Answered by:
event id

Question
-
Get-MailboxServer | get-messagetrackinglog -sender user1@mydomain.com -recipients user2@mydomain.com -start "05/25/2018 00:00" -end "05/25/2018 23:59" | select MessageSubject,Timestamp,Eventid,Source,Sender,Recipients,SourceContext,MessageId,ServerHostname
| Export-Csv C:\report.csv -NoTypeInformation
1 when i run the above command and when i filter the output in csv file i can eventid listed below
what does those eventid's mean
HARECEIVE
HADISCARD
HAREDIRECT
TRANFER
AGENTINFO2. what does sourcecontext mean
3. Under source i can see routing & agent, what does they mean.
Thursday, June 28, 2018 6:06 PM
Answers
-
Hi Risingflight,
HARECEIVE: A shadow message was received by the server in the local database availability group (DAG) or Active Directory site.
HADISCARD: A shadow message was discarded after the primary copy was delivered to the next hop. For more information.
HAREDIRECT: A shadow message was created.
AGENTINFO: This event is used by transport agents to log custom data.
Sourcecontext: Extra information associated with the source field.Such as when the source is StoredDriver, the information in Sourcecontext will related with database and mailbox.
For more information, you can have a look about this article: https://docs.microsoft.com/en-us/Exchange/mail-flow/transport-logs/message-tracking
Regards,
Kyle Xu
Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.
Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.
- Marked as answer by Risingflight Friday, June 29, 2018 2:25 PM
- Unmarked as answer by Risingflight Sunday, July 1, 2018 5:49 PM
- Proposed as answer by Kyle.XuMicrosoft contingent staff Monday, July 2, 2018 2:13 AM
- Marked as answer by Risingflight Tuesday, July 10, 2018 5:39 PM
Friday, June 29, 2018 6:58 AM -
Hi Risingflight,
From the information that you provided to us, we cannot know the whole mail flow about this mail. If you want to get better help, you should provide complete information, not part of the information.
If we send mails to internet, we can see a event id "SendExternal" which means mail leaves your server.
By the way, we discuss only one major issue in a thread, if you have issue with this mail's mail flow, I suggest you open another thread for better help.
Regards,
Kyle Xu
Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.
Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.
- Proposed as answer by Kyle.XuMicrosoft contingent staff Wednesday, July 4, 2018 9:19 AM
- Marked as answer by Risingflight Tuesday, July 10, 2018 5:40 PM
Monday, July 2, 2018 2:13 AM
All replies
-
Hi Risingflight,
HARECEIVE: A shadow message was received by the server in the local database availability group (DAG) or Active Directory site.
HADISCARD: A shadow message was discarded after the primary copy was delivered to the next hop. For more information.
HAREDIRECT: A shadow message was created.
AGENTINFO: This event is used by transport agents to log custom data.
Sourcecontext: Extra information associated with the source field.Such as when the source is StoredDriver, the information in Sourcecontext will related with database and mailbox.
For more information, you can have a look about this article: https://docs.microsoft.com/en-us/Exchange/mail-flow/transport-logs/message-tracking
Regards,
Kyle Xu
Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.
Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.
- Marked as answer by Risingflight Friday, June 29, 2018 2:25 PM
- Unmarked as answer by Risingflight Sunday, July 1, 2018 5:49 PM
- Proposed as answer by Kyle.XuMicrosoft contingent staff Monday, July 2, 2018 2:13 AM
- Marked as answer by Risingflight Tuesday, July 10, 2018 5:39 PM
Friday, June 29, 2018 6:58 AM -
In the below screenshot my application has sent an email to external user on 29/06.the user wants to know that his email has left exchange server or not. looking below screenshot how can i say that his mail has left the server
- Edited by Risingflight Sunday, July 1, 2018 5:57 PM f
Friday, June 29, 2018 2:26 PM -
Hi Risingflight,
From the information that you provided to us, we cannot know the whole mail flow about this mail. If you want to get better help, you should provide complete information, not part of the information.
If we send mails to internet, we can see a event id "SendExternal" which means mail leaves your server.
By the way, we discuss only one major issue in a thread, if you have issue with this mail's mail flow, I suggest you open another thread for better help.
Regards,
Kyle Xu
Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.
Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.
- Proposed as answer by Kyle.XuMicrosoft contingent staff Wednesday, July 4, 2018 9:19 AM
- Marked as answer by Risingflight Tuesday, July 10, 2018 5:40 PM
Monday, July 2, 2018 2:13 AM -
i tried the below syntax but i am not getting output please help me
Get-MailboxServer | get-messagetrackinglog -sender user1@mydomain.com -recipients user2@mydomain.com -start "06/28/2018 00:00" -end "06/28/2018 23:59" -MessageSubject "To internet" | Export-Csv C:\report.csv -NoTypeInformation
Monday, July 2, 2018 5:11 AM -
Hi Risingflight,
Because, you don't have a mail which subject is "To internet". I send a mail to a account which out of my domain and its subject is "To internet".
This thread's topic is "event id", so if you still confuse about mail flow, I suggest you open other thread.
Regards,
Kyle Xu
Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.
Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.
Monday, July 2, 2018 6:06 AM -
sorry i got confusedMonday, July 2, 2018 7:06 AM
-
Hi Risingflight,
Where do you send mails from and where do you want send mails to?
First you said "How can I say that his mail has left the server ", then you said "-sender user1@mydomain.com -recipients user2@mydomain.com"
So, you want send mail inside your organization or send mail from your organization to internet?
If you want send mails inside your organization, how many Exchange servers in your organization? Why you said "How can I say that his mail has left the server"
Regards,
Kyle Xu
Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.
Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.
Tuesday, July 3, 2018 1:37 AM