Exchange Online 中的监视、报告和邮件跟踪Monitoring, reporting, and message tracing in Exchange Online

Exchange Online 提供了许多不同的报表,可帮助您确定的总体状态和组织的运行状况。还有工具,可帮助您解决特定事件 (如消息未到达到其预期接收人),并审核报告以帮助合规性要求。下表介绍的报告和 Exchange Online 管理员可用的故障排除工具。Exchange Online offers many different reports that can help you determine the overall status and health of your organization. There are also tools to help you troubleshoot specific events (such as a message not arriving to its intended recipients), and auditing reports to aid with compliance requirements. The following table describes the reports and troubleshooting tools that are available to Exchange Online administrators.

备注

从旧的 Office 365 管理中心报告的映射,请参阅我的 Office 365 报告在哪里?For a mapping of reports from the old Office 365 admin center, see Where did my Office 365 report go?

功能Feature 说明Description 在哪里可以找到它Where you can find it 详细信息For more information
Office 365 管理中心中的使用率报告Usage reports in the Office 365 admin center
Office 365 组活动查看有关创建和使用 Office 365 组数的信息。Office 365 groups activity View information about the number of Office 365 groups that are created and used.
电子邮件活动查看有关发送、 接收和阅读在整个组织,以及通过特定用户的消息数的信息。Email activity View information about the number of messages sent, received and read in your whole organization, and by specific users.
电子邮件应用程序使用率查看有关连接到 Exchange Online 的电子邮件应用程序的信息。这包括每个应用程序的连接总数以及进行连接的 Outlook 版本。Email app usage View information about the email apps that are connecting to Exchange Online. This include the total number of connections for each app, and the versions of Outlook that are connecting.
邮箱使用情况查看有关使用存储的信息、 配额消耗、 项目计数和邮箱的最后一次活动 (发送或读取的活动)。Mailbox usage View information about storage used, quota consumption, item count, and last activity (send or read activity) for mailboxes.
在 Office 365 管理中心,在https://portal.office.com/adminportal/home,单击报告>使用率。在仪表板的顶部,单击选择报表。 在显示的下拉列表,进行以下选择之一: Office 365 部分: Office 365 组 activityExchange 部分: activityEmail usageMailbox 使用率应用程序的电子邮件In the Office 365 admin center at https://portal.office.com/adminportal/home, click Reports > Usage. At the top of the dashboard, click Select a report. In the in the drop-down list that appears, make one of these selections: Office 365 section: Office 365 groups activityExchange section: Email activityEmail app usageMailbox usage 管理中心-Office 365 组中的 office 365 报告Office 365 Reports in the admin center - Office 365 groups
管理中心-电子邮件活动中的 office 365 报告Office 365 Reports in the Admin Center - Email activity
在管理中心内的电子邮件应用程序使用率的 office 365 报告Office 365 Reports in the Admin Center - Email apps usage
在管理中心内的邮箱使用情况的 office 365 报告Office 365 Reports in the Admin Center - Mailbox usage
安全&在 Office 365 管理中心中的合规性报告Security & compliance reports in the Office 365 admin center
这些增强的报告提供的 Exchange Online 管理员,其中包括摘要信息,并能够向下钻取的详细信息的交互式的报告体验。These enhanced reports provide an interactive reporting experience for Exchange Online admins, which includes summary information, and the ability to drill down for more details.
数据丢失防护 (DLP) 查看有关 DLP 策略和规则影响邮件包含敏感数据,当他们输入或离开组织的信息。Data loss prevention (DLP) View information about DLP policies and rules that affect messages containing sensitive data as they enter and leave your organization.
注意: DLP 仅在特定 Exchange Online 订阅计划中可用。有关信息,请参阅Exchange Online Service Description中的数据丢失防护条目。Note: DLP is only available in certain Exchange Online subscription plans. For information, see the Data Loss Prevention entries in the Exchange Online Service Description.
高级威胁保护 (ATP) 查看有关安全链接和安全附件 ATP 一部分的信息。Advanced Threat Protection (ATP) View information about safe links and safe attachments that are part of ATP.
注意: ATP 位于 Office 365 企业 E5,但您还可以通过以下方式购买 ATP 作为到其他订阅计划。有关详细信息,请参阅Office 365 高级威胁 Protection Service DescriptionNote: ATP is available in Office 365 Enterprise E5, but you can also purchase ATP as an add-on to other subscription plans. For more information, see Office 365 Advanced Threat Protection Service Description.
Exchange Online Protection (EOP) 查看关于恶意软件检测、 带欺骗性的邮件、 垃圾邮件检测和与您的组织的邮件流的信息。Exchange Online Protection (EOP) View information about malware detections, spoofed mail, spam detections, and mail flow to and from your organization.
Office 365 安全性&合规性中心,网址为https://protection.office.com,单击报告>仪表板。 选择在可用的报告选项之一: DLP 报告: DLP 策略匹配 DLP 误报和覆盖。 ATP 报告: ATP 文件类型、 ATP 消息处置和威胁保护状态。 EOP 报告: 恶意软件检测、 流行恶意软件、 顶级发件人和收件人欺骗邮件、 垃圾邮件检测和已发送和接收邮件。In the Office 365 Security & Compliance Center at https://protection.office.com, click Reports > Dashboard. Select one of the reports that are available on the page: DLP reports: DLP policy matches and DLP false positives and overrides. ATP reports: ATP file types, ATP message disposition, and Threat protection status. EOP reports: Malware detections, Top malware, Top senders and recipients, Spoof mail, Spam detections, and Sent and received mail. 查看数据丢失防护报告View the reports for data loss prevention
高级威胁保护和 Exchange Online Protection 查看报告View reports for Advanced Threat Protection and Exchange Online Protection
使用 Microsoft Graph 的自定义报告Custom reports using Microsoft Graph
以编程方式创建报表中可用的 Office 365 管理中心内使用 Microsoft GraphProgrammatically create the reports that are available in the Office 365 admin center by using Microsoft Graph
n/a
使用在 Microsoft Graph 中的 Office 365 使用率报告的子主题The subtopics of Working with Office 365 usage reports in Microsoft Graph
使用报告 Web 服务的自定义报告Custom reports using reporting web services
以编程方式从可用 Exchange Online PowerShell 中使用 REST/ODATA2 查询筛选报告 cmdlet 创建报告。Programmatically create reports from the available Exchange Online PowerShell reporting cmdlets by using REST/ODATA2 query filtering.
注意: 很多报告已弃用和由 Microsoft Graph 中类似报告取代 cmdlet 在原始 Exchange Online PowerShell。有关详细信息,请参阅联机在 Exchange 报告 cmdletNote: Many of the original Exchange Online PowerShell reporting cmdlets have been deprecated and replaced by similar reports in Microsoft Graph. For more information, see Reporting cmdlets in Exchange Online.
https://reports.office365.com/ecp/reportingwebservice/reporting.svc
Office 365 报告 Web 服务Office 365 Reporting Web Services
邮件跟踪Message trace
通过 Exchange Online 组织中传输,如下所示电子邮件。您可以确定一封电子邮件是否已收到、 拒绝、 延迟,或由服务发送。它还会显示其达到其最终状态之前,对邮件采取了哪些操作。Follows email messages as they travel through your Exchange Online organization. You can determine if an email message was received, rejected, deferred, or delivered by the service. It also shows what actions were taken on the message before it reached its final status.
您可以使用此信息来高效地回答您的用户、 邮件流疑难解答、 验证策略更改,减轻与技术支持联系以寻求帮助。You can use this information to efficiently answer your user's questions, troubleshoot mail flow issues, validate policy changes, and alleviates the need to contact technical support for assistance.
在 Office 365 管理中心,在https://portal.office.com/adminportal/home,单击管理中心>Exchange。在新建 Exchange 管理员中心页打开,转到邮件流>邮件跟踪。In the Office 365 admin center at https://portal.office.com/adminportal/home, click Admin centers > Exchange. In the new Exchange admin center page that opens, go to Mail flow > Message trace. 跟踪电子邮件Trace an email message
要了解如何使用邮件跟踪和其他故障排除工具,请参见以 Office 365 商业版管理员身份查找并解决电子邮件传递问题中的视频。To learn how to use message trace and other tools for troubleshooting, watch the video at Find and fix email delivery issues as an Office 365 for business admin.
审核日志记录Audit logging
跟踪管理员对 Exchange Online 组织所做的特定更改。这些报告帮助您满足法规、遵从性以及诉讼要求。Tracks specific changes made by admins to your Exchange Online organization. These reports help you meet regulatory, compliance, and litigation requirements.
在 Office 365 管理中心,在https://portal.office.com/adminportal/home,单击管理中心>Exchange Online Protection。在新建 Exchange 管理员中心页打开,转到合规性管理>审核。In the Office 365 admin center at https://portal.office.com/adminportal/home, click Admin centers > Exchange Online Protection. In the new Exchange admin center page that opens, go to Compliance management > Auditing. Exchange 审核报告Exchange auditing reports

报告和邮件跟踪数据的可用性与延迟Reporting and message trace data availability and latency

下表描述了 Exchange Online 报告和邮件跟踪数据何时可用以及可用多长时间。The following table describes when Exchange Online reporting and message trace data is available and for how long.

报告类型 ****Report type* 数据可用时间 (回溯期) ****Data available for (look back period)* 延迟 ****Latency*
邮箱摘要报告Mailbox summary reports
60 天60 days
邮件数据聚合在 24-48 小时内基本完成。一些小的增量聚合更改可能最多需要 5 天。Message data aggregation is mostly complete within 24-48 hours. Some minor incremental aggregated changes may occur for up to 5 days.
邮件保护摘要报告Mail protection summary reports
90 天90 days
邮件数据聚合在 24-48 小时内基本完成。一些小的增量聚合更改可能最多需要 5 天。Message data aggregation is mostly complete within 24-48 hours. Some minor incremental aggregated changes may occur for up to 5 days.
邮件保护详细报告Mail protection detail reports
90 天90 days
对于未超过 7 天的详细数据,数据应该会在 24 小时内出现,但可能需要在 48 小时后才会完整。一些小的增量更改可能最多需要 5 天才能出现。For detail data that's less than 7 days old, data should appear within 24 hours but may not be complete until 48 hours. Some minor incremental changes may occur for up to 5 days.
若要查看关于超过 7 天的邮件的详细报告,获取结果可能需要几个小时。To view detail reports for messages that are greater than 7 days old, results may take up to a few hours.
邮件跟踪数据Message trace data
90 天90 days
对未超过 7 天的邮件运行邮件跟踪时,邮件应该会在 5-30 分钟内显示。When you run a message trace for messages that are less than 7 days old, the messages should appear within 5-30 minutes.
对超过 7 天的邮件运行邮件跟踪时,获取结果可能需要几个小时。When you run a message trace for messages that are greater than 7 days old, results may take up to a few hours.

备注

数据可用性和延迟是相同的是否通过 Office 365 管理中心或远程 PowerShell 请求。Data availability and latency is the same whether requested via the Office 365 admin center or remote PowerShell.