Get-MessageTrackingLog showing no results - Exchange 2013

[anhtnt]

Hello,

I trace mail with command: get-messagetrackinglog from 06/30/2022 to 07/31/2022 but return nothing. I checked in the directory containing the log, the log file still exists.

Why is there no result when I run the command?

Many Greetings and thanks for any hint. 

[#2]

@anhtnt 

Why to use the date as this format

Try to pass the date by using the Get-Date cmdlet

Get-MessageTrackingLog -Start (Get-Date).AddDays(-4) -End (Get-Date).AddDays(-1)

[#3]

yes, before going into more detailed problems, would you run the command suggested by @farislaeb, and then make a query via a sender

Get-MessageTrackingLog -Sender email address removed for privacy reasons

[#4]

@farismalaeb @cengizyilmaz  The same. Still no results

[#5]

@anhtnt 

@anhtnt 

Try Get-TransportServer | select MessageTracking* to see what the path is for you.

Get-TransportServer | select MessageTracking*

Have you restart your Exchange service and try to get the logs again?
Try to restart the Microsoft Exchange Transport Log Search service and Microsoft Exchange Active Directory Topology service manually.

[#6]

@cengizyilmaz 
I can trace from 12/08 to 14/08 but from 10/08 to 12/08, its empty result.

 

[#7]

If you try to open the log folder and and take a look on the message trace... are the content there or not.
So you have only 2 days of trace?

[#8]

@farismalaeb 
I see .LOG file exist, but not enough .idx files in C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\MessageTracking\index.

[#9]

@anhtnt 

Try to run the following code

get-exchangeserver |get-TransportService  | fl *Tracking*

[#10]

@anhtnt 

You say the recordings are in the file, and Tracking Log doesn't find them. This is very interesting.

As a workaround, change the location of the message tracking log and restart Microsoft Exchange Active Directory Topology service.

[#11]

@anhtnt
You have to test the following in your lab before doing it. It was sometime ago and this happened to me so i can't recall exactly what i did but here it is. There is a index folder in the message tracking log folder, you may try to delete it (just the file in it not the folder) and restart "Microsoft Exchange Transport Log Search" service, it should take a while to rebuild.

I would suggest not to tinker on the message tracking log file, make sure antivirus exception was made to the path. If you need to work on the file, you can try to copy it to another location and work on it, log parser etc.

[#12]

@cengizyilmaz  @Thai_Lam  After i rename folder "index" and restart "Microsoft Exchange Transport Log Search", it only regenerates the index files in the last day. 

How do i know it will work properly? Is there any way to regenerate previously lost index files?