Perform a Message Trace in Exchange Server

To perform a message trace, you can use the Get-MessageTrackingLog cmdlet in Exchange Management Shell.

For information on this command, see https://learn.microsoft.com/en-us/powershell/module/exchange/get-messagetrackinglog?view=exchange-ps

Examples:

To see the messages from a specific sender for the last 7 days, enter:

Get-MessageTrackingLog -Server <ExchangeServerComputerName> - Start (Get-Date).AddDays(-7) -End (Get-Date) -Sender "someone@somewhere.com"

To see the messages to a specific recipient for the last 14 days, enter:

Get-MessageTrackingLog -Server <ExchangeServerComputerName> - Start (Get-Date).AddDays(-14) -End (Get-Date) -Recipients "someone-else@somewhere.com"

You can combine sender and recipient to limit the returned results:

Get-MessageTrackingLog -Server <ExchangeServerComputerName> - Start (Get-Date).AddDays(-14) -End (Get-Date) -Sender "someone@somewhere.com" -Recipients "someone-else@somewhere.com"

To see the messages with that contain a specific subject line text, enter:

Get-MessageTrackingLog -Server CRUEXCH01 -Start (Get-Date).AddDays(-7) -End (Get-Date) -MessageSubject "Touching Base"