Pipeline Tracing in Exchange 2013

Pipeline tracing is one of the best feature which is available from Exchange 2007.

Like in Earlier versions of Exchange prior Exchange 2007 we used Microsoft Tool archive sink which we need to download and install them manually on the Exchange 2003/2000 servers. Also the main disadvantage of using this tool is unlike Exchange 2007/2010 & 2013 we do not have an option to enable it only for a particular affected user. Rather than it enables for the whole Exchange users and finally it fills up the drive space.

In this article we will be looking in working with Pipeline Tracing in Exchange 2013

In Exchange 2007/2010 we used to enable pipeline tracing on Exchange Hub Transport Servers and the Message snapshots are stored in the Hub Servers.

Now in Exchange 2013 where do we enable them? Is it Mailbox or CAS servers?

Answer is we enable them in Mailbox servers. The reason being why is because Microsoft Exchange Transport Service which is running in Mailbox server  is the core component of Categorization and it takes care of the Message categorization where it processes the message in different phases and this is the right place for us to take the Message Snap Shots.

Now we will look into how to enable Pipeline Tracing in Exchange 2013

Pipeline Tracing can be enabled only Via Shell and there is no GUI option available right from Exchange 2007 and it’s continued same in Exchange 2013

1)      Open Exchange Management Shell in Exchange 2013

Type in the below command to enable Pipeline Tracing First,

Set-TransportService Exchange2013 -PipelineTracingEnabled $true

Once we enable the pipeline tracing you will be getting the below warning message. You can safely ignore this alert and proceed with the next step.

Now we need to enable pipeline tracing for the affected user (sender) with below command.

Now we need to enable the pipeline tracing path i.e., the location where to store these message snap shots by running the below command. This step is optional since for the Transport service on a Mailbox server, the default location is %ExchangeInstallPath%TransportRoles\Logs\Hub\PipelineTracing. For the Mailbox Transport service on a Mailbox server, the default location is %ExchangeInstallPath%TransportRoles\Logs\Mailbox\PipelineTracing. If you specify a custom path, the path must be on the local Exchange server.

Run the below command to enable pipeline tracing in a custom pathSet-TransportService Mailbox01 -PipelineTracingPath "D:\Hub\Pipeline Tracing"

After we enable them you get a warning message as above. You can safely ignore them.

Now we have enabled the pipeline tracing.  It’s better to restart the Microsoft Exchange Transport service after you perform above steps.
Now we need to ask the affected user to send an email for the Message snapshots to be recorded. In our case since Sathish is the affected sender (just an example) I’m sending email from Sathish account for recording Message snapshots. 


Once after the email is sent you will see the below folder created with the name Message snapshots and in turn there will be a folder created with some alpha numeric.

When you open this alpha numeric folder you can see the Message transactions as below. Also it has the original eml file for comparing with the message transactions.
                                                                                                                                                                                  

Now we can copy these .eml files in your local machine where you have Outlook installed. 
We need to open each .eml files with outlook and can see in which categorization part the message is removed.