Forum Discussion
track email
The tracking logs are very verbose, so you're not alone that it's a lot of information to parse. What you'll want to look for or filter by is the event type (https://docs.microsoft.com/en-us/Exchange/mail-flow/transport-logs/message-tracking#event-types-in-the-message-tracking-log).
For scenario 1, RECEIVE will be the event for Exchange receiving the message, and DELIVER will be the event for delivery to your user's mailbox.
For scenario 2, SEND will indicate the message was sent out of the Exchange server.
For identifying failures, there are multiple different event types to consider (see link above).
If you just want to see certain events, you can add a filter of -EventId and then the event name in quotes to your Get-MessageTrackingLog search.
Hope this helps!
The tracking logs are very verbose, so you're not alone that it's a lot of information to parse. What you'll want to look for or filter by is the event type (https://docs.microsoft.com/en-us/Exchange/mail-flow/transport-logs/message-tracking#event-types-in-the-message-tracking-log).
For scenario 1, RECEIVE will be the event for Exchange receiving the message, and DELIVER will be the event for delivery to your user's mailbox.
For scenario 2, SEND will indicate the message was sent out of the Exchange server.
For identifying failures, there are multiple different event types to consider (see link above).
If you just want to see certain events, you can add a filter of -EventId and then the event name in quotes to your Get-MessageTrackingLog search.
Hope this helps!
hi below is results of the syntax i have edited some of the information
i can see STOREDELIVER and DELIVER which means the email has been received by the end user
[PS] C:\Windows\system32>Get-TransportService | Get-MessageTrackingLog -Sender exchangeonlineuser@mydomain.com -Recipient
exchangeonpremisesuser@mydomain.com -start "06/28/2018 00:00" -end "06/28/2018 23:59" | fl
RunspaceId : 654d2367-c2ef-480b-b6aa-59f760bb0db0
Timestamp : 6/28/2018 7:00:57 PM
ClientIp :
ClientHostname : myexchangeserver02.mydomain.com
ServerIp :
ServerHostname : myexchangeserver01
SourceContext : XXXXXXXXX;2018-06-28T12:55:40.570Z;ClientSubmitTime:2018-06-28T12:55:19.000Z
ConnectorId :
Source : STOREDRIVER
EventId : DELIVER
InternalMessageId : 18606543789045
MessageId : <xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx>
NetworkMessageId : xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Recipients : {exchagneonpremisesuser@mydomain.com}
RecipientStatus : {}
TotalBytes : 47654
RecipientCount : 1
RelatedRecipientAddress :
Reference :
MessageSubject : Test Email
Sender : exchangeonlineuser@mydomain.com
ReturnPath : exchangeonlineuser@mydomain.com
Directionality : Originating
TenantId :
OriginalClientIp : X.XX.XX.XXX
MessageInfo : XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
MessageLatency : 00:00:00
MessageLatencyType : EndToEnd
EventData : {[IncludeInSla, True], [MailboxDatabaseGuid, xxxxxx],
[Mailboxes, xxxxx], [StoreObjectIds, xxxxxxxxx
xxxxxxxxxxxxxxxxx==], [FromEntity,
Internet], [ToEntity, Hosted], [P2RecipStat, 0.007/2], [MsgRecipCount, 2], [DeliveryLatency,
0.000], [AttachCount, 0], [E2ELatency, 1.697], [DeliveryPriority, Normal], [AccountForest,
mydomain.com]}
TransportTrafficType : Email
SchemaVersion : 15.01.1466.003
- That's correct, it has been delivered to the local mailbox.