to=<empfaenger@example.com>" /var/log/mail.log | tail -40

Exchange Online

Get-MessageTraceV2 Strumento aggiuntivo 

Connect-ExchangeOnline
Get-MessageTraceV2 -SenderAddress "sender@example.com" -RecipientAddress "empfaenger@example.com" `
  -StartDate (Get-Date "2026-08-09 08:00") -EndDate (Get-Date "2026-08-09 12:00") |
  Sort-Object Received |
  Format-Table Received, SenderAddress, RecipientAddress, Subject, Status -AutoSize

Get-MessageTrace (alt) Strumento aggiuntivo 

# Vor der Umstellung auf V2; identische Parameter, kleinere Ergebnisgrenzen.
Get-MessageTrace -SenderAddress "sender@example.com" -RecipientAddress "empfaenger@example.com" `
  -StartDate (Get-Date "2026-08-09 08:00") -EndDate (Get-Date "2026-08-09 12:00")

I due campi data definiscono l'intervallo al minuto; se vuoti, il comando usa le ultime 48 ore. Get-TransportService interroga tutti i server di trasporto, non solo quello locale. Le righe HealthMailbox (messaggi di monitoraggio di Microsoft) vengono filtrate, altrimenti i risultati reali vi si perdono. Exchange Online richiede il modulo ExchangeOnlineManagement; lì Get-MessageTraceV2 ha sostituito Get-MessageTrace.

Cercare per oggetto

Trova messaggi in base a una parte dell'oggetto: la via abituale quando l'utente sa dire solo "la mia fattura di ieri".

Exchange on-prem

Get-MessageTrackingLog (Exchange) Integrato 

Get-TransportService | Get-MessageTrackingLog -WarningAction 0 `
  -MessageSubject "Rechnung" `
  -Start (Get-Date).AddHours(-48) -End (Get-Date) -ResultSize Unlimited |
  Where-Object { $_.Sender -notmatch "HealthMailbox" } |
  Sort-Object Timestamp |
  Format-Table Timestamp, EventId, Sender, @{N="Recipients";E={$_.Recipients -join ","}}, MessageSubject -AutoSize

journalctl / grep (Postfix) Integrato 

journalctl -u postfix --since "48 hours ago" | grep -i "Rechnung" | tail -40
grep -i "Rechnung" /var/log/mail.log | tail -40

Exchange Online

Get-MessageTraceV2 Strumento aggiuntivo 

# V2 kennt keinen Betreff-Parameter, darum nachträglich filtern.
Get-MessageTraceV2 -StartDate (Get-Date).AddHours(-48) -EndDate (Get-Date) |
  Where-Object { $_.Subject -like "*Rechnung*" } |
  Format-Table Received, SenderAddress, RecipientAddress, Subject, Status -AutoSize

On-prem, -MessageSubject cerca una sottostringa. In Exchange Online il comando filtra a posteriori, perché Get-MessageTraceV2 non ha un parametro per l'oggetto.

Tracciare un messaggio

Mostra tutte le tappe di un messaggio specifico tramite il suo Message-ID, su tutti i server di trasporto.

Message-ID aus dem Kopf

Exchange on-prem

Get-MessageTrackingLog (Exchange) Integrato 

Get-TransportService | Get-MessageTrackingLog -WarningAction 0 `
  -MessageId "<a1b2c3@example.com>" `
  -Start (Get-Date).AddHours(-48) -End (Get-Date) -ResultSize Unlimited |
  Sort-Object Timestamp |
  Format-Table Timestamp, ServerHostname, EventId, Source, SourceContext, @{N="Recipients";E={$_.Recipients -join ","}} -AutoSize

grep (Postfix) Integrato 

qid=$(grep -F "<a1b2c3@example.com>" /var/log/mail.log | grep -oE "[A-F0-9]{8,}" | head -1)
echo "Queue-ID: $qid"
grep "$qid" /var/log/mail.log

Exchange Online

Get-MessageTraceV2 Strumento aggiuntivo 

Get-MessageTraceV2 -MessageId "<a1b2c3@example.com>" `
  -StartDate (Get-Date).AddHours(-48) -EndDate (Get-Date) |
  Format-List Received, SenderAddress, RecipientAddress, Subject, Status, MessageTraceId

Il Message-ID si trova nell'header del messaggio (il nostro analizzatore di header e-mail lo mostra). Riportate le parentesi angolari esattamente come nell'header.

Percorso di consegna con scarto temporale

Il percorso di consegna come catena con i secondi trascorsi dal primo evento: mostra quale tappa ha perso tempo.

Exchange on-prem

Get-MessageTrackingLog (Exchange) Integrato 

$log = Get-TransportService | Get-MessageTrackingLog -WarningAction 0 `
  -MessageId "<a1b2c3@example.com>" -Start (Get-Date).AddHours(-48) -End (Get-Date) -ResultSize Unlimited |
  Sort-Object Timestamp
$first = $log[0].Timestamp
$log | Select-Object @{N="+Sek";E={[math]::Round(($_.Timestamp - $first).TotalSeconds,1)}},
  Timestamp, ServerHostname, EventId, Source, @{N="Detail";E={$_.RecipientStatus -join " "}} |
  Format-Table -AutoSize
# Kette: RECEIVE -> SUBMIT -> TRANSFER -> SEND (nach aussen) bzw. DELIVER (ins Postfach).

grep / awk (Postfix) Integrato 

qid=$(grep -F "<a1b2c3@example.com>" /var/log/mail.log | grep -oE "[A-F0-9]{8,}" | head -1)
grep "$qid" /var/log/mail.log | awk '{ print $1, $2, $3, $6, $7, $8, $9, $10 }'

Exchange Online

Get-MessageTraceDetailV2 Strumento aggiuntivo 

$m = Get-MessageTraceV2 -MessageId "<a1b2c3@example.com>" -StartDate (Get-Date).AddHours(-48) -EndDate (Get-Date)
$m | ForEach-Object {
  Get-MessageTraceDetailV2 -MessageTraceId $_.MessageTraceId -RecipientAddress $_.RecipientAddress |
    Format-Table Date, Event, Action, Detail -AutoSize
}

La catena di EventId si legge RECEIVE, SUBMIT, TRANSFER e infine SEND (in uscita) o DELIVER (nella casella). FAIL o DEFER segnano il punto di rottura.

Consegne non riuscite

Raggruppa gli eventi FAIL per motivo, i più frequenti in cima: trova lo schema dietro un'interruzione invece dei singoli casi.

Letzte 48 Stunden

Exchange on-prem

Get-MessageTrackingLog (Exchange) Integrato 

Get-TransportService | Get-MessageTrackingLog -WarningAction 0 -EventId FAIL `
  -Start (Get-Date).AddHours(-48) -End (Get-Date) -ResultSize Unlimited |
  Where-Object { $_.Sender -notmatch "HealthMailbox" } |
  Group-Object { $_.RecipientStatus -join " " } -NoElement |
  Sort-Object Count -Descending | Select-Object -First 15 Count, Name

grep (Postfix) Integrato 

grep "status=bounced" /var/log/mail.log |
  grep -oE "said: [0-9]{3}[ -][0-9.]* [^)]*" | sort | uniq -c | sort -rn | head -15

Exchange Online

Get-MessageTraceV2 Strumento aggiuntivo 

Get-MessageTraceV2 -Status Failed -StartDate (Get-Date).AddHours(-48) -EndDate (Get-Date) |
  Group-Object RecipientAddress -NoElement | Sort-Object Count -Descending | Select-Object -First 15

Trovare le consegne lente

Calcola per ogni messaggio il tempo tra ricezione e consegna e mostra i più lenti: la risposta documentata a "la posta è così lenta".

Exchange on-prem

Get-MessageTrackingLog (Exchange) Integrato 

$log = Get-TransportService | Get-MessageTrackingLog -WarningAction 0 `
  -Start (Get-Date).AddHours(-48) -End (Get-Date) -ResultSize Unlimited |
  Where-Object { $_.Sender -notmatch "HealthMailbox" }
$log | Group-Object MessageId | ForEach-Object {
  $recv = ($_.Group | Where-Object EventId -eq "RECEIVE" | Sort-Object Timestamp | Select-Object -First 1).Timestamp
  $done = ($_.Group | Where-Object { $_.EventId -in "DELIVER", "SEND" } | Sort-Object Timestamp | Select-Object -Last 1).Timestamp
  if ($recv -and $done) {
    [pscustomobject]@{ Sekunden = [math]::Round(($done - $recv).TotalSeconds, 1); Betreff = $_.Group[0].MessageSubject }
  }
} | Sort-Object Sekunden -Descending | Select-Object -First 15

grep (Postfix) Integrato 

grep -oE "delay=[0-9.]+" /var/log/mail.log | cut -d= -f2 | sort -rn | head -15
# delay = Gesamtzeit von der Annahme bis zur Zustellung in Sekunden.

Exchange Online

Get-MessageTraceV2 Strumento aggiuntivo 

# EXO liefert keine Laufzeit je Nachricht; die Detailansicht zeigt die Stationen mit Zeitstempel.
Get-MessageTraceV2 -StartDate (Get-Date).AddHours(-48) -EndDate (Get-Date) |
  Sort-Object Received -Descending | Select-Object -First 25 Received, SenderAddress, RecipientAddress, Subject, Status

Principali mittenti e destinatari

Conta il volume per mittente e destinatario: utile per questioni di carico e quando si sospetta che una casella sia compromessa.

Exchange on-prem

Get-MessageTrackingLog (Exchange) Integrato 

$log = Get-TransportService | Get-MessageTrackingLog -WarningAction 0 -EventId RECEIVE `
  -Start (Get-Date).AddHours(-48) -End (Get-Date) -ResultSize Unlimited |
  Where-Object { $_.Sender -notmatch "HealthMailbox" }
"--- Top-Absender ---"
$log | Group-Object Sender -NoElement | Sort-Object Count -Descending | Select-Object -First 10
"--- Top-Empfaenger ---"
$log | ForEach-Object { $_.Recipients } | Group-Object -NoElement | Sort-Object Count -Descending | Select-Object -First 10

grep (Postfix) Integrato 

grep -oE "from=<[^>]+>" /var/log/mail.log | sort | uniq -c | sort -rn | head -10
grep -oE "to=<[^>]+>" /var/log/mail.log | sort | uniq -c | sort -rn | head -10

Exchange Online

Get-MessageTraceV2 Strumento aggiuntivo 

$t = Get-MessageTraceV2 -StartDate (Get-Date).AddHours(-48) -EndDate (Get-Date)
"--- Top-Absender ---"
$t | Group-Object SenderAddress -NoElement | Sort-Object Count -Descending | Select-Object -First 10
"--- Top-Empfaenger ---"
$t | Group-Object RecipientAddress -NoElement | Sort-Object Count -Descending | Select-Object -First 10

Filtrare per EventId

Mostra tutti gli eventi di un tipo, ad esempio solo FAIL, DEFER o DELIVER.

Exchange on-prem

Get-MessageTrackingLog (Exchange) Integrato 

Get-TransportService | Get-MessageTrackingLog -WarningAction 0 -EventId FAIL `
  -Start (Get-Date).AddHours(-48) -End (Get-Date) -ResultSize Unlimited |
  Sort-Object Timestamp |
  Format-Table Timestamp, ServerHostname, Sender, @{N="Recipients";E={$_.Recipients -join ","}}, MessageSubject -AutoSize
# Gaengige EventIds: RECEIVE SEND DELIVER FAIL DEFER RESOLVE EXPAND REDIRECT DROP SUBMIT TRANSFER

grep (Postfix) Integrato 

grep -oE "status=[a-z]+" /var/log/mail.log | sort | uniq -c | sort -rn

Exchange Online

Get-MessageTraceV2 Strumento aggiuntivo 

# EXO kennt keine EventIds, sondern einen Status:
# Delivered, Failed, Pending, Quarantined, FilteredAsSpam, Expanded
Get-MessageTraceV2 -Status Failed -StartDate (Get-Date).AddHours(-48) -EndDate (Get-Date) |
  Format-Table Received, SenderAddress, RecipientAddress, Subject, Status -AutoSize

Exchange Online non ha EventId ma uno stato (Delivered, Failed, Pending, Quarantined, FilteredAsSpam).

Panoramica del server

Conta gli eventi di un server per tipo e mostra se il log di tracciamento è attivo e per quanto tempo viene conservato.

Exchange on-prem

Get-MessageTrackingLog (Exchange) Integrato 

Get-MessageTrackingLog -Server mbx01.example.com -WarningAction 0 `
  -Start (Get-Date).AddHours(-48) -End (Get-Date) -ResultSize Unlimited |
  Where-Object { $_.Sender -notmatch "HealthMailbox" } |
  Group-Object EventId -NoElement | Sort-Object Count -Descending

Get-TransportService Integrato 

Get-TransportService | Select-Object Name, MessageTrackingLogEnabled, MessageTrackingLogPath, MessageTrackingLogMaxAge

Exchange Online

Get-ConnectionByClientTypeReport Strumento aggiuntivo 

# EXO hat keine einzelnen Server; die Auswertung laeuft ueber Mandant-Berichte.
Get-MailTrafficATPReport -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) | Format-Table Date, EventType, MessageCount

Per impostazione predefinita Exchange conserva i log di tracciamento per 30 giorni; gli incidenti più vecchi non si possono più documentare.

Esportare per i ticket

Scrive il risultato come CSV con punto e virgola e UTF-8: si apre direttamente in Excel e si allega a un ticket.

Exchange on-prem

Export-Csv (Exchange) Integrato 

Get-TransportService | Get-MessageTrackingLog -WarningAction 0 -Sender "sender@example.com" `
  -Start (Get-Date).AddHours(-48) -End (Get-Date) -ResultSize Unlimited |
  Where-Object { $_.Sender -notmatch "HealthMailbox" } |
  Select-Object Timestamp, ServerHostname, EventId, Source, Sender,
    @{N="Recipients";E={$_.Recipients -join ";"}}, MessageSubject,
    @{N="Status";E={$_.RecipientStatus -join " "}} |
  Sort-Object Timestamp |
  Export-Csv .\tracking.csv -NoTypeInformation -Encoding UTF8 -Delimiter ";"

grep / awk (Postfix) Integrato 

grep -iE "from=<sender@example.com>" /var/log/mail.log |
  awk '{ print $1" "$2" "$3";"$4";"$6" "$7" "$8 }' > tracking.csv
head -5 tracking.csv

Exchange Online

Export-Csv (Exchange Online) Strumento aggiuntivo 

Get-MessageTraceV2 -SenderAddress "sender@example.com" `
  -StartDate (Get-Date).AddHours(-48) -EndDate (Get-Date) |
  Export-Csv .\trace.csv -NoTypeInformation -Encoding UTF8 -Delimiter ";"

L'output contiene mittente, destinatario e oggetto. Verificate che sia accettabile per i destinatari prima di condividerlo.

Altre aree