Quick and Dirty Reporting on Distribution List Usage

I was given a list of 50 distribution lists, and asked to report on how often they were used. Time to hit the tracking logs. And we have two hub servers, so I have to query against both servers to get the whole list. Here's what I came up with. For this example, we'll work with 5 distribution lists. I don't want to type in all 50.

# create an array containing the distribution list addresses
$recipients = "list1@sample.com", "list2@sample.com", "list3@sample.com"
$recipients += "list4@sample.com", "list5@sample.com"


# create an array containing our hub servers
$servers = "hubserver1", "hubserver2"


# set the start and end date of the query
$startdate = "2/1/12 12:00 AM"
$enddate = "2/2/12 12:00 AM"


foreach ($recipient in $recipients) {
     $results = @()
     foreach ($server in $servers) {
          $results += Get-MessageTrackingLog -Server $server -Start $startdate -End $enddate -Recipients $recipient -EventId RECEIVE
     }
     Write-Host "$recipient," $results.count    # outputs the distribution list address and the hit count
     Remove-Item variable:results     # delete the results
}

The output is a simple:

list1@sample.com, 12

list2@sample.com, 2

list3@sample.com, 27

list4@sample.com, 423

list5@sample.com, 1

If you need to see the individual message data, just change the code to remove the $results array, like this:

foreach ($recipient in $recipients) {
     foreach ($server in $servers) {
          Get-MessageTrackingLog -Server $server -Start $startdate -End $enddate -Recipients $recipient -EventId RECEIVE
     }
}

Of course, your results are based on the number of tracking logs you have available. Exchange 2010 automatically purges tracking logs based on the settings of the transport server configuration, which defaults to 30 days. If you have enough disk space, you can modify the retention period with the Set-TransportServer command. See this article for more information on configuring message tracking.