Messaging tracking log

Print Friendly, PDF & Email


Message Tracing graba los log files de trafico de email entre servidores de la organización.

Está habilitado por defecto y podemos ver la ruta de los logs que consulta el messagingTracking log en:

  • Set-TransportServer BR-EX2010-MB -MessageTrackingLogEnabled $true


Exchange Server 2013: Message tracking con Out-GridView

Con Exchange Server 2013 no disponemos de la consola GUI de message tracking: el centro de seguimiento de mensajes.

Podemos ver donde se configura

  • Get-TransportServer
  • Get-TransportService


  • Max Age – 30 days. You can turn this up or down as required. I find sometimes by the time an issue is reported or found that 30 days is not quite enough to be able to search back in time. However this is entirely up to you, and if your logs are being backed up you can always consider restoring older logs from backup if required.
  • Max Directory Size – this is an additional setting for limiting the total size of message tracking logs on your server. The default limit is 1Gb but in high volume environments you may find that this limit means logs are purged before they reach the full 30 day max age, because the max directory size overrides the max age setting. On most of my servers I’ve increased this to 4Gb and in some cases as much as 10Gb. Consider your server’s disk capacity as well as the impact that more log files has on the amount of time some tracking log searches will take.
  • Max File Size – the default is 10mb and I’ve never seen a need to change this.
  • Log Path – the default is the same drive as the Exchange 2010 install directory, but you can move this to any path you wish. On some of our highest volume servers (eg messaging hub sites, and Edge Transport servers) this path has been changed to a non-OS drive with a lot more free disk space.
  • Subject Logging – this is enabled by default and the only reason I’ve ever needed to disable it was when there were some privacy/security concerns for that particular environment




Sin embargo disponemos del cmd-let de powershell donde podemos realizar búsquedas dentro del message-tracking.

Ejemplo de salida de message tracking utilizando Powershell a partir de una fecha:

  • Get-MessageTrackingLog -ResultSize Unlimited -Start “Jan 3 2013” | more


Estos son los paramentos que podemos sacar

  • Get-messagetrackinglog

    -Start “01/14/2014 5:00PM”

    -End “01/15/2014 12:00AM”

    -sender “peter@adidas.local”

    -Recipient noemi@puma.local

    -messagesubject ‘subject’

    -ResultSize [Unlimited | 25]

    | Select-Object Timestamp, ClientIp, ClientHostname, ServerIp, ServerHostname, Source,EventId, MessageId,Recipients, RecipientStatus, TotalBytes, MessageSubject, Sender, ReturnPath | out-gridview




Search by Recipient, Subject where the Event ID is failed 

  • Get-ExchangeServer | get-messagetrackinglog -recipient -messagesubject “subject” -Start “10/10/2012 3:01:00 PM” -End “10/10/2012 9:59:00 PM” | where {$_.EventID -eq “Failed”}| fl Timestamp, MessageID, Recipients, MessageSubject, EventID, Sender, ReturnPath


En Exchange 2010


The web interface for message tracking is part of the Exchange Control Panel and provides very basic search functionality to search for messages either sent by or received by a mailbox, based on the sender, recipients, and subject line.











Message tracking log searches can also be performed in the Tracking Log Explorer, a GUI search tool that is part of the Exchange Management Console. This tool gives administrators some more control over the searches they perform such as searching for specific events (eg FAIL events), searching for a particular message ID, and controlling the date ranges for search results.




  • Get-MessageTrackingLog -Start 9/19/2012
  • Get-MessageTrackingLog -Start “9/19/2012 13:00:00”

Get-MessageTrackingLog -Start (Get-Date).AddHours(-1)

Get-MessageTrackingLog -Start 9/17/2012 -End 9/18/2012 -ResultSize unlimited

C:\>Get-MessageTrackingLog -Start “9/17/2012 00:00:00” -End “9/17/2012 11:59:59 PM” -ResultSize unlimited

Be the first to comment

Leave a Reply