locked
event id RRS feed

  • Question

  • Get-MailboxServer | get-messagetrackinglog -sender user1@mydomain.com -recipients user2@mydomain.com  -start "05/25/2018 00:00"  -end "05/25/2018 23:59" | select  MessageSubject,Timestamp,Eventid,Source,Sender,Recipients,SourceContext,MessageId,ServerHostname 
    | Export-Csv C:\report.csv -NoTypeInformation

    1 when i run the above command and when i filter the output in csv file i can eventid listed below 
    what does those eventid's mean
    HARECEIVE
    HADISCARD
    HAREDIRECT
    TRANFER
    AGENTINFO

    2. what does sourcecontext mean

    3. Under source i can see routing & agent, what does they mean.

    Thursday, June 28, 2018 6:06 PM

Answers

  • Hi Risingflight,

    HARECEIVE: A shadow message was received by the server in the local database availability group (DAG) or Active Directory site.  

    HADISCARD: A shadow message was discarded after the primary copy was delivered to the next hop. For more information.

    HAREDIRECT: A shadow message was created.

    AGENTINFO: This event is used by transport agents to log custom data.

    Sourcecontext: Extra information associated with the source field.

    Such as when the source is StoredDriver, the information in Sourcecontext will related with database and mailbox.

    For more information, you can have a look about this article: https://docs.microsoft.com/en-us/Exchange/mail-flow/transport-logs/message-tracking 

    Regards,

    Kyle Xu


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.

    Friday, June 29, 2018 6:58 AM
  • Hi Risingflight,

    From the information that you provided to us, we cannot know the whole mail flow about this mail. If you want to get better help, you should provide complete information, not part of the information.

    If we send mails to internet, we can see a event id "SendExternal" which means mail leaves your server.

    By the way, we discuss only one major issue in a thread, if you have issue with this mail's mail flow, I suggest you open another thread for better help.

    Regards,

    Kyle Xu


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.

    Monday, July 2, 2018 2:13 AM

All replies

  • Hi Risingflight,

    HARECEIVE: A shadow message was received by the server in the local database availability group (DAG) or Active Directory site.  

    HADISCARD: A shadow message was discarded after the primary copy was delivered to the next hop. For more information.

    HAREDIRECT: A shadow message was created.

    AGENTINFO: This event is used by transport agents to log custom data.

    Sourcecontext: Extra information associated with the source field.

    Such as when the source is StoredDriver, the information in Sourcecontext will related with database and mailbox.

    For more information, you can have a look about this article: https://docs.microsoft.com/en-us/Exchange/mail-flow/transport-logs/message-tracking 

    Regards,

    Kyle Xu


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.

    Friday, June 29, 2018 6:58 AM
  • In the below screenshot  my application has sent an email to external user on 29/06.the user wants to know that his email has left exchange server or not. looking below screenshot how can i say that his mail has left the server

    Friday, June 29, 2018 2:26 PM
  • Hi Risingflight,

    From the information that you provided to us, we cannot know the whole mail flow about this mail. If you want to get better help, you should provide complete information, not part of the information.

    If we send mails to internet, we can see a event id "SendExternal" which means mail leaves your server.

    By the way, we discuss only one major issue in a thread, if you have issue with this mail's mail flow, I suggest you open another thread for better help.

    Regards,

    Kyle Xu


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.

    Monday, July 2, 2018 2:13 AM
  • i tried the below syntax but i am not getting output please help me

    Get-MailboxServer | get-messagetrackinglog -sender user1@mydomain.com -recipients user2@mydomain.com  -start "06/28/2018 00:00"  -end "06/28/2018 23:59"  -MessageSubject "To internet" | Export-Csv C:\report.csv -NoTypeInformation

    Monday, July 2, 2018 5:11 AM
  • Hi Risingflight,

    Because, you don't have a mail which subject is "To internet". I send a mail to a account which out of my domain and its subject is "To internet".

    This thread's topic is "event id", so if you still confuse about mail flow, I suggest you open other thread.

    Regards,

    Kyle Xu


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.

    Monday, July 2, 2018 6:06 AM
  • sorry i got confused
    Monday, July 2, 2018 7:06 AM
  • Hi Risingflight,

    Where do you send mails from and where do you want send mails to?

    First you said "How can I say that his mail has left the server ", then you said "-sender user1@mydomain.com -recipients user2@mydomain.com"

    So, you want send mail inside your organization or send mail from your organization to internet?

    If you want send mails inside your organization, how many Exchange servers in your organization? Why you said "How can I say that his mail has left the server"

    Regards,

    Kyle Xu


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.

    Tuesday, July 3, 2018 1:37 AM