For more information, see Foreign connectors. Sign up or log in Sign up using Google. Might contain the Internal-Message-Id value. A message was received by the SMTP receive component of the transport service or from the Pickup or Replay directories source: The removal of recipients is the only way to apply multiple policies to a single message, no messages are lost due to this behavior Similar behavior is seen when an Exchange redirect transport rule is used What To Do The FAIL event appearing in the Exchange Message Tracking logs for this reason is expected behavior and can be safely ignored, no action is required. A shadow message failed to be created. I had the exact same issue this week and it took me days to figure out.

Uploader: Shaktik
Date Added: 16 June 2015
File Size: 23.58 Mb
Operating Systems: Windows NT/2000/XP/2003/2003/7/8/10 MacOS 10/X
Downloads: 5485
Price: Free* [*Free Regsitration Required]

Other messaging systems may use different syntax or values.

Very Important MessageThis is ie email from Alan. Recipients were moved to a forked message because of content conversion, message recipient limits, or agents. The value is Message Tracking Log.

Tracking messages in Exchange log files – easy and quick!

eent A moderator for a moderated recipient approved the message, so the message was delivered to the moderated recipient. The message transmission from the Mailbox Transport Submission service to the Transport service was deferred. As the internal network works on ipv4, I temporarily disabled ipv6 in the network settings, and in the EAC under message flow: If you have single exchange server with all roles. The UTC date-time of the message tracking event.


For more information, see Shadow redundancy. Every comment submitted here is read by a human but we do not reply to specific technical questions. The IPv4 or IPv6 address of the messaging server or messaging client that submitted the message.

How to Tell Which Transport Rule Was Applied to an Email Message

Multiple email addresses are separated by the semicolon character. A shadow message was discarded after the primary copy was delivered to the next hop. A shadow message failed to be created. Get-MessageTrackingLog have only one unpleasant feature: You are commenting using your Facebook account. A log file reaches its maximum age. Choose the type you’d like to provide: The message event information is organized by fields, and these fields are separated by commas.

First of all, we need to install Log Parser 2. I had the exact same issue this week and it took me days to figure out.

See below link for details of all message tracking log events https: Source values in the message tracking log The values in the source field in the message tracking log indicate faul transport component that’s responsible for the message tracking event.


The event source was a MAPI submission from a mailbox on the local server. The Microsoft Exchange Mail Submission service on a Mailbox server successfully notified a Hub Transport server that a message is awaiting submission to the Hub.

I am investigating to see if there is a way you can see which transport rules is applying to a certain message. I can think of a few cases where this might be useful.

So, what can the message tracking logs tell us? On Mailbox servers, the maximum size of the message tracking log folder is three times the specified value.

Next, I sort the events by time stamp, and look at the EventId, Source, and MessageSubject fields because we already know the message subject was modified.

Administrators can use this Exchange Management Shell cmdlet to search stredriver message tracking log for information about messages using a wide range of filter criteria. A message submitted by the Pickup directory or the Evejt directory that can’t be delivered or returned.

A message was automatically resubmitted from Safety Net.

The event source was the approval framework that’s used with moderated recipients.

Author: admin