Exchange Troubleshooting Assistant (ExTRA) : How To Take Traces Using ExTRA and Analyse
In this post I will be explaining how to take Exchange traces using ExTRA tool and will show how the traces will look like.
This tool is basically used for various Exchange troubleshooting, but in this post we will be seeing hot to Enable Exchange tracing for calendar issues.
Note: It is always recommended to take the help of Microsoft Support Engineer on Call before proceeding these steps.
The issue what we are going to check is for an user whose calendar items are getting missed frequently. So, to check how the calendar invites are missing/deleted we are going to follow these steps.
How to enable trace in Exchange Servers.
1. Exchange 2007/2010 comes in built with ExTRA which helps you trace activities that occur in the store or database
2. Open cmd prompt as admin and type ExTra to open it “or”
3. Start –> Run –> ExTra
4. This will open the Exchange Troubleshooting Assistant
5. Now Select a new task and click next and select “Trace control”. This will throw an error “This server does not have the module needed for interpreting traces. Continue only if this is being done under the direct supervision of a qualified Exchange support engineer.”
6. On the “Configure Trace File” page, configure the location of the trace
7. DO NOT enable “circular logging” and select “Create a new file when max trace file size is reached”
8. Under “select the type of tracing needed” select the option “Set Trace Tags Manually”
9. Select Trace Types – PFD, Fatal, Error, Warning, Info, Debug, Performance, Function
10. Under ‘Components to Trace’ – Select “Store”
11. Select ‘Trace Tags’ –
tagCalendarChange
tagCalendarDelete – This tag is going to capture all calendar deletions
tagMtgMessageChange
tagMtgMessageDelete
12. If you want to enable tracing for just one sure, do so using “Show mailbox trace filtering options” and select the user
13. Now click “Start Tracing”
14. The next time the user reports the issue, you will have the “*.etl” file with details on who/what deleted it
15. Stop and Exit the trace when you feel comfortable the collected logs are enough to troubleshoot.
16. Let Microsoft PSS can analyze the output file and see what deleted the calendar item
This is what I saw on analysing the output file:
This means that the one of the re-occurring calendar item with the subject “July-Dec 2015-APJ Local Deal Governance” was deleted at “12/Aug/2015 12:28:45 AM” by the user "System Administrator “on outlook client”
How to convert the ETL logs to CSV report.
Traces will be viewable by an Exchange Support Engineer, he will use a tool to view the ETL logs.
extrace.exe –c –v ExchangeDebugTrace.ETL > output.csv
Notes:
- Trace logs might get filled up quickly, so when you enable the tracking make sure there is enough free disk space on the server.
- Stop the trace when you don’t want it any more. Make sure you exit the console.
- Use ExTRA tool for the respective mailbox versions. E.g... Exchange 2007 / 2010.
- To enable the trace you need to always login to the mailbox server on which the user mailbox is present.
If you need any help to analyse the ETL logs, please forward we could try to help you.
Thank you for visiting my blog
Please update your comments or feedback.
Contact me @: exctech2013@gmail.com
