How to do messaging tracking in Exchange Server 2016

Message tracking is the part of every exchange admin life, every day there will be some work where we will require to do message tracking for investigation on issues, so to Track message in exchange server 2016 we have Get-MessageTrackingLog CMD. In this article we will see how we can use this cmd for message tracking.

NOTE: Searching the message tracking logs requires that the Microsoft Exchange Transport Log Search service is running else you will end up in an error which will say

“Failed to connect to the Microsoft Exchange Transport Log Search service on computer”

CMD: Get-MessageTrackingLog

By default will return 1000 most recent message tracking log entries on the server

CMD: Get-MessageTrackingLog –EventId SEND –Server LABEXCH02

Will return Logs with EventID Send from Server LABEXCH02

Get-MessageTrackingLog -ResultSize Unlimited -Start "4/28/2016 8:00AM" -End "5/28/2016 5:00PM" -EventId "RECEIVE" -Sender "LAbadmin@letsexchange.in" -Server LABEXCH02

This example searches the message tracking logs on the server LABEXCH02 for all entries from 4/28/2016 8:00 AM to 5/28/2016 5:00 PM for all Receive events where the message sender was
labadmin@letsexchange.in

So now lets Use the Exchange Management Shell to search the message tracking logs for message entries on multiple servers

If there are selective roles like separate CAS, HUB and Mailbox in case of exchange 2010 environment use the below cmd.

$Servers = Get-ExchangeServer;

$Servers | where {$_.isHubTransportServer -eq $true -or $_.isMailboxServer -eq $true} | Get-MessageTrackingLog –EventId SEND –resultsize unlimited

Or If all server have hub server role we can use below cmd.

Get-ExchangeServer | Get-MessageTrackingLog –EventId SEND –resultsize unlimited