In December last year I updated a number of message tracking settings (Get-mailboxserver ServerX | fl messagetracking*).
Currently these are set as follows:
MessageTrackingLogEnabled : True
MessageTrackingLogMaxAge : 120.00:00:00
MessageTrackingLogMaxDirectorySize : 5 GB (5,368,709,120 bytes)
MessageTrackingLogMaxFileSize : 4 GB (4,294,967,296 bytes)
MessageTrackingLogPath : C:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs\MessageTracking
MessageTrackingLogSubjectLoggingEnabled : True
The problem I have is that these were successfully updated and applied in December. When I ran a search of recent
logs, no data was returned. When I checked the path of the logs I couldn’t see new logs being generated. When I ran
the “Get-mailboxserver ServerX | fl messagetracking*” command the settings had reverted to their default ones.
With this in mind I sent myself the export of the administration log to see who has changed these settings. Here I can
see entries like the one outlined below that shows me making the change.
<Event Caller="Domain/user.name" Cmdlet="Set-TransportServer" ObjectModified=" ServerX " RunDate="2012-12-21T16:31:10+00:00" Succeeded="true" Error="None" OriginatingServer="ServerX">
- <CmdletParameters>
<Parameter Name="Identity" Value="ServerX" />
<Parameter Name="MessageTrackingLogMaxFileSize" Value="4 GB (4,294,967,296 bytes)" />
</CmdletParameters>
- <ModifiedProperties>
I can see a second round of entries again where I made the change yesterday – but that’s all. No other account has made the change that is recorded in the administration log.
The only other changes I am aware of between these two dates are:
Install and uninstall of McAfee ScanMail and the installation of this hotfix KB2497453.
I have tried to find the associated registry keys for these settings:
MessageTrackingLogMaxAge
MessageTrackingLogMaxDirectorySize
MessageTrackingLogMaxFileSize
As we have Quest ChangeAuditor and I may be able to get more information from that. Has anyone seen this before? Does anyone know what the associated registry keys will be? Has anyone seen this issue with an uninstall of McAfee?