SOLVED

New Message Trace is very slow

%3CLINGO-SUB%20id%3D%22lingo-sub-197427%22%20slang%3D%22en-US%22%3ENew%20Message%20Trace%20is%20very%20slow%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-197427%22%20slang%3D%22en-US%22%3E%3CP%3EI%20tried%20using%20the%20new%20Message%20Trace%20in%20the%20Office%20365%20admin%20portal%20and%20I%20still%20haven't%20received%20my%20report%201%20hour%20after%20creating%20my%20search.%20Previously%20the%20message%20trace%20was%20instantaneous%2C%20I%20would%20see%20the%20results%20of%20my%20search%20immediately%20after%20clicking%20'search'.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ENow%20with%20the%20new%20Message%20Trace%2C%20I%20am%20informed%20that%20I%20will%20receive%20an%20email%20when%20my%20report%20is%20ready.%20I%20waited%20over%20an%20hour%20and%20I%20have%20not%20received%20any%20email.%20I%20use%20message%20traces%20often%20to%20troubleshoot%20email%20issues%20and%20it%20is%20an%20important%20feature%20for%20me.%20Having%20a%20long%20delay%20before%20viewing%20the%20results%20is%20quite%20inconvenient.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20this%20behavior%20normal%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-197427%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAdmin%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EExchange%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-327521%22%20slang%3D%22en-US%22%3ERe%3A%20New%20Message%20Trace%20is%20very%20slow%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-327521%22%20slang%3D%22en-US%22%3E%3CP%3EThis%20is%20exactly%20the%20method%20I'm%20referring%20to%20above.%20Where%2FWhere-Object%20is%20a%20client-side%20operation%2C%20meaning%20that%20you%20need%20to%20fetch%20all%20the%20message%20trace%20events%20first%20before%20you%20can%20apply%20the%20filter.%20At%20which%20point%20you%20might%20as%20well%20just%20export%20them%20to%20CSV%20and%20filter%2Fsearch%20via%20Excel.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-327502%22%20slang%3D%22en-US%22%3ERe%3A%20New%20Message%20Trace%20is%20very%20slow%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-327502%22%20slang%3D%22en-US%22%3E%3CP%3EI%20disagree.%20There%20is%20a%20way%20to%20do%20a%20message%20trace%20by%20subject%2C%20but%20it%20is%20only%20possible%20using%20one%20word.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHere%20is%20just%20one%20example.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fblogs.technet.microsoft.com%2Fpraveenkumar%2F2015%2F08%2F12%2Fmessage-tracking-by-subject%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fblogs.technet.microsoft.com%2Fpraveenkumar%2F2015%2F08%2F12%2Fmessage-tracking-by-subject%2F%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-327495%22%20slang%3D%22en-US%22%3ERe%3A%20New%20Message%20Trace%20is%20very%20slow%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-327495%22%20slang%3D%22en-US%22%3E%3CP%3EThere%20is%20no%20way%20to%20run%20a%20search%20based%20on%20subject%2C%20period.%20Doesn't%20matter%20if%20it's%20a%20single%20session%2C%26nbsp%3Ba%20single%20word%2C%20a%20phrase%20-%20it's%20simply%20not%20possible.%20The%20only%20way%20would%20be%20to%20run%20a%20%22full%22%20message%20trace%2C%20get%20all%20the%20events%20for%20the%20period%20in%20question%2C%20then%20filter%20them%20in%20PowerShell%20or%20Excel%20or%20whatever.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-327354%22%20slang%3D%22en-US%22%3ERe%3A%20New%20Message%20Trace%20is%20very%20slow%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-327354%22%20slang%3D%22en-US%22%3E%3CP%3EHello%2C%20I%20had%20(2)%20questions.%20Are%20you%20saying%20that%20the%20answer%20to%20both%20of%20my%20questions%20is%20no%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ENo%2C%20it%20is%20not%20possible%20to%20run%20(2)%20different%20power%20shell%20sessions%20searching%20by%20subject%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Eand%20No%2C%20it%20is%20not%20possible%20to%20run%20a%20message%20trace%20by%20subject%20using%20more%20than%20one%20word%20as%20the%20search%20criteria%3F%26nbsp%3B%20%26nbsp%3BThe%20idea%20is%20to%20run%20a%20message%20trace%20by%20subject%20with%20includes%20the%20entire%20subject%20line%20of%20an%20email.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-327051%22%20slang%3D%22en-US%22%3ERe%3A%20New%20Message%20Trace%20is%20very%20slow%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-327051%22%20slang%3D%22en-US%22%3E%3CP%3ESubject-based%20searches%20are%20not%20possible.%20The%20only%20way%20to%20make%20this%20work%20is%20to%20fetch%20all%20events%2C%20then%20filter%20them%20client-side.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-326944%22%20slang%3D%22en-US%22%3ERe%3A%20New%20Message%20Trace%20is%20very%20slow%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-326944%22%20slang%3D%22en-US%22%3E%3CP%3EHello%2C%20Is%20it%20possible%20to%20run%20(2)%20simultaneous%20message%20traces%20by%20subject%20from%20powershell%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20it%20possible%20to%20do%20a%20message%20trace%20by%20subject%20for%20more%20than%20one%20word%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-198337%22%20slang%3D%22en-US%22%3ERe%3A%20New%20Message%20Trace%20is%20very%20slow%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-198337%22%20slang%3D%22en-US%22%3E%3CP%3EHello%20Jason%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20should%20help%20you%20get%20started%20with%20the%20powershell%20access%20to%20message%20tracing%20from%20O365%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fpowershell%2Fmodule%2Fexchange%2Fmail-flow%2Fget-messagetrace%3Fview%3Dexchange-ps%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fpowershell%2Fmodule%2Fexchange%2Fmail-flow%2Fget-messagetrace%3Fview%3Dexchange-ps%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-198335%22%20slang%3D%22en-US%22%3ERe%3A%20New%20Message%20Trace%20is%20very%20slow%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-198335%22%20slang%3D%22en-US%22%3EI%20was%20not%20aware%20that%20I%20could%20use%20Powershell%2C%20thanks!%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-198334%22%20slang%3D%22en-US%22%3ERe%3A%20New%20Message%20Trace%20is%20very%20slow%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-198334%22%20slang%3D%22en-US%22%3E%3CP%3EHello%20Jason%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIt%20is%20also%20possible%20to%20get%20message%20trace%20results%20promptly%20when%20done%20using%20PowerShell%20against%20Office%20365.%3C%2FP%3E%3CP%3EWe%20resort%20to%20this%20method%20to%20find%20out%20the%20required%20traces%20just%20in%20summary%20and%20not%20the%20detailed%20report%20of%20everything%20available.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20is%20just%20an%20alternate%20if%20you%20are%20comfortable%20using%20PowerShell%20with%20O365.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-198321%22%20slang%3D%22en-US%22%3ERe%3A%20New%20Message%20Trace%20is%20very%20slow%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-198321%22%20slang%3D%22en-US%22%3E%3CP%3EThanks%20for%20the%20tip.%20I%20was%20worried%20that%20I%20could%20only%20do%20downloadable%20reports%20now.%20After%20following%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F58%22%20target%3D%22_blank%22%3E%40Vasil%20Michev%3C%2FA%3E's%20guideline%2C%20I%20was%20able%20to%20view%20my%20report%20instantly.%20Thanks!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-198319%22%20slang%3D%22en-US%22%3ERe%3A%20New%20Message%20Trace%20is%20very%20slow%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-198319%22%20slang%3D%22en-US%22%3E%3CP%3ERequesting%20the%20downloadable%20report%20has%20always%20required%20some%20time.%20If%20you%20want%20the%20%22synchronous%22%20results%20that%20get%20displayed%20immediately%2C%20make%20sure%20to%20use%20the%20%3CSPAN%20class%3D%22labelText%20ng-binding%22%3ESummary%20report%20option%2C%20not%20Enhanced%20summary%20report%20or%20Extended%20report.%20And%20also%20make%20sure%20to%20limit%20the%20date%20range%20to%20maximum%2010%20days%20past.%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Contributor

I tried using the new Message Trace in the Office 365 admin portal and I still haven't received my report 1 hour after creating my search. Previously the message trace was instantaneous, I would see the results of my search immediately after clicking 'search'. 

 

Now with the new Message Trace, I am informed that I will receive an email when my report is ready. I waited over an hour and I have not received any email. I use message traces often to troubleshoot email issues and it is an important feature for me. Having a long delay before viewing the results is quite inconvenient.

 

Is this behavior normal?

11 Replies
Highlighted
Best Response confirmed by Jason Drew (Contributor)
Solution

Requesting the downloadable report has always required some time. If you want the "synchronous" results that get displayed immediately, make sure to use the Summary report option, not Enhanced summary report or Extended report. And also make sure to limit the date range to maximum 10 days past.

Highlighted

Thanks for the tip. I was worried that I could only do downloadable reports now. After following @Vasil Michev's guideline, I was able to view my report instantly. Thanks!

Highlighted

Hello Jason,

 

It is also possible to get message trace results promptly when done using PowerShell against Office 365.

We resort to this method to find out the required traces just in summary and not the detailed report of everything available.

 

This is just an alternate if you are comfortable using PowerShell with O365.

Highlighted
I was not aware that I could use Powershell, thanks!
Highlighted

Hello Jason,

 

This should help you get started with the powershell access to message tracing from O365

 

https://docs.microsoft.com/en-us/powershell/module/exchange/mail-flow/get-messagetrace?view=exchange...

Highlighted

Hello, Is it possible to run (2) simultaneous message traces by subject from powershell?

 

Is it possible to do a message trace by subject for more than one word?

Highlighted

Subject-based searches are not possible. The only way to make this work is to fetch all events, then filter them client-side.

Highlighted

Hello, I had (2) questions. Are you saying that the answer to both of my questions is no?

 

No, it is not possible to run (2) different power shell sessions searching by subject?

 

and No, it is not possible to run a message trace by subject using more than one word as the search criteria?   The idea is to run a message trace by subject with includes the entire subject line of an email.

 

 

Highlighted

There is no way to run a search based on subject, period. Doesn't matter if it's a single session, a single word, a phrase - it's simply not possible. The only way would be to run a "full" message trace, get all the events for the period in question, then filter them in PowerShell or Excel or whatever.

Highlighted

I disagree. There is a way to do a message trace by subject, but it is only possible using one word. 

 

Here is just one example.

 

https://blogs.technet.microsoft.com/praveenkumar/2015/08/12/message-tracking-by-subject/

Highlighted

This is exactly the method I'm referring to above. Where/Where-Object is a client-side operation, meaning that you need to fetch all the message trace events first before you can apply the filter. At which point you might as well just export them to CSV and filter/search via Excel.