Retrieve Microsoft Exchange Message Tracking Log with PowerShell
Please refer to the steps below on how to retrieve Microsoft Exchange Message Tracking Log with PowerShell
Default Configuration of Message Tracking Log
- Retention of 30 Days
- Max file size of 10MB
- MAX folder size of 1GB
- Generated hourly
Get-TransportService | Select MessageTrackingLogEnabled, MessageTrackingLogMaxAge, MessageTrackingLogMaxDirectorySize, MessageTrackingLogMaxFileSize, MessageTrackingLogPath
MessageTrackingLogEnabled : True
MessageTrackingLogMaxAge : 30.00:00:00
MessageTrackingLogMaxDirectorySize : 1000 MB (1,048,576,000 bytes)
MessageTrackingLogMaxFileSize : 10 MB (10,485,760 bytes)
MessageTrackingLogPath : C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\MessageTracking
Filter Message based on Sender
Use "Get-TransportServer" to perform search on all Exchange Transport Servers
$Sender = "[email protected]"
Get-TransportServer | Get-MessageTrackingLog -Sender $Sender | ? EventID -like "SEND" `
| Select Timestamp, Sender, {$_.Recipients}, MessageSubject
Filter Message based on Recipient
$Recipient ="[email protected]"
Get-TransportServer | Get-MessageTrackingLog -Recipients $Recipient | ? EventID -like "RECEIVE" `
| Select Timestamp, Sender,{$_.Recipients}, MessageSubject
Filter Message based on Time Range
- Time format: DD/MM/YYYY HH:MM:SS
- ($_.Recipients -notlike "journal")* – to exclude recipients
Get-TransportServer | Get-MessageTrackingLog -Start "14/2/2020 00:00:00" -End "14/2/2020 23:59:59" -ResultSize unlimited `
| ? {($_.EventID -like "SEND") -and ($_.Recipients -notlike "journal*")} ` #Exclusion
|Select Timestamp, Sender, {$_.Recipients}, MessageSubject
- (Get-Date).Addhours(-1) – last 1 hour
- (Get-Date).AddDays(-2) – last 2 days
Get-MessageTrackingLog -ResultSize unlimited -Server IB-MBX01 -Start (Get-Date).Addhours(-1) -Sender $Sender | ? EventID -like "SEND" `
|Select Timestamp, Sender, {$_.Recipients}, MessageSubject
Filter Message based on Subject
Get-TransportServer | Get-MessageTrackingLog -Sender [email protected] -MessageSubject "Read" | ? EventID -like "SEND" `
|Select Timestamp, Sender, {$_.Recipients}, MessageSubject