none
Exchange tracking log for event id expand only showing 1 week of data RRS feed

  • Question

  • We have message tracking log enabled for one month and able to search messages against tracking logs but when i use message tracking with eventid expand command it is giving output for only 7 days.

    Get-MessageTrackingLog -resultsize unlimited -messagesubject "Information Security Awareness - SPAM & PHISHING ATTACK!!!" -EventID Expand -server servername | ? {$_.RelatedRecipientAddress -like "ausr@test.com"}

    Wednesday, September 4, 2019 4:49 AM

All replies

  • Hi,

    Make sure that the server you run this command contain these messages more than 7 days. 
    Try adding Get-TransportService | before your command.

    What if you delete the messagesubject parameter to get all the results and sort by timestamp, verify whether it will return data 7 days ago?

    Regards,

    Joyce Shen


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Thursday, September 5, 2019 2:34 AM
  • Hi,

    i have re-verified  this with Get-TransportService | before your command but still I am getting data for 7 days.

    same data after deleting messagesubject

    Thursday, September 5, 2019 12:59 PM
  • Hi,

    What's the result if you specify the searching date?

    Searching Message Tracking Logs by Time and Date Range

    Can the message tracking logs be searched in EAC?

    Regards,

    Joyce Shen


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.


    Friday, September 6, 2019 7:57 AM
  • Results are same even adding start date. I  tried to get event id expand data and it started from 30th Aug. 7 days data.
    Friday, September 6, 2019 9:04 AM
  • and with event id receive I am getting 1 month tracking logs.
    Friday, September 6, 2019 9:08 AM
  • Hello

    Only one excahnge server have got?


    sorry my english

    Friday, September 6, 2019 11:05 AM
  • All exchange server are showing same result.
    Friday, September 6, 2019 11:22 AM
  • Hello

    if run on all server:

    Get-MessageTrackingLog -ResultSize unlimited  -Start 2019.08.07 -End 2019.08.15 |fl > list.txt

    and in txt search for expand have got hit?

    and check messagetracking folser size. if folder size reach limit automatic override older logs.

    https://docs.microsoft.com/en-us/exchange/mail-flow/transport-logs/configure-message-tracking?view=exchserver-2019


    sorry my english


    • Edited by Sneff_Gabor Friday, September 6, 2019 11:32 AM
    Friday, September 6, 2019 11:28 AM
  • Mentioned command provides 1 month search result and there is no eventid EXPAND in output.
    Friday, September 6, 2019 11:45 AM
  • and have got group why need expand?
    Get-MessageTrackingLog -ResultSize unlimited  -Start 2019.08.07 -End 2019.08.15 -Recipients group name -server ...


    sorry my english


    • Edited by Sneff_Gabor Friday, September 6, 2019 12:34 PM
    Friday, September 6, 2019 11:55 AM
  • We need expand because we want to know who send an email to Distribution group so we want relatedrecipientaddress value against expand.
    Sunday, September 8, 2019 7:25 AM
  • Hi,

    I want to confirm that if you run the command now, will the data of 08/30 still be displayed? Or just show the data later than 09/02?

    Regards,

    Joyce Shen


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Monday, September 9, 2019 7:05 AM
  • If I run this command now, I can get data till  9/3/2019. 
    Wednesday, September 11, 2019 12:05 PM
  • Hello

    test please:

    $distributionGroups = Get-DistributionGroup | Select -expand PrimarySMTPAddress
    Foreach($distributionGroup in $distributionGroups){Get-MessageTrackingLog -Recipient $distributionGroup}


    sorry my english

    Wednesday, September 11, 2019 1:32 PM
  • so after running mentioned query, the last log I can see is of Timestamp     : 9/2/2019 1:40:39 PM.
    Thursday, September 12, 2019 4:48 AM
  • Hi,

    Type the message subject and time 7 days ago to get the whole log for that message info, will the expand event id disappear? I have test in my environment which the max age is set to 60 days and the expand log can be viewed normally.

    Regards,

    Joyce Shen


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Monday, September 16, 2019 8:35 AM
  • Hi,

    Is there any update about your issue?

    Regards,

    Joyce Shen


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Thursday, September 19, 2019 5:28 AM