Share via


event id

Question

Thursday, June 28, 2018 6:06 PM

Get-MailboxServer | get-messagetrackinglog -sender [email protected] -recipients [email protected]  -start "05/25/2018 00:00"  -end "05/25/2018 23:59" | select  MessageSubject,Timestamp,Eventid,Source,Sender,Recipients,SourceContext,MessageId,ServerHostname 
| Export-Csv C:\report.csv -NoTypeInformation

1 when i run the above command and when i filter the output in csv file i can eventid listed below 
what does those eventid's mean
HARECEIVE
HADISCARD
HAREDIRECT
TRANFER
AGENTINFO

2. what does sourcecontext mean

3. Under source i can see routing & agent, what does they mean.

All replies (7)

Friday, June 29, 2018 6:58 AM ✅Answered

Hi Risingflight,

HARECEIVE: A shadow message was received by the server in the local database availability group (DAG) or Active Directory site.  

HADISCARD: A shadow message was discarded after the primary copy was delivered to the next hop. For more information.

HAREDIRECT: A shadow message was created.

AGENTINFO: This event is used by transport agents to log custom data.

Sourcecontext: Extra information associated with the source field.

Such as when the source is StoredDriver, the information in Sourcecontext will related with database and mailbox.

For more information, you can have a look about this article: /en-us/Exchange/mail-flow/transport-logs/message-tracking 

Regards,

Kyle Xu

Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact [email protected].

Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.


Monday, July 2, 2018 2:13 AM ✅Answered

Hi Risingflight,

From the information that you provided to us, we cannot know the whole mail flow about this mail. If you want to get better help, you should provide complete information, not part of the information.

If we send mails to internet, we can see a event id "SendExternal" which means mail leaves your server.

By the way, we discuss only one major issue in a thread, if you have issue with this mail's mail flow, I suggest you open another thread for better help.

Regards,

Kyle Xu

Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact [email protected].

Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.


Friday, June 29, 2018 2:26 PM

In the below screenshot  my application has sent an email to external user on 29/06.the user wants to know that his email has left exchange server or not. looking below screenshot how can i say that his mail has left the server


Monday, July 2, 2018 5:11 AM

i tried the below syntax but i am not getting output please help me

Get-MailboxServer | get-messagetrackinglog -sender [email protected] -recipients [email protected]  -start "06/28/2018 00:00"  -end "06/28/2018 23:59"  -MessageSubject "To internet" | Export-Csv C:\report.csv -NoTypeInformation


Monday, July 2, 2018 6:06 AM

Hi Risingflight,

Because, you don't have a mail which subject is "To internet". I send a mail to a account which out of my domain and its subject is "To internet".

This thread's topic is "event id", so if you still confuse about mail flow, I suggest you open other thread.

Regards,

Kyle Xu

Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact [email protected].

Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.


Monday, July 2, 2018 7:06 AM

sorry i got confused


Tuesday, July 3, 2018 1:37 AM

Hi Risingflight,

Where do you send mails from and where do you want send mails to?

First you said "How can I say that his mail has left the server ", then you said "-sender [email protected] -recipients [email protected]"

So, you want send mail inside your organization or send mail from your organization to internet?

If you want send mails inside your organization, how many Exchange servers in your organization? Why you said "How can I say that his mail has left the server"

Regards,

Kyle Xu

Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact [email protected].

Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.