Message tracking is best achieved from the Exchange Management Shell on the Exchange servers. If you wish to follow a message from mailbox servers to edge servers then you simply run the same tracking commands on the edge server Exchange Shell. The Exchange GUI does provide some form of message tracking, but seems to be clunky and unreliable.
The below command will get a list of messages received from a specific sender. The select statement will provide the message information to make it easier to identify the particular message you are looking for. (Open the EMC as an admin, right click “open as”.)
The MessageID is assigned to the message for its lifetime and so this can be used to follow a single message through multiple Exchange systems if desired.
Get-MessageTrackingLog -Sender email@example.com | select MessageID,timestamp,EventID,Source,Sender,Recipients,MessageSubject | Sort-Object TimeStamp | ft -autosize
If you are having issue with the output table formatting, increase the shell window buffer. Right click shell toolbar > Properties > Layout > Change “Screen Buffer Size” width to 500.
With the addition of a start date you can get the last 3 days of messages for that mail address. Particularly useful if the mailbox receives batch jobs of emails, it could contain hundreds of rows of messages.
Get-MessageTrackingLog -Sender firstname.lastname@example.org -start (get-date).adddays(-3) | select MessageID,timestamp,EventID,Source,Sender,Recipients,MessageSubject | Sort-Object TimeStamp | ft -autosize
Run the same commands on either the mailbox server or edge servers to track the messages.
If you have located the message you wish to track then use the MessageID to only find that message.
On an edge server this should only return a couple of tracking instances. “Receive” to Edge and “Send” to next hop(mailbox server or external smarthost).
On a mailbox server it will contain multiple entries for receive, send, storedriver, transport, mailbox, deliver, etc… The number and type will vary depending on the location of the mailbox.
The MessageID can also be used on external system such as Symantec.Cloud to locate a specific message.