Hello!
I read this article http://technet.microsoft.com/ru-ru/library/bb124375%28v=exchg.150%29.aspx#Structure and still don't understand the following:
"
Example entries in the message tracking logAn uneventful message sent between two users generates several entries in the message tracking log. You can see the results using theGet-MessageTrackingLog cmdlet. For more information, see Search Message Tracking Logs.
This is a condensed example of the message tracking log entries created when the user chris@contoso.com successfully sends a test message to the user michelle@contoso.com. Both users have mailboxes on the same server.
EventId Source Sender Recipients MessageSubject
------- ------ ------ ---------- --------------
NOTIFY STOREDRIVER {}
RECEIVE STOREDRIVER chris@contoso.com {michelle@contoso.com} test
SUBMIT STOREDRIVER chris@contoso.com {michelle@contoso.com} test
HAREDIRECT SMTP chris@contoso.com {michelle@contoso.com} test
RECEIVE SMTP chris@contoso.com {michelle@contoso.com} test
AGENT AGENT chris@contoso.com {michelle@contoso.com} test
SEND SMTP chris@contoso.com {michelle@contoso.com} test
DELIVER STOREDRIVER chris@contoso.com {michelle@contoso.com} test"
1) Of what exactly message tracking log are these entries? There are four types of message tracking logs as was shown earlier:
- MSGTRK These logs are associated with the Transport service.
- MSGTRKMA These logs are associated with the approvals and rejections used by moderated transport. For more information, seeУправляемый транспорт.
- MSGTRKMD These logs are associated with messages delivered to mailboxes by the Mailbox Transport Delivery service.
- MSGTRKMS These logs are associated with messages sent from mailboxes by the Mailbox Transport Submission service.
2) What is the methodology of registering some event in these logs - for example, when user1@domain.com sends a message to user2@domain.com (located on the same server, exactly as in the aforementioned example), - in which log(s) what information must be logged? Should it be duplicated across multiple logs (say in MSGTRK and MSGTRKMD)?
3) After I repeated this test ("when the user chris@contoso.com successfully sends a test message to the user michelle@contoso.com. Both users have mailboxes on the same server.") I was able to find neither SENDER nor RECIPIENTS
addresses in any of the logs - just something like "<9a71b6ac-dafd-41ef-bb60-dc2ea3444c18@EXCHANGE.Test2.Local>" instead of the ~"user@Test2.Local". Nor did I find the message itself, although I can easily find it in ECP...
Thank you in advance,
Michael Firsov