Have a Question?
< All Topics
Print

Retrieve Microsoft Exchange Message Tracking Log with PowerShell

Please refer to the steps below on how to retrieve Microsoft Exchange Message Tracking Log with PowerShell

Default Configuration of Message Tracking Log

  • Retention of 30 Days
  • Max file size of 10MB
  • MAX folder size of 1GB
  • Generated hourly

MessagingTacking-01

Get-TransportService | Select MessageTrackingLogEnabled, MessageTrackingLogMaxAge, MessageTrackingLogMaxDirectorySize, MessageTrackingLogMaxFileSize, MessageTrackingLogPath  


MessageTrackingLogEnabled          : True
MessageTrackingLogMaxAge           : 30.00:00:00
MessageTrackingLogMaxDirectorySize : 1000 MB (1,048,576,000 bytes)
MessageTrackingLogMaxFileSize      : 10 MB (10,485,760 bytes)
MessageTrackingLogPath             : C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\MessageTracking

Filter Message based on Sender

Use "Get-TransportServer" to perform search on all Exchange Transport Servers

$Sender = "[email protected]"
Get-TransportServer | Get-MessageTrackingLog -Sender $Sender | ? EventID -like "SEND" `
| Select Timestamp, Sender, {$_.Recipients}, MessageSubject

Filter Message based on Recipient

$Recipient ="[email protected]"
Get-TransportServer | Get-MessageTrackingLog -Recipients $Recipient | ? EventID -like "RECEIVE" `
| Select Timestamp, Sender,{$_.Recipients}, MessageSubject

Filter Message based on Time Range

  • Time format: DD/MM/YYYY HH:MM:SS
  • ($_.Recipients -notlike "journal")* – to exclude recipients
Get-TransportServer | Get-MessageTrackingLog -Start "14/2/2020 00:00:00" -End "14/2/2020 23:59:59" -ResultSize unlimited `
| ? {($_.EventID -like "SEND") -and ($_.Recipients -notlike "journal*")} ` #Exclusion 
|Select Timestamp, Sender, {$_.Recipients}, MessageSubject
  • (Get-Date).Addhours(-1) – last 1 hour
  • (Get-Date).AddDays(-2) – last 2 days
Get-MessageTrackingLog -ResultSize unlimited -Server IB-MBX01 -Start (Get-Date).Addhours(-1) -Sender $Sender | ? EventID -like "SEND" `
|Select Timestamp, Sender, {$_.Recipients}, MessageSubject

Filter Message based on Subject

Get-TransportServer | Get-MessageTrackingLog -Sender [email protected] -MessageSubject "Read" | ? EventID -like "SEND" `
|Select Timestamp, Sender, {$_.Recipients}, MessageSubject

Reference
1. https://docs.microsoft.com/en-us/exchange/mail-flow/transport-logs/message-tracking?view=exchserver-2019#EventTypes

Table of Contents
Scroll to Top