Hi everybody.

I had been tasked with tracking down a user's emails.

I ran a script in powershell to export data I could work with.

For some reason this particular user's emails in this time range do not show up as the EVENTID "SEND".

They also do not have a Byte Count nor a list of recipients.

They only seem to show up as "SUBMIT"

Apparently this user has been sending out emails with a large amount of BCCs.

Is there any way to actually see this activity? Why would it be showing up as SUBMIT and not SEND? Why won't it show any recipients or byte count?

Here is my example script.

Get-MessageTrackingLog -ResultSize Unlimited -Server "contoso-ex1" -Start "5/1/2014 12:01:00 AM" -End "5/8/2014 6:40:00 PM" | Select Sender,{$_.Recipients},{$_.RecipientStatus},MessageSubject,TimeStamp, EventId, Source,SourceContext,MessageId,InternalMessageId,ClientIP,ClientHostName,ServerIP,ServerHostName,ConnectorId,TotalBytes,RecipientCount,RelatedRecipientAddress,Reference,ReturnPath,MessageInfo | Export-Csv .\MessageTrackingLog.csv

Please note that only this one user's emails are showing only as SUBMIT. The rest are mostly SEND.

Hi Timssims,

You can download Email stats script from below Technet resource which will produce entire email stats report in CSV. It will help you to check mailbox tracking log in exchange 2010 :

http://gallery.technet.microsoft.com/scriptcenter/bb94b422-eb9e-4c53-a454-f7da6ddfb5d6

Further, if you still persist with same issue, you can have a look at this very prominent application(http://www.exchangereports.net/) which provide email tracking report at granular level with real time monitoring (includes of all users sent/received emails organization wide or outside the organization).

Hi,

Id like to double confirm the question: This issue occurred only on one specific user in a particular time range. In other time, the message tracking shows correctly information for this user.

I suggest we check the application log during that time range and see whether there are any related event IDs about this user.

Thanks,

Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

Hi,

Is there any update on this thread?

Thanks,

Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

Hi,

Is there any update on this thread?

Thanks,

Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com