Message Trace, the PowerShell WayAndrew StobartDecember 16, 20140From my experience, a very small number of people actually choose PowerShell over the GUI (Graphical User Interface, ie. The Office 365 Portal). But once you get a grasp of PowerShell and write some scripts, youll see the light and going back to your old ways will be very hard. PowerShell has two big advantages. First, once you are proficient youll be able to pull and modify data much faster with PowerShell than going into the portal. Second, most managers arent PowerShell experts, so when you are working and have your PowerShell window open they will be extra impressed with you! Dont worry, you can thank me later.In this article Im going to focus on using PowerShell to obtain message trace results from the past 48 hours. The commands in this article will work for date ranges up to seven days in the past. For messages older than seven days we need to run an extended message trace, or Start-HistoricalSearch.Typical message trace runLets start by running a typical message trace in EOP which returns all results for the past 48 hours. In this view we can sort based on the columns presented to us and can double click for additional information. Now lets look at how PowerShell can improve upon this experience.Message trace using PowerShellYoull see below that Im going to be piping my results to Out-GridView. If you have not used this cmdlet before, it essentially will launch a new interactive window where you can view the results. Lets take a look.The following script will return the message trace results of the last 48 hours.$dateEnd = get-date $dateStart = $dateEnd.AddHours(-48)Get-MessageTrace -StartDate $dateStart -EndDate $dateEnd | Select-Object Received, SenderAddress, RecipientAddress, Subject, Status, ToIP, FromIP, Size, MessageID, MessageTraceID | Out-GridView Here is what the results look like. Just like with the portal message trace, we can sort by clicking the column headers. Moving onto the differences, the first difference youll notice here is that there are more columns presented to us, and even nicer is that we can sort and filter on these extra columns which is something you cant do in the portal message trace. For example, in the above screenshot, I have set a filter to only show me the messages that were larger than 12 MB, something that is not possible with the portal based message trace. Yes... now we are seeing some of the power!Next lets look for messages from the past 48 hours that have a Status of Failed. Here is our script.$dateEnd = get-date $dateStart = $dateEnd.AddHours(-48)Get-MessageTrace -StartDate $dateStart -EndDate $dateEnd | Select-Object Received, SenderAddress, RecipientAddress, Subject, Status, ToIP, FromIP, Size, MessageID, MessageTraceID | Where {$_.Status -eq "Failed"} | Out-GridViewThis shows that we have five failed messages from the last 48 hours. Now lets pipe our results to Get-MessageTraceDetail to find out more information on the failed messages. Heres our next script to do this.$dateEnd = get-date $dateStart = $dateEnd.AddHours(-48)Get-MessageTrace -StartDate $dateStart -EndDate $dateEnd | Where {$_.Status -eq "Failed"} | Get-MessageTraceDetail | Select-Object MessageID, Date, Event, Action, Detail, Data |