searching exchange logs

I am using exchange 2013, and I've ran the following PS command, but it's not very good,as it doesn't tell me much.

get-messagetrackinglog -resultsize unlimited -sender "sender@domain.com" -start "date" -end "date" | out-gridview

So you can see from the attache screen that it actually doesn't show date/time in the output, which is not very helpful.

Also, my problem is that I have a user that said he sent an email at 7:33 am, but no one every received it, as it went to a DL.  So how can I research this to see why exchange never sent the email.  The strange thing is that when a different user sent out an email to the same DL, it worked fine.

Any ideas?  How can I search in exchange, in the ECP, as that will be easier to search?

error
DanNetwork EngineerAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

AmitIT ArchitectCommented:
First check if user is allowed to send email to that DL
0
DanNetwork EngineerAuthor Commented:
Yes he is, but how do I check that, because I thought anyone can send email to a DL?
0
Dave GouldOnsite SupportCommented:
By default, using out-gridview only shows a limited number of columns but you can change what is displayed by using select. ie :
get-messagetrackinglog -resultsize unlimited -sender sender@domain.com | select EventId, Source, timestamp, recipients, messagesubject |out-gridview

Also, if you have more thzan one mail hub, you shoul prefix the command with get-TransportServer

ie
get-TransportServer | get-messagetrackinglog -resultsize unlimited .....etc
0
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

DanNetwork EngineerAuthor Commented:
I don't think I do.

Also, how can I follow every transaction and the sequence and why it failed?

Is there any way to search for what I'm looking for in the ECP?
0
Dave GouldOnsite SupportCommented:
First check the eventid. Did you see the mail in question in the transport logs?
If so what eventID's does it show?
Does your exchange send directly to the Internet or does it go via a relay?
You might want to check the transport logs on the server. (should be something like "exchange\TransportRoles\Logs\ProtocolLog\SmtpSend\SENDyyyymmdd-1.log"
0
DanNetwork EngineerAuthor Commented:
well, my logs are here:
transportroles\logs\hub\protocol\smtpsend
There's no files in that folder

Then for the smtpreceive:
transportroles\logs\hub\protocol\smtpreceive
There's only 1 file from over 1 month ago, with a 0 kb

Apparently either logging is turned off, or they are somewhere else?

Not sure what to do?
0
DanNetwork EngineerAuthor Commented:
I did a search in powershell, and here's what came up, now what do I do this this, how can I research this further to see why the routing failed.  Why didn't the email from home get sent correctly?

error
0
Dave GouldOnsite SupportCommented:
First of all, it does appear that your protocol logging is turned off so you might want to turn it on for future issues. This is done on the "log settings" tab on the hub server settings via the EMC console.

On the tracking log, you have an HAREDIRECTFAIL. This is for the shadow redundancy in a multi server environment. you can turn it off if you are not using the HA features. Here is a useful link giving more info:
http://technet.microsoft.com/en-us/library/jj657506(v=exchg.150).aspx

On the other hand, it is difficult to see where the routing fail comes from
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
DanNetwork EngineerAuthor Commented:
Hello Dave,

Are you referring to servers -> servers -> and then "transport logs" section?
Both Message tracking log and connectivity log settings are enabled.
If you're referring about another place, then I'm not sure what you're referring to?

I'll review the website you mentioned.

I only have 1 exchange server, so I do not have any HA enabled.

I can't believe that it's this hard to try to fire out why an email that a user sent internally did not get delivered to other users internally.  Every user is an internal user, so that just frustrates me as why Microsoft makes it so hard.

So are there any commands I need to know to be able to run that will give me more information about why it failed?
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.