Exchange 2013: 'Get-AgentLog' Throws Exception When Run From The Front End
During the investigation of a not-so-recent case, it was discovered that Get-AgentLog - when run from a Front-End server - will throw an exception. What occurs is that when you attempt to run the command from EMS, you receive a notice about an exception and that a Watson dump is being generated; however, no Watson dump can be found on the server and there are no events in the Application or Crimson Logs:
Get-AgentLog -TransportService FrontEnd -StartDate ([System.DateTime]::Now).AddDays(-4) -EndDate ([System.DateTime]::Now)
WARNING: An unexpected error has occurred and a Watson dump is being generated: Index (zero based) must be greater than or equal to zero and less than the size of the argument list.
Specified cast is not valid.
+ CategoryInfo : NotSpecified: (:) [Get-AgentLog], InvalidCastException
+ FullyQualifiedErrorId : System.InvalidCastException,Microsoft.Exchange.Management.AgentLog.GetAgentLog
+ PSComputerName : <Server>
If you attempt to specify the location, you receive an error that the location cannot be found (note the fully qualified error):
VERBOSE: Connecting to <Server>
VERBOSE: Connected to <Server>.
Get-AgentLog -TransportService FrontEnd -StartDate ([System.DateTime]::Now).AddDays(-4) -EndDate ([System.DateTime]::Now) -Location "C:\exchsrvr\TransportRoles\Logs\FrontEnd\AgentLog\"
The location "C:\exchsrvr\TransportRoles\Logs\FrontEnd\AgentLog" does not exist. Please specify a valid file or directory to look for agent logs using the -Location parameter.
Parameter name: Location
+ CategoryInfo : InvalidArgument: (:) [Get-AgentLog], ArgumentException
+ FullyQualifiedErrorId : [Server=<Server2>,RequestId=5b8d0c5b-6b0b-4b7d-ad94-008aab18485c,TimeStamp=11/27/2013 11:15:48 PM] 97084C54,Microsoft.Exchange.Management.AgentLog.GetAgentLog
+ PSComputerName : <Server>
In the stack, you would see that the exception is a CLR exception, due to a conversion:
KERNELBASE!RaiseException+0x39
clr!RaiseTheExceptionInternalOnly+0x28b
clr!IL_Throw+0xe3
System_Management_Automation_ni!System.Management.Automation.LanguagePrimitives.ConvertStringToType(System.Object, System.Type, Boolean, System.Management.Automation.PSObject, System.IFormatProvider, System.Management.Automation.Runspaces.TypeTable)+0x126e67e
_message:00000000054d6638 (System.String) Length=89, String="Cannot convert the "switchAttribute" value of type "System.String" to type "System.Type"."
_HResult:0x80004002 (System.Int32)
errorId:0000000002d09190 (System.String) Length=27, String="InvalidCastFromStringToType"
The cause: In Exchange 2013, commands are proxied from the Frontend Server (CAS) to a Backend Server (Mailbox). This is the reason that Server2 shows up in the Fully Qualified Error, when the command is run from Server.
The work-around is to open Windows PowerShell and add the PSSnapin (this bypasses command proxying). Then, you will receive the necessary output, sans any exceptions occurring.
Get-AgentLog -TransportService FrontEnd -StartDate ([System.DateTime]::Now).AddDays(-30) -EndDate ([System.DateTime]::Now) | FT -AutoSize
Timestamp SessionId IPAddress MessageId P1FromAddress P2FromAddresses Recipients Agent Event Action
--------- --------- --------- --------- ------------- --------------- ---------- ----- ----- ------
11/21/2013 8:47:25 PM 08D0B544432ACF98 <Redacted> <Redacted> <Redacted> <Redacted> Inbound Trust Agent OnEndOfHeaders ModifyHeaders
11/21/2013 8:47:25 PM 08D0B544432ACF98 <Redacted> <Redacted> <Redacted> <Redacted> Inbound Trust Agent OnEndOfHeaders ModifyHeaders
11/21/2013 8:48:27 PM 08D0B544432ACF9A <Redacted> <Redacted> <Redacted> <Redacted> Inbound Trust Agent OnEndOfHeaders ModifyHeaders
11/21/2013 8:48:27 PM 08D0B544432ACF9A <Redacted> <Redacted> <Redacted> <Redacted> Inbound Trust Agent OnEndOfHeaders ModifyHeaders
You can read more about this at these sites: