Hi,

Where can I find the log files for both incoming and outgoing e-mails including accepted and rejected messages for all internal and external e-mails.

Thanks for your help in advance.

Regards,

Azeezullah

The paths are shown in the properties of the receive and send connectors.  There will only be logs if you have enabled protocol logging on the individual c

Hi Azeezullah,

Except protocol logs, you can also check the message tracking logs.

In Microsoft Exchange Server 2013, the message tracking log is a detailed record of all message activity as messages are transferred to and from the Transport service on Mailbox servers, mailboxes on Mailbox servers, and Edge Transport servers.

Best regards,

Protocol log is virtually useless if you want to trace "all internal and external e-mails". The feature is used for troubleshooting purpose and should not be enabled for long term. Also it is very difficult to read the protocol log.

The proper way is to look at the message tracking log.

Unfortunately in many cases it's all we have at our disposal.  The message tracking log may not have the required in

Sorry, Ed. That's not very helpful. You may like to provide some details of what info is not available in message tracking log.

• Edited by Li Zhen 1 hour 49 minutes ago

Sorry, Ed. That's not very helpful. You may like to provide some details of what info is not available in message tracking log.

• Edited by Li Zhen Thursday, July 23, 2015 5:41 AM

Failure information, for example.  The question asked for accepted and rejected e-mails.  Message tracking simply may not have everything he's a

There is a fail record in message tracking log if email is not delivered. Although it may not tell why it fails, that's not the concern in this thread.

The problems of protocol log,

• It's a troubleshooting feature, not suitable to be enabled massively or for long term.
• There's no way to do filtering. Hence no way to generate report or statistics.
• Message subject (often used as search criteria) is not recorded.

That's why I said it's virtually useless.

• Edited by Li Zhen 14 hours 55 minutes ago

I never proposed that the protocol logs are an all-purpose logging tool, just an answer to the specific problem the poster requested.  He asked specifically for inbound and outbound traffic, and the protocol logs give him that without all the overhead of the message tracking logs.

There is a fail record in message tracking log if email is not delivered. Although it may not tell why it fails, that's not the concern in this thread.

The problems of protocol log,

• It's a troubleshooting feature, not suitable to be enabled massively or for long term.
• There's no way to do filtering. Hence no way to generate report or statistics.
• Message subject (often used as search criteria) is not recorded.

That's why I said it's virtually useless.

• Edited by Li Zhen Thursday, July 23, 2015 4:33 PM

What do you mean by "overhead of message tracking log"?

MTL is enabled by default on all system all time. And it's searchable, filterable.

You proposed to enable protocol log on verbose mode. Even though it's difficult to search, not filterable, and it's missing key information.

Which one has more overhead?

I proposed a solution.  I maintain it's valid for the purpose I interpreted the question to be asking for.

That's ok.

Just curious how would you interpret the following?

• Traceability of all incoming and outgoing email
• Overhead of message tracking logs
• Overhead of protocol log in verbose mode

No need to answer though, lol.

The question was thus:

Where can I find the log files for both incoming and outgoing e-mails including accepted and rejected messages for all internal and external e-mails.

I think my suggestion answers that if what he wants is "incoming and outgoing".  I never said your answer was wrong, so I don't know why you're in attack mode.  The message tracking logs are better if he's looking for internal messages as well, but there will be a lot more data to sort through.

"I never said your answer was wrong, so I don't know why you're in attack mode."

I really don't know why you think I'm in attack mode while I'm trying to help the poster by giving right answer.

"The message tracking logs are better if he's looking for internal messages as well, but there will be a lot more data to sort through."

MTL is well formatted. Get-MessageTrackingLog has lots of parameters you can use to handle MTL. What can you do with protocol log besides keyword search in a text editor?

• Edited by Li Zhen 1 hour 40 minutes ago

I often open it with Excel, but that's kind of beside the point.  Again, depending on what he's really looking for, either log could

"I never said your answer was wrong, so I don't know why you're in attack mode."

I really don't know why you think I'm in attack mode while I'm trying to help the poster by giving right answer.

"The message tracking logs are better if he's looking for internal messages as well, but there will be a lot more data to sort through."

MTL is well formatted. Get-MessageTrackingLog has lots of parameters you can use to handle MTL. What can you do with protocol log besides keyword search in a text editor?

• Edited by Li Zhen Friday, July 24, 2015 5:48 AM