Scenario: You have a message that was delivered into Exchange 2013 within the last 30 days, but you cannot locate any Message Tracking log entries for that message. Clearly the message was delivered into the mailbox as the message header contains the Exchange 2013 server hops.
When we run the following in Exchange 2013, it outputs the following defaults:
get-transportservice Ex2013Srv1 | FL MessageTrackingLogMax*
MessageTrackingLogMaxAge: 30 Days MessageTrackingLogMaxDirectorySize: 1000 MB MessageTrackingLogMaxFileSize: 10MB
Looking deeper into the Message Tracking Logging in the actual File Directory where the messages are stored (C:Program FilesMicrosoftExchange ServerV15TransportRolesLogsMessageTracking), I see 30 days worth of logs and what appears to be well over 1000 MB in log files combined.
Here’s whats happening.
The Message Tracking Log Directory contains different message tracking log files, all prefixed with the type of Tracking Log it is.
MSGTRK - Logs associated with the Transport Service MSGTRKMA - Logs associated with the approvals and rejections MSGTRKMD - Logs associated with messages delivered to Mailboxes MSGTRKMS - Logs associated with messages sent from mailboxes
The 30 day max directory age OR the 1000 MB max directory size applies to the different message tracking log types separately. For example, I have 30 days worth of MSGTRKMS logs as there is less activity for sending messages from the transport service on the server and the combined MSGTRKMS logs are under 1000 MB in combined size. But I only have 20 days worth of MSGTRKMD logs as the combined log files size has met the 1000 MB limit. Circular logging kicks in and older log files that meets the max age or max size criteria are then replaced with newer message tracking logs.
In our scenario, the messages have aged off based on the size of the cumulative message tracking types and/or the date of when the files were created.
Ex-Shell 