Message Tracking Aging in Exchange 2013

Scenario: You have a message that was delivered into Exchange 2013 within the last 30 days, but you cannot locate any Message Tracking log entries for that message.  Clearly the message was delivered into the mailbox as the message header contains the Exchange 2013 server hops.

When we run the following in Exchange 2013, it outputs the following defaults:

get-transportservice Ex2013Srv1 | FL MessageTrackingLogMax*

MessageTrackingLogMaxAge:           30 Days
MessageTrackingLogMaxDirectorySize: 1000 MB
MessageTrackingLogMaxFileSize:      10MB

Looking deeper into the Message Tracking Logging in the actual File Directory where the messages are stored (C:Program FilesMicrosoftExchange ServerV15TransportRolesLogsMessageTracking), I see 30 days worth of logs and what appears to be well over 1000 MB in log files combined.

Here’s whats happening.

The Message Tracking Log Directory contains different message tracking log files, all prefixed with the type of Tracking Log it is.

MSGTRK - Logs associated with the Transport Service
MSGTRKMA - Logs associated with the approvals and rejections
MSGTRKMD - Logs associated with messages delivered to Mailboxes
MSGTRKMS - Logs associated with messages sent from mailboxes

The 30 day max directory age OR the 1000 MB max directory size applies to the different message tracking log types separately.  For example, I have 30 days worth of MSGTRKMS logs as there is less activity for sending messages from the transport service on the server and the combined MSGTRKMS logs are under 1000 MB in combined size.  But I only have  20 days worth of MSGTRKMD logs as the combined log files size has met the 1000 MB limit.  Circular logging kicks in and older log files that meets the max age or max size criteria are then replaced with newer message tracking logs.

In our scenario,  the messages have aged off based on the size of the cumulative message tracking types and/or the date of when the files were created.




Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: