Call Us! 1-800-383-5193
Call Us! 1-800-383-5193
Call Us! 1-800-383-5193

Need Help?

Emergency Response Time custom

Our experts have had an average response time of 11.06 minutes in March 2021 to fix urgent issues.

We will keep your servers stable, secure and fast at all times for one fixed price.

Exchange 2016 Search Message Tracking Logs – How we do it

by | Dec 12, 2020

In Exchange 2016, the easy way to search the message tracking logs is to use the Get-MessageTrackingLog cmdlet.

Here at Bobcares, we have seen several such Microsoft Exchange related queries as part of our Server Management Services for web hosts and online service providers.

Today we will take a look at how to track logs in Exchange 2016


Search message tracking logs

Message tracking records the message activity as mail flows through the transport pipeline on Mailbox servers and Edge Transport servers. The best way to search the message tracking logs is to use the Get-MessageTrackingLog cmdlet in the Exchange Management Shell.

We make use of some search criteria to search for entries in the message tracking log. Here are some:

  • Find out what happened to a message that was sent by a user to a specific recipient.
  • Detect if a mail flow rule is acting on a message.
  • Find out if a message sent from an Internet sender made it into your Exchange organization.
  • Find all messages sent by a specified user during a specified time period.


Exchange 2016 search message tracking logs

Now let’s take a look at the commands our Support Engineers use to search message tracking logs.

To display the information about the Exchange events page-by-page, we run the command:

Get-MessageTrackingLog | Out-Host –Paging

To display the data in the table format and adjust the column width, we use the Format-Table cmdlet:

Get-MessageTrackingLog | Format-Table –AutoSize

If several Hub Transport servers are used in the Exchange organization, we need to specify the name of a server to search as an argument of the –Server parameter. Or else, we run the message tracking command for each of the Hub Transport servers with the pipe:

Get-TransportServer | Get-MessageTrackingLog

Let’s display all emails for the last 24 hours ((Get-Date).AddHours(-24)), in which a recipient from domain is specified:

Get-MessageTrackingLog -Start (Get-Date).AddHours(-24) -ResultSize unlimited | where {[string]$_.recipients -like "*"}

We run the below command to display all emails sent by the specific user through a certain server in a given period of time.

Get-MessageTrackingLog -ResultSize unlimited –Sender "” –server rome-hub-01 -Start "11/30/2020 06:00:00" -End "12/13/2020 22:00:00" |select-object Timestamp,Sender,Recipients,MessageSubject,EventId|ft

Also, we can find all the emails sent by a user to any other user and export the search results into a CSV file. For that, we run the below command.

Get-MessageTrackingLog -Sender "" -Recipients "" -ResultSize unlimited –server rome-hub-01| Select-Object Timestamp,Sender,{$_.recipients},MessageSubject | Export-Csv -Path "C:\Export\exchange\exchange_tracking_logs.csv" -Encoding Default -Delimiter ";"

Also, we can search by message subject. Here is the command we run to display all emails with the “test” word in the subject field, run the following command.

Get-MessageTrackingLog -MessageSubject "test" -ResultSize unlimited –server rome-hub-01| Select-Object Timestamp,Sender, {$_.recipients}, MessageSubject | out-gridview

In case, if we have the message ID then we run the below.

Get-MessageTrackingLog -messageID "" -ResultSize unlimited –server rome-hub-01| Select-Object Timestamp,Sender, {$_.recipients}, MessageSubject

Moreover, to count the number of incoming email messages for the specific mailbox for the last 7 days, we run the following command:

(Get-MessageTrackingLog -EventID "RECEIVE" -Recipients "" -ResultSize unlimited).Count

[Need any further assistance with Exchange queries? – We are here to help you]



In short, we can search the message tracking logs by using the Get-MessageTrackingLog cmdlet in Exchange 2016. Today, we saw how our Support Engineers do it.


Never again lose customers to poor server speed! Let us help you.

Our server experts will monitor & maintain your server 24/7 so that it remains lightning fast and secure.


var google_conversion_label = "owonCMyG5nEQ0aD71QM";


Submit a Comment

Your email address will not be published. Required fields are marked *

Privacy Preference Center


Necessary cookies help make a website usable by enabling basic functions like page navigation and access to secure areas of the website. The website cannot function properly without these cookies.

PHPSESSID - Preserves user session state across page requests.

gdpr[consent_types] - Used to store user consents.

gdpr[allowed_cookies] - Used to store user allowed cookies.

PHPSESSID, gdpr[consent_types], gdpr[allowed_cookies]


Statistic cookies help website owners to understand how visitors interact with websites by collecting and reporting information anonymously.

_ga - Preserves user session state across page requests.

_gat - Used by Google Analytics to throttle request rate

_gid - Registers a unique ID that is used to generate statistical data on how you use the website.

smartlookCookie - Used to collect user device and location information of the site visitors to improve the websites User Experience.

_ga, _gat, _gid
_ga, _gat, _gid


Marketing cookies are used to track visitors across websites. The intention is to display ads that are relevant and engaging for the individual user and thereby more valuable for publishers and third party advertisers.

IDE - Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user.

test_cookie - Used to check if the user's browser supports cookies.

1P_JAR - Google cookie. These cookies are used to collect website statistics and track conversion rates.

NID - Registers a unique ID that identifies a returning user's device. The ID is used for serving ads that are most relevant to the user.

DV - Google ad personalisation

IDE, test_cookie, 1P_JAR, NID, DV, NID
IDE, test_cookie


These are essential site cookies, used by the google reCAPTCHA. These cookies use an unique identifier to verify if a visitor is human or a bot.