I have 4 Exchange Hub Transport serveres. 2 of them use as to relay email from application servers. Logging was enabled on both the server.
I have application server try to send an email, received undelivered
<email@example.com>: host smtp.contoso.com[192.168.1.1] said:
530 5.7.1 Client was not authenticated (in reply to MAIL FROM command)
So, I went to SMTP Receive protocol log and look for specific log. Say email was sent at 10.00am, so i look for log which modified at 10:10am, do searching by IP address, however i can't found the SMTP session from 192.168.1.1
Is the log only for sucess SMTP session?