Retrieve Microsoft Exchange Message Tracking Log with PowerShell

You are here:
← All Topics

Please refer to the steps below on how to retrieve Microsoft Exchange Message Tracking Log with PowerShell

Default Configuration of Message Tracking Log

  • Retention of 30 Days
  • Max file size of 10MB
  • MAX folder size of 1GB
  • Generated hourly

MessagingTacking-01

Get-TransportService | Select MessageTrackingLogEnabled, MessageTrackingLogMaxAge, MessageTrackingLogMaxDirectorySize, MessageTrackingLogMaxFileSize, MessageTrackingLogPath  


MessageTrackingLogEnabled          : True
MessageTrackingLogMaxAge           : 30.00:00:00
MessageTrackingLogMaxDirectorySize : 1000 MB (1,048,576,000 bytes)
MessageTrackingLogMaxFileSize      : 10 MB (10,485,760 bytes)
MessageTrackingLogPath             : C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\MessageTracking

Filter Message based on Sender

Use "Get-TransportServer" to perform search on all Exchange Transport Servers

$Sender = "[email protected]"
Get-TransportServer | Get-MessageTrackingLog -Sender $Sender | ? EventID -like "SEND" `
| Select Timestamp, Sender, {$_.Recipients}, MessageSubject

Filter Message based on Recipient

$Recipient ="[email protected]"
Get-TransportServer | Get-MessageTrackingLog -Recipients $Recipient | ? EventID -like "RECEIVE" `
| Select Timestamp, Sender,{$_.Recipients}, MessageSubject

Filter Message based on Time Range

  • Time format: DD/MM/YYYY HH:MM:SS
  • ($_.Recipients -notlike "journal")* – to exclude recipients
Get-TransportServer | Get-MessageTrackingLog -Start "14/2/2020 00:00:00" -End "14/2/2020 23:59:59" -ResultSize unlimited `
| ? {($_.EventID -like "SEND") -and ($_.Recipients -notlike "journal*")} ` #Exclusion 
|Select Timestamp, Sender, {$_.Recipients}, MessageSubject
  • (Get-Date).Addhours(-1) – last 1 hour
  • (Get-Date).AddDays(-2) – last 2 days
Get-MessageTrackingLog -ResultSize unlimited -Server IB-MBX01 -Start (Get-Date).Addhours(-1) -Sender $Sender | ? EventID -like "SEND" `
|Select Timestamp, Sender, {$_.Recipients}, MessageSubject

Filter Message based on Subject

Get-TransportServer | Get-MessageTrackingLog -Sender [email protected] -MessageSubject "Read" | ? EventID -like "SEND" `
|Select Timestamp, Sender, {$_.Recipients}, MessageSubject

Reference
1. https://docs.microsoft.com/en-us/exchange/mail-flow/transport-logs/message-tracking?view=exchserver-2019#EventTypes

Contents

Leave a Reply

Your email address will not be published. Required fields are marked *

Scroll to Top