Exchange Message Tracking from the Command Line

You can use the Exchange shell to track messages that could not be delivered because of message size issues. The RecipientStatus field in Message Tracking logs is used to store the SMTP response and enhanced status codes. The Message Tracking EventID we’re looking for is FAIL.

To track messages that failed because of recipient’s MaxReceiveSize:

Get-MessageTrackingLog -EventID FAIL | where {$_.RecipientStatus -like “*RecipSizeLimit*”}

To track messages that failed because of the sender’s MaxSendSize:

Get-MessageTrackingLog -EventID FAIL | where {$_.RecipientStatus -like “*SendSizeLimit*”}

https://practical365.com/exchange-server/searching-message-tracking-logs-by-email-subject/

Get-MessageTrackingLog -MessageSubject "Important: Password Expiration Notification"

Get-MessageTrackingLog -sender "foo@somedomain.com"

Get-MessageTrackingLog -Sender foo@somedomain.com -Start (Get-Date).AddHours(-1)

Get-MessageTrackingLog -Sender foo@somedomain.com -Recipients foo@mydomain.com

Get-MessageTrackingLog -Sender foo@somedomain.com -Recipients foo@mydomain.com,another@mydomain.com

Get-MessageTrackingLog -ResultSize Unlimited -Start "01-01-2019" -End "01-15-2019" | where{$_.sender -like "*@senderdomain.tld"}

Get-MessageTrackingLog -Recipients "foo@mydomain.com"

Get-MessageTrackingLog -Recipients *@gmail.com

Get-MessageTrackingLog -Start (Get-Date).AddHours(-1) | Where-Object {$_.recipients -like "*@gmail.com"}

Get-MessageTrackingLog -Start (Get-Date).AddHours(-1) | Where-Object {$_.recipients -match "gmail"}

The -match comparison operator does not require the wildcard character.