
Having problems? Ask for help in the Exchange forums. In Exchange 2019, the Get-MessageTrackingLog cmdlet is able to search the message tracking logs on Exchange 2016 and Exchange 2013 Mailbox servers in the same Active Directory site.įor information about keyboard shortcuts that may apply to the procedures in this topic, see Keyboard shortcuts in the Exchange admin center. In Exchange 2016, the Get-MessageTrackingLog cmdlet is able to search the message tracking logs on Exchange 2013 Mailbox servers and Exchange 2010 Hub Transport servers in the same Active Directory site. Also, if you manually save an existing message tracking log file, the change in the file's date-time stamp breaks the query logic that Exchange uses to search the message tracking logs. You can't copy the message tracking log files from another Exchange server and then search them by using the Get-MessageTrackingLog cmdlet. However, you need to enter your date-time search criteria for the Start or End parameters in the regional date-time format of the computer that you're using to perform the search. The date-time field in the message tracking log stores information in Coordinated Universal Time (UTC). The sender-address field is displayed as Sender. The recipient-address field is displayed as Recipients. The date-time field is displayed as Timestamp. For example, internal-message-id is displayed as InternalMessageId. The biggest differences are:ĭashes are removed from the field names. The field names displayed in the results from the Get-MessageTrackingLog cmdlet are similar to the actual field names found in the message tracking log files. However, stopping this service does not affect other features in Exchange. If you disable or stop this service, you can't search the message tracking logs or run delivery reports. Searching the message tracking logs requires that the Microsoft Exchange Transport Log Search service is running. To see what permissions you need, see the "Message tracking" entry in the Mail flow permissions topic. You need to be assigned permissions before you can perform this procedure or procedures. What do you need to know before you begin? For example:įind out what happened to a message that was sent by a user to a specific recipient.įind out if a mail flow rule (also known as a transport rule) acted on a message.įind out if a message sent from an Internet sender made it into your Exchange organization.įind all messages sent by a specified user during a specified time period. You can use the Get-MessageTrackingLog cmdlet in the Exchange Management Shell to search for entries in the message tracking log by using specific search criteria. Message tracking records the message activity as mail flows through the transport pipeline on Mailbox servers and Edge Transport servers.
