Message tracking

The message tracking log is a detailed record of all activity as mail flows through the transport pipeline on Mailbox servers and Edge Transport servers. You can use message tracking for message forensics, mail flow analysis, reporting, and troubleshooting.

By default, Exchange uses circular logging to limit the message tracking log based on file size and file age to help control the hard disk space that's used by the log files. To configure the message tracking log, see Configure message tracking.

Search the message tracking log

Message tracking logs contain vast amounts of data as messages move through a Mailbox server or Edge Transport server. When it comes to searching the message tracking logs, you have options:

• Get-MessageTrackingLog: Administrators can use this Exchange Management Shell cmdlet to search the message tracking log for information about messages using a wide range of filter criteria. For more information, see Search message tracking logs.

• Delivery reports for administrators: Administrators can use the Delivery reports tab in the Exchange admin center or the underlying Search-MessageTrackingReport and Get-MessageTrackingReport cmdlets in the Exchange Management Shell to search the message tracking logs for information about messages sent by or received by a specific mailbox in the organization. For more information, see Delivery reports for administrators.

Structure of the message tracking log files

By default, the message tracking log files exist in %ExchangeInstallPath%TransportRoles\Logs\MessageTracking. The folder contains log files that have different names, but they all follow the naming convention MSGTRKServiceyyyyMMdd-nnnn.log. The different log file names are described in the following table.

The other placeholders in the log file names represent the following information:

• yyyyMMdd is the coordinated universal time (UTC) date when the log file was created. yyyy = year, MM = month, and dd = day.

• nnnn is an instance number that starts at the value 1 every day for each log.

Information is written to the log file until the file reaches its maximum size. Then, a new log file that has an incremented instance number is opened (the first log file is -1, the next is -2, and so on). Circular logging deletes the oldest log files for a service when either of the following conditions are true:

• A log file reaches its maximum age.

• The message tracking log folder reaches its maximum size.

  Notes:

  • The maximum size of the message tracking log folder is calculated as the total size of all log files that have the same name prefix. Other files that do not follow the name prefix convention are not counted in the total folder size calculation. Renaming old log files or copying other files into the message tracking log folder could cause the folder to exceed its specified maximum size.

  • On Mailbox servers, the maximum size of the message tracking log folder is three times the specified value. Although the message tracking log files are generated by the four different services and have four different name prefixes, the amount and frequency of data written to the moderated transport log (MSGTRKMA) is negligible compared to the other three logs.

The message tracking log files are text files that contain data in the comma-separated value (CSV) format. Each message tracking log file has a header that contains the following information:

• #Software: The value is Microsoft Exchange Server.

• #Version: Version number of the Exchange server that created the message tracking log file. The value uses the format 15.01.nnnn.nnn.

• #Log-Type: The value is Message Tracking Log.

• #Date: The UTC date-time when the log file was created. The UTC date-time is represented in the ISO 8601 date-time format: yyyy-MM-ddThh:mm:ss.fffZ, where yyyy = year, MM = month, dd = day, T indicates the beginning of the time component, hh = hour, mm = minute, ss = second, fff = fractions of a second, and Z signifies Zulu, which is another way to denote UTC.

• #Fields: Comma-delimited field names that are used in the message tracking log files.

Fields in the message tracking log files

The message tracking log stores each message event on a single line in the log. The message event information is organized by fields, and these fields are separated by commas. The field name is generally descriptive enough to determine the type of information that it contains. However, some fields may be blank, or the type of information in the field may change based on the message event type and the service that recorded the event. General descriptions of the fields that are used to classify each message tracking event are explained in the following table.

Event types in the message tracking log

Various event types in the event-id field are used to classify the message events in the message tracking log. Some message events appear in only one type of message tracking log file, and some message events appear in all types of message tracking log files. The events types that are used to classify each message event are explained in the following table.

Source values in the message tracking log

The values in the source field in the message tracking log indicate the transport component that's responsible for the message tracking event. The following table describes the values of the source field.

Example entries in the message tracking log

An uneventful message sent between two users generates several entries in the message tracking log. You can see the results using the Get-MessageTrackingLog cmdlet. For more information, see Search message tracking logs.

This is an example of the message tracking log entries created when the user [email protected] successfully sends a test message to the user [email protected]. Both users have mailboxes on the same server.

EventId    Source      Sender            Recipients             MessageSubject
-------    ------      ------            ----------             --------------
NOTIFYMAPI STOREDRIVER                   {}
RECEIVE    STOREDRIVER [email protected] {[email protected]} test
SUBMIT     STOREDRIVER [email protected] {[email protected]} test
HAREDIRECT SMTP        [email protected] {[email protected]} test
RECEIVE    SMTP        [email protected] {[email protected]} test
AGENTINFO  AGENT       [email protected] {[email protected]} test
SEND       SMTP        [email protected] {[email protected]} test
DELIVER    STOREDRIVER [email protected] {[email protected]} test

Security concerns for the message tracking log

No message content is stored in the message tracking log. By default, the subject line of an email message is stored in the message tracking log. You might need to disable subject logging to comply with increased security or privacy requirements. For instructions on how to disable subject logging, see Configure message tracking.