Reviewing the Exchange Mailbox Diagnostics Log

Reviewing the Exchange Mailbox Diagnostics Log

  •  
  •  
  • 1
  •  
  •  
  •  
    1
    Share

A peer of mine today asked if it was possible to review the log of the Managed Folder Assistant, and, if it was, how to find the last time it ran.

As it turns out, you can!  You can also find a whole lot of interesting stuff from the diagnostics perspective.

First things first–we’re going to figure out what it is we’re even looking for.

Exporting the Mailbox Diagnostics Log

There is a quite an expansive list of mailbox diagnostic data that is maintained by Exchange Online.  This diagnostic data is accessed via the aptly-named Export-MailboxDiagnosticsLogs cmdlet.  Data is generated as XML.  To see what kind of stuff we have access to, you can do something like this:

[xml]$Log = (Export-MailboxDiagnosticLogs -Identity <mailbox> -ExtendedProperties).MailboxLog

It won’t return much to the screen.  To see the list of everything that’s stored in the log, simply run:

$Log.Properties.MailboxTable.Property | ft -auto

You’ll see something that looks like this:

Reviewing the Exchange Mailbox Diagnostics Log

This is the whole list of properties stored in the table (sorted alphabetically):

BigFunnelAttributeVectorCommonVersion
BigFunnelAttributeVectorSharePointVersion
BigFunnelCorruptedCount
BigFunnelFiltersCount
BigFunnelFilterTableAvailablePages
BigFunnelFilterTableTotalPages
BigFunnelIsEnabled
BigFunnelLargePOIsCount
BigFunnelLargePOIsSize
BigFunnelLargePOITableAvailablePages
BigFunnelLargePOITableTotalPages
BigFunnelMailboxCreationVersion
BigFunnelMailboxPOIVersion
BigFunnelMailboxSemanticIndexVersion
BigFunnelMaintainRefiners
BigFunnelMasterIndexVersion
BigFunnelNotIndexedCount
BigFunnelPartitionLevelIngestion
BigFunnelPartitionLevelQuery
BigFunnelSemanticSearchEnabled
BigFunnelShouldNotBeIndexedCount
BigFunnelStaleCount
BigFunnelStoreIndexAssistantProcessedVersion
BigFunnelStoreIndexAssistantRequestedVersion
CalendarVersion
ClassificationEnabled
ClassificationReady
ClutterEnabled
CommonViewsEntryId
ComplianceJobAssistantLastSPOAndODBRetentionCPSCallingTime
ComplianceJobAssistantNextProcessingTime
ContainerBehaviorTypeId
ContainsDynamicCrawlerJobs
ContainsScheduledTimers
ContainsSwssItems
ControlDataForBigFunnelRetryFeederTimeBasedAssistant
ControlDataForBigFunnelStoreIndexAssistant
ControlDataForComplianceBoundaryAssistant
ControlDataForComplianceJobAssistant
ControlDataForConferenceRoomUsageAssistant
ControlDataForDataGovernanceAssistant
ControlDataForDataGovernanceMachineLearningAssistant
ControlDataForDlpDarProcessingTimeBasedAssistant
ControlDataForDumpsterExpirationAssistant
ControlDataForDynamicGriffinTba129
ControlDataForDynamicGriffinTba130
ControlDataForDynamicGriffinTba131
ControlDataForDynamicGriffinTba142
ControlDataForDynamicGriffinTba146
ControlDataForDynamicGriffinTba37
ControlDataForDynamicGriffinTba38
ControlDataForDynamicGriffinTba64
ControlDataForDynamicGriffinTba68
ControlDataForDynamicGriffinTba77
ControlDataForDynamicTba14
ControlDataForDynamicTba2
ControlDataForDynamicTba5
ControlDataForDynamicTba6
ControlDataForDynamicTba7
ControlDataForDynamicTba8
ControlDataForFileExtractionTimeBasedAssistant
ControlDataForLastUserActionTimeAssistant
ControlDataForLowLatencyContainerAssistant
ControlDataForMailboxDiscoveryAssistant
ControlDataForMailboxLifecycleAssistant
ControlDataForMailboxTenantDataAssistant
ControlDataForOfficeGraphDumpsterCleanupTimeBasedAssistant
ControlDataForOfficeGraphSecondaryCopyQuotaTimeBasedAssistant
ControlDataForSigsUapFoldersCleanupAssistant
ControlDataForStoreFolderIndexesMaintenanceAssistant
ControlDataForSupervisoryReviewTimeBasedAssistant
ControlDataForSystemCleanupFolderAssistant
CreationTime
CurrentNLSVersion
DatabaseSchemaVersion
DeferredActionFolderEntryId
DeletedItemsEntryId
DeletedMsgCount
DisplayName
DlpIsSpoOdbSiteMailbox
DlpIsSpoOdbSiteMailboxExpiryTimeUtc
DlpMailboxPendingCrawlCount
DlpMailboxRuleHash
DlpMailboxSpoOdbSiteId
DlpMailboxSpoOdbSiteIdStampedTimeUtc
DynamicCrawlersTasksBlob
ExtendedDumpsterSize
ExtendedRuleSizeLimit
ExtendedSize
FastIsEnabled
FileExtractionMaintenanceRequired
FinderEntryId
FocusedOtherInboxEnabled
HasBeenClutterInvited
InferenceOLKUserActivityLoggingEnabled
InferenceTrainedModelVersionBreadCrumb
InferenceUserCapabilityFlags
IsBigFunnelUserMailbox
IsClutterClassificationDisabledByFocusedInbox
IsClutterDisabledByFocusedInbox
IsContentIndexingEnabled
IsFastEnabledForIntializeMailbox
IsFocusedInboxDisabledByClutter
IsMailboxLocalized
ItemAssistantCrawlVersionBlob
ItemCount
ItemCount64
JunkEmailRuleToPicwSyncVersion
JunkEmailSafeListDirty
LastCalendarTimeCurrentValue
LastContactsTimeCurrentValue
LastEmailTimeCurrentValue
LastFileTimeCurrentValue
LastLogonTime
LastProfileTimeCurrentValue
LastTasksTimeCurrentValue
LastUserActionTime
LastUserActionUpdateTime
LastUserActionWorkloadAggregateTime
LCID
LegacyScheduleFolderEntryId
LegacyShortcutsFolderEntryId
LegacyViewsFolderEntryId
LoadBalancingMovesAttemptedCount
LocaleId
LogonRightsOnMailbox
LowLatencyContainerConfigurationHash
MailboxFeatureStorageProperty
MailboxGuid
MailboxMiscFlags
MailboxNumber
MailboxOofState
MailboxTenantSizeEstimate
MailboxType
MailboxTypeDetail
MaxMessageSize
MaxSubmitMessageSize
MCDBMessageTablePercentReplicated
MetaCacheDatabaseLastResetTime
MetaCacheDatabaseLazyIndexesLastBuildTime
MipAutoLabelingMailboxRuleHash
NormalMessageSize64
NotificationBrokerSubscriptions
OfficeGraphDumpsterCleanupLastCrawlVersion
OofScheduleEnd
OofScheduleStart
OutboxEntryId
PeopleRelevanceLastSuccessfulEBARunTime
PeopleRelevanceMailEventCount
PersistableTenantPartitionHint
PerUserTrackingBasedOnImmutableId
ProhibitReceiveQuota
ProhibitSendQuota
PropertyGroupMapping
ResourceUsageLastInteractiveClientTime
ResourceUsageMaxDateTime
ResourceUsageMinDateTime
ResourceUsageRollingAvgDatabaseReads
ResourceUsageRollingAvgPagesDirtied
ResourceUsageRollingAvgRop
ResourceUsageRollingAvgRopAggregate
ResourceUsageRollingClientTypes
ResourceUsageTopEdgeEnvironments
SentItemsEntryId
Size
StorageQuotaLimit
StoreIndexAssistantLastIndexedNlsVersion
SystemMessageCount
SystemMessageSize
SystemMessageSize
SystemMessageSizeShutoffQuotaAuto
TotalPages
UIReady

To quote Ian Malcom:

That is one big pile of shit.

Yes, but what do we do with it?

Generating a Report

Now that you have this, you can look through the properties to find values that would be helpful for determining the last pass of the managed folder assistant.  The values we’re looking for are:

ElcLastSuccessTimeStamp
ElcLastRunDeletedFromRootItemCount

The ElcLastSuccessTimeStamp is only stamped once the managed folder assistant has run.  For Exchange Online, the Managed Folder Assistant only processes mailboxes that are larger than 10mb.

This script will allow you to export the managed folder assistant log details for one or more mailboxes in your organizaiton.

[CmdletBinding()]
param (
[Parameter(Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True, Position = 1)]$Identity,
[string]$OutFile = (Get-Date -Format yyyy-MM-dd) + "_ManagedFolderAssistantReport.csv",
[switch]$ConsoleOutput,
[switch]$IncludeHtmlOutput
)

begin
{
# Check parameters
If ($PSBoundParameters.ContainsKey('Identity') -and $MyInvocation.PipelineLength -eq 1)
{
[object[]]$Identity = Get-Mailbox $Identity
}
Else
{
[object[]]$Identity = Get-Mailbox -ResultSize Unlimited
}
$global:Report = @()

$Total = $Identity.Count
$i = 1 
}

process
{
# Select Mailbox Identity Data
If ($PSBoundParameters.ContainsKey('Identity') -and $MyInvocation.PipelineLength -eq 1)
{
$DisplayName = $Identity.Name
$Alias = $Identity.Alias
$PrimarySmtp = $Identity.PrimarySmtpAddress
}
Else
{
$DisplayName = $_.Name
$Alias = $_.Alias
$PrimarySmtp = $_.PrimarySmtpAddress
}

Write-Progress -Activity "Gathering mailbox diagnostic data" -Percent (($i/$Total) * 100) -CurrentOperation "Processing $($DisplayName)"
$ElcLastSuccessTimeStamp = $null
$ElcLastRunDeletedFromRootItemCount = $null
[xml]$MailboxLog = (Export-MailboxDiagnosticLogs -Identity $Identity.Alias -ExtendedProperties).MailboxLog
$ElcLastSuccessTimeStamp = ($MailboxLog.Properties.MailboxTable.Property | ? { $_.Name -like "*ElcLastSuccessTimeStamp*" }).Value
$ElcLastRunDeletedFromRootItemCount = ($MailboxLog.Properties.MailboxTable.Property | ? { $_.Name -like "*ElcLastRunDeletedFromRootItemCount*" }).Value
If ($ElcLastSuccessTimeStamp -eq $null) { $ElcLastSuccessTimeStamp = "Never run" }
If ($ElcLastRunDeletedFromRootItemCount -eq $null) { $ElcLastRunDeletedFromRootItemCount = "N/A" }
$Entry = [PSCustomObject]@{
User = $DisplayName
LastProcessed = $ElcLastSuccessTimeStamp
ItemsProcessed = $ElcLastRunDeletedFromRootItemCount
}
$global:Report += $Entry
If ($ConsoleOutput) { $Entry }
$i++
}

end
{
$Report | Export-Csv -NoTypeInformation $OutFile
If ($IncludeHtmlOutput) { $Report | ConvertTo-Html | Out-File $($Outfile).Replace(".csv","html.")}
Write-Host "To review the report in the console, type `$Report and press return."
}

You can also get the script at the PowerShell Gallery: https://www.powershellgallery.com/packages/Get-ManagedFolderAssistantReport/.

Happy reporting!

Published by Aaron Guilmette

Helping companies conquer inferior technology since 1997. I spend my time developing and implementing technology solutions so people can spend less time with technology. Specialties: Active Directory and Exchange consulting and deployment, Virtualization, Disaster Recovery, Office 365, datacenter migration/consolidation, cheese.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.