Windows OS Hub
  • Windows Server
    • Windows Server 2022
    • Windows Server 2019
    • Windows Server 2016
    • Windows Server 2012 R2
    • Windows Server 2012
    • Windows Server 2008 R2
    • SCCM
  • Active Directory
    • Active Directory Domain Services (AD DS)
    • Group Policies
  • Windows Clients
    • Windows 11
    • Windows 10
    • Windows 8
    • Windows 7
    • Windows XP
    • MS Office
    • Outlook
  • Virtualization
    • VMWare
    • Hyper-V
    • KVM
  • PowerShell
  • Exchange
  • Cloud
    • Azure
    • Microsoft 365
    • Office 365
  • Linux
    • CentOS
    • RHEL
    • Ubuntu
  • Home
  • About

Windows OS Hub

  • Windows Server
    • Windows Server 2022
    • Windows Server 2019
    • Windows Server 2016
    • Windows Server 2012 R2
    • Windows Server 2012
    • Windows Server 2008 R2
    • SCCM
  • Active Directory
    • Active Directory Domain Services (AD DS)
    • Group Policies
  • Windows Clients
    • Windows 11
    • Windows 10
    • Windows 8
    • Windows 7
    • Windows XP
    • MS Office
    • Outlook
  • Virtualization
    • VMWare
    • Hyper-V
    • KVM
  • PowerShell
  • Exchange
  • Cloud
    • Azure
    • Microsoft 365
    • Office 365
  • Linux
    • CentOS
    • RHEL
    • Ubuntu

 Windows OS Hub / Exchange / Get-MessageTrackingLog: Search Message Tracking Logs on Exchange Server

December 19, 2019 ExchangePowerShell

Get-MessageTrackingLog: Search Message Tracking Logs on Exchange Server

You can use the Get-MessageTrackingLog cmdlet in the Exchange Management Shell to analyze mail flow, message forensics and to get different information about messages sent or received by a specific mailbox in your email organization. In this article, I will show several examples of PowerShell one-liner commands which I often use to track messages on Exchange Server 2016/2013/2010 and Office 365 (Exchange Online).

Let me remind you that the Exchange transport logs are located in the %ExchangeInstallPath%TransportRoles\Logs\MessageTracking folder. And the most efficient and flexible way to analyze message tracking logs in the Exchange is to use the Get-MessageTrackingLog cmdlet.

First of all, consider the main Get-MessageTrackingLog parameters that you can use to filter events in the logs. The following cmdlet parameters are used the most often:

  • Sender – search by sender;
  • Recipients — search by recipient;
  • Server – search on the specific transport server;
  • Start “11/30/2019 08:00:00” -End “12/18/2019 21:00:00” — search for the specific period of time;
  • MessageSubject — search by message subject;
  • EventID – search by Exchange event (as a rule, the following codes are used: RECEIVE, SEND, FAIL, DSN, DELIVER, BADMAIL, RESOLVE, EXPAND, REDIRECT, TRANSFER, SUBMIT, POISONMESSAGE, DEFER);
  • messageID – track by a message ID.

If you run the Get-MessageTrackingLog cmdlet without any parameters, all events from the Exchange transport logs for the last 30 days will be displayed. The cmdlet displays the last 1,000 events only. To remove this restriction, use the –ResultSize Unlimited parameter. (It is not recommended to do it without some additional filter parameters due to potentially high load on your transport server.)

You can display the information about your Exchange events page-by-page using this command:

Get-MessageTrackingLog | Out-Host –Paging

Get-MessageTrackingLog - powershell cmdlet to Search Message Tracking Logs by Sender or Recipient

To display the data in the table format and adjust the column width, the Format-Table cmdlet is used:

Get-MessageTrackingLog | Format-Table –AutoSize

If several Hub Transport servers is used in your Exchange organization, you will need to specify the name of a server to search as an argument of the –Server parameter . Or run the message tracking command for each of your Hub Transport servers with the pipe:

Get-TransportServer | Get-MessageTrackingLog

Let’s display all emails for the last 24 hours ((Get-Date).AddHours(-24)), in which a recipient from @gmail.com domain is specified:

Get-MessageTrackingLog -Start (Get-Date).AddHours(-24) -ResultSize unlimited | where {[string]$_.recipients -like "*@gmail.com"}

Get-MessageTrackingLog last day by recepient

To display all emails sent by the specific user through the certain server in a given period of time use the command below (only the specific tracking fields will be displayed in the report):

Get-MessageTrackingLog -ResultSize unlimited –Sender "cmansion@woshub.com” –server rome-hub-01 -Start "11/30/2019 06:00:00" -End "12/13/2019 22:00:00" |select-object Timestamp,Sender,Recipients,MessageSubject,EventId|ft

Search Message Tracking Logs by Time and Date Range

Let’s find all emails sent by a user to another one and export the search results into a CSV file:

Get-MessageTrackingLog -Sender "cmansion@woshub.com" -Recipients "amorato@woshub.com" -ResultSize unlimited –server rome-hub-01| Select-Object Timestamp,Sender,{$_.recipients},MessageSubject | Export-Csv -Path "C:\Export\exchange\exchange_tracking_logs.csv" -Encoding Default -Delimiter ";"

You can search by the message subject. To display all emails with “test” word in the subject field, run the following command. (To display the results in a separate graphic window as a table with the convenient sorting, filtering and search features, you can use the Out-gridview cmdlet.)

Get-MessageTrackingLog -MessageSubject "test" -ResultSize unlimited –server rome-hub-01| Select-Object Timestamp,Sender, {$_.recipients}, MessageSubject | out-gridview

Get-MessageTrackingLog gridview

You can search by the specific message ID (you can get it from the message header in Outlook):

Get-MessageTrackingLog -messageID "41A4321C3543314FFFFF23122F2BDB7ABD00342@rome-hub-01.woshub.com" -ResultSize unlimited –server rome-hub-01| Select-Object Timestamp,Sender, {$_.recipients}, MessageSubject

To count the number of incoming email messages for the specific mailbox for the last 7 days, run the following command:

(Get-MessageTrackingLog -EventID "RECEIVE" -Recipients "amorato@woshub.com" -ResultSize unlimited).Count

You can display the more insteresing message statistics. For example, you want to see how many emails from different senders from the gmail.com have been received by users of your company during the last 5 days (we will display the total number of emails sent by each external sender):

Get-MessageTrackingLog -EventId "Receive" -Start (Get-Date).AddDays(-5) -ResultSize Unlimited | Where-Object {$_.Sender -like "*@gmail.com"} | Group-Object Sender | Sort-Object Count -Descending | Format-Table *

Get-MessageTrackingLog with grouping , sorting and counting by sender

To find emails stored in the Exchange user mailboxes, use the Search-Mailbox cmdlet.

Office 365 allows you to perform message tracking logs search from the Exchange Admin Center (EAC). Go to the Mail Flow -> Message Trace. Fill in the search fields. This is actually the web interface for the Get-MessageTrackingLog cmdlet, which allows the user to generate PowerShell tracking command in a simple web form.

office 365 Mail Flow -> Message Trace

The methods considered above will help you to get the statistics on the sent and received messages in your Exchange system and diagnose different email transport problems.

2 comments
3
Facebook Twitter Google + Pinterest
previous post
Internal SSD/SATA Drive Shows as a Removable in Windows
next post
Fix: Photos App in Windows 10 Opens Extremely Slow

Related Reading

Using Previous Command History in PowerShell Console

January 31, 2023

How to Install the PowerShell Active Directory Module...

January 31, 2023

Finding Duplicate E-mail (SMTP) Addresses in Exchange

January 27, 2023

How to Disable or Uninstall Internet Explorer (IE)...

January 26, 2023

How to Delete Old User Profiles in Windows?

January 25, 2023

2 comments

Anas Hamra January 2, 2021 - 2:31 am

Hi,

I am getting this error. Not sure why.

I tried in both Exchange shell and PowerShell

I have Exchange 2019

Welcome to the Exchange Management Shell!

Full list of cmdlets: Get-Command
Only Exchange cmdlets: Get-ExCommand
Cmdlets that match a specific string: Help **
Get general help: Help
Get help for a cmdlet: Help or -?
Exchange team blog: Get-ExBlog
Show full output for a command: | Format-List

Show quick reference guide: QuickRef
VERBOSE: Connecting to Exchange-2019.ans.red.
VERBOSE: Connected to Exchange-2019.ans.red.
[PS] C:\Windows\system32>Get-MessageTrackingLog
Get-MessageTrackingLog : The term ‘Get-MessageTrackingLog’ is not recognized as the name of a cmdlet, function, script
file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct
and try again.
At line:1 char:1
+ Get-MessageTrackingLog
+ ~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (Get-MessageTrackingLog:String) [], CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException

[PS] C:\Windows\system32>

Reply
Bhargav February 15, 2021 - 1:28 pm

Run “Add-PSSnapin *exch*” command and see if it makes a difference.

Reply

Leave a Comment Cancel Reply

Categories

  • Active Directory
  • Group Policies
  • Exchange Server
  • Microsoft 365
  • Azure
  • Windows 11
  • Windows 10
  • Windows Server 2022
  • Windows Server 2019
  • Windows Server 2016
  • PowerShell
  • VMWare
  • Hyper-V
  • Linux
  • MS Office

Recent Posts

  • Configure User’s Folder Redirection with Group Policy

    February 3, 2023
  • Using Previous Command History in PowerShell Console

    January 31, 2023
  • How to Install the PowerShell Active Directory Module and Manage AD?

    January 31, 2023
  • Finding Duplicate E-mail (SMTP) Addresses in Exchange

    January 27, 2023
  • How to Delete Old User Profiles in Windows?

    January 25, 2023
  • How to Install Free VMware Hypervisor (ESXi)?

    January 24, 2023
  • How to Enable TLS 1.2 on Windows?

    January 18, 2023
  • Allow or Prevent Non-Admin Users from Reboot/Shutdown Windows

    January 17, 2023
  • Fix: Can’t Extend Volume in Windows

    January 12, 2023
  • Wi-Fi (Internet) Disconnects After Sleep or Hibernation on Windows 10/11

    January 11, 2023

Follow us

woshub.com
  • Facebook
  • Twitter
  • RSS
Popular Posts
  • Configuring Anti-Spam Protection on Exchange 2013, 2016 – RBL Providers
  • New-MailboxRepairRequest: Fixing Corrupted Mailboxes in Exchange 2016/2013/2010
  • How to Configure DKIM on Exchange Server 2010/2013
  • How to Import and Export Mailbox to PST in Exchange 2016/2013/2010?
  • How to Blacklist/Block Sender Domain or an Email Address on Exchange?
  • Managing Exchange Mailbox Inbox Rules with PowerShell
Footer Logo

@2014 - 2023 - Windows OS Hub. All about operating systems for sysadmins


Back To Top