0

I have 2 Exchange 2010 servers. I was looking for a receive time of a certain email so I opened Tracking Log Explorer and added the appropriate Date & Time filters. All I see are internal emails like reports generated and emailed from other internal servers.

Why don't I see any emails that were received from outside sources?

Edit: I also have a server that backs up all of our virtual machines and then sends out a results email. I see all of those emails in the Tracking Log Explorer however if I send an email from my Exchange account to my Gmail account that is not recorded in the Tracking Log Explorer. Similarly if I send an email from my Gmail account to my Exchange account it is not recorded in the Tracking Log Explorer.

Edit 2: I figured I'd update with a resolution. Basically if I want a nice frontend to do message tracking I'd use the Message Tracking web app. The Tracking Log Explorer uses the get-messagetrackinglog command which I think is the crux of the problem. Apparently the mailbox server only processes the message submit and the transport server does the routing and views recipient info.

When I started reading about the Powershell commands (See here: http://exchangeserverpro.com/exchange-2010-message-tracking/) I came across Get-TransportServer. So I put together this command:

Get-TransportServer | get-messagetrackinglog -Start "9/1/2015 5:00:00 AM" -End "9/1/2015 9:28:00 AM" | Select-Object eventid,sender,timestamp,@{Name="Recipients";Expression={$.recipients}},@{Name="RecipientStatus";Expression={$.recipientstatus}},messagesubject | Export-CSV c:\folder\tracking.csv

And that gives me everything in a CSV. Sender, recipient, everything. I still think the Message Tracking app is nicer but the PS command works and it can be filtered by date & time whereas the Message Tracking app can't.

ComputerUser5243
  • 11
  • 5
  • Are these the *only* 2 Exchange servers in your organization? – Mathias R. Jessen Aug 29 '15 at 15:28
  • Yes they are the only two. – ComputerUser5243 Aug 29 '15 at 15:34
  • AFAIR, the tracking log explorer doesn't append `-ResultSize Unlimited` to the query, so it only shows you the first 1000 tracking events. Try copying the Get-MessageTrackingLog command from the bottom of the form to the Exchange Management Console, add the `ResultSize` parameter and pipe the output to `Out-GridView`, should return everything within the timeframe – Mathias R. Jessen Aug 29 '15 at 15:58
  • I just gave that a go and got the same results as in the Tracking Log Explorer. It's as if Exchange is only logging mail from internal servers set as relays. – ComputerUser5243 Aug 29 '15 at 16:33
  • I'll try to explain it better. I also have a server that backs up all of our virtual machines and then sends out a results email. I see all of those emails in the Tracking Log Explorer however if I send an email from my Exchange account to my Gmail account that is not recorded in the Tracking Log Explorer. Similarly if I send an email from my Gmail account to my Exchange account it is not recorded in the Tracking Log Explorer. Oddly enough I see result emails from our internal VM backup server but not the internal Nagios server I have set up. – ComputerUser5243 Aug 29 '15 at 16:45

0 Answers0