Hello!

I read this article http://technet.microsoft.com/ru-ru/library/bb124375%28v=exchg.150%29.aspx#Structure and still don't understand the following:

"

Example entries in the message tracking log

Hello,

The message tracking log entries refers to four types of message tracking logs. If there is no moderation, the MSGTRKMA message tracking log type dont needed.

When you send message to another user on the same server, it only needs MSGTRK, MSGTRKMD and MSGTRKMS message tracking log type.

Exchange 2013 use mailbox guid@ primary smtp e-mail address.

Hello,

Thank you for the reply!

"When you send message to another user on the same server, it only needs MSGTRK, MSGTRKMD and MSGTRKMS message tracking log type." - yes, I understand it, but this does not answer my questions...

Hello,

There is no difference clearly for these log types. Generally, there will be the following event types in the message tracking logs when you send message to another user on the same server.

Deliver, Notifymapi, Process, Receive, Resolve, Send, Submit event types.

Cara Chen, thank you for the reply!

"Generally, there will be the following event types in the message tracking logs when you send message to another user on the same server. " -  but why I can't find in those logs "normal" receipinet and sender addresses as described in the article (RECEIVE SMTP chris@contoso.com {michelle@contoso.com} test)?

"There is no difference clearly for these log types" - ???????!!!

And one more question, please: when sending e-mails from one user to another on the same server should they be logged in the smtp log (once it enabled, of course)? My smtp log is empty...

Best regards,

Michael

Hi,
What exactly was the query you ran?

I wonder if you have more than one Exchange 2013 Server and didn't include them all in your search. If that is the case, then it would explain why you didn't get Sender and Recipients in the output.

Martina, I mean there're no administrator@test2.local, user1@test2.local and user3@test2.local addresses in my logs, although I see these messages in the reporting section of ECP, so my logs do not correlate with the article's example

EventId    Source      Sender            Recipients             MessageSubject
-------    ------      ------            ----------             --------------
NOTIFY     STOREDRIVER                   {}
RECEIVE    STOREDRIVER chris@contoso.com {michelle@contoso.com} test
SUBMIT     STOREDRIVER chris@contoso.com {michelle@contoso.com} test

Hi MF47,
It is still not clear to me if you ran Get-Messagetrackinglog against all your Servers or not.
I assume you have more than one EX13 Server and not including all of them in the search will leave many "actions" out simple because they happens on another server during transit.

Example:
Get-ExchangeServer | where {$_.isHubTransportServer -eq $True -or $_.isMailboxServer -eq $True} | Get-MessageTrackingLog -Messagesubject "Test"

Hi Martina,

Please excuse me, I fogot to say there's only one Exchange server. And I did not run Get-MessageTrackingLog or something like that - I just opened the logs in the Notepad.