Home » Exchange » How to View Exchange Server Logs: A Step-by-Step Guide

How to View Exchange Server Logs: A Step-by-Step Guide

Tej Pratap Shukla | Modified: December 24, 2024 | Exchange | 8 Minutes Reading

Are you an admin who finds it difficult to understand how to view Exchange Server logs? This difficulty can slow down your productivity. Regularly monitoring these Exchange Server logs enables admins to diagnose problems in the on-premise server setup.

Don’t worry as we will teach you exactly how to set and check logs. These steps would be applicable in different scenarios like those who operate a single stand-alone server, or a a multi-server environment in a Database Availability Group. Let’s start with the most basic log 

Agent Logging Checking in Exchange Server

These are the logs that track the anti-spam agent actions on incoming mail. 

Admins dont need to configure these as Exchange Server enables them by default. You may turn them off if you add any other external spam monitoring system. Here are the commands  to configure the results

Set-TransportService <ServerIdentity> -AgentLogEnabled <$true | $false> -AgentL

You can find the logs at

Front End Transport Service: 

<ExchangeInstallPath>\TransportRoles\Logs\FrontEnd\AgentLog

Transport Service (Hub Transport): 

<ExchangeInstallPath>\TransportRoles\Logs\Hub\AgentLog

Edge Transport Server: 

<ExchangeInstallPath>\TransportRoles\Logs\Edge\AgentLog

Configure Connectivity Login for Exchange Server

If the admin ever wants to look at the behavior of outbound traffic transmission activity performed by the Transport service they can look at these logs. It can also help to figure out if there are any problems 

You can find and view the Exchange Server connectivity logs on the following paths. 

Mailbox Server:

Front End Transport Service: 

<ExchangeInstallPath>\TransportRoles\Logs\FrontEnd\Connectivity

Transport Service (Hub Transport): 

<ExchangeInstallPath>\TransportRoles\Logs\Hub\Connectivity

Edge Transport Server: 

<ExchangeInstallPath>\TransportRoles\Logs\Edge\Connectivity

Message Tracking and Delivery Report Logs

These logs are quite useful in scenarios where the Exchange search stops working or admins want to figure out the message delivery pathway. You can set it up.

  • Using the Exchange Admin Center (EAC):
  • Navigate to Servers > Servers, select the server, and click Edit.
  • Under Transport Logs, configure:
  • Enable/Disable Message Tracking.
  • Change the log file path.
  • Save changes.

Exchange Management Shell Examples:

Change Log Location & Settings:

Set-TransportService Mailbox01 -MessageTrackingLogPath "D:\Message Tracking Log" -MessageTrackingLogMaxFileSize 20MB -MessageTrackingLogMaxDirectorySize 1.5GB -MessageTrackingLogMaxAge 45.00:00:00

Disable Message Subject Logging:

Set-TransportService Mailbox01 -MessageTrackingLogSubjectLoggingEnabled $false

Disable Message Tracking:

Set-TransportService Mailbox01 -MessageTrackingLogEnabled $false

Verify Configuration via the following command:

Get-TransportService Mailbox01 | Format-List MessageTrackingLog*

How to Check Pipeline Tracing in Exchange Server

This is not a default log option, admins have to enable it manually. Once done this will allow admins to keep track of the before and after status of all email messages that are processed by the server transport agents. If any errors appear because of the transformations made on the messages inside the transport pipeline.

It can only be done via the commands, there is no GUI support to enable it. 

Step 1: Configure the Pipeline Tracing Sender Address

<Set-TransportService | Set-MailboxTransportService> <ServerIdentity> -PipelineTracingSenderAddress <SMTPAddress | "<>">

If you use the <> placeholder it will enable the tracing for all users and system-generated messages and quickly consume all available disk space.

That’s why admins should only apply this to specific users.

Step 2 (Optional): Specify a Custom Pipeline Tracing Folder

Transport service: %ExchangeInstallPath%TransportRoles\Logs\Hub\PipelineTracing

Mailbox Transport service: %ExchangeInstallPath%TransportRoles\Logs\Mailbox\PipelineTracing

Edge Transport Server: %ExchangeInstallPath%\TransportRoles\Logs\Edge\PipelineTracking

To set a custom folder:

<Set-TransportService | Set-MailboxTransportService> <ServerIdentity> -PipelineTracingPath <LocalFilePath>

 

Step 3: Enable Pipeline Tracing

Enable tracing for the specified transport service:

<Set-TransportService | Set-MailboxTransportService> <ServerIdentity> -PipelineTracingEnabled $true

Verify Pipeline Tracing Configuration

<Get-TransportService | Get-MailboxTransportService> <ServerIdentity> | Format-List PipelineTracing*

Verify the output the configured values must match your settings.

Check the tracing folder to confirm that message snapshot files appear there.

Disable pipeline tracing when troubleshooting is complete:

<Set-TransportService | Set-MailboxTransportService> <ServerIdentity> -PipelineTracingEnabled $false

Verify Pipeline Tracing is Disabled via

<Get-TransportService | Get-MailboxTransportService> <ServerIdentity> | Format-List PipelineTracingEnabled

Make sure that the PipelineTracingEnabled value is $false. GO to the tracing folder and verify that no new snapshot files are being created.

Setup and View Protocol Logging Activity in On-Premise Exchange Server

If you want your Exchange Server to keep the SMTP communication records between Send and Receive connectors during a regular message delivery cycle then you must enable this.

It can be done via 

  • Login to EAC and go to:
  • Mail flow > Send connectors
  • Mail flow > Receive connectors

Choose any connector to configure it and click Edit.

Inside the General tab, expand the Protocol logging level section, and pick one of the following:

  • None: Disable protocol logging. | Verbose: Enable protocol logging.
  • Click Save.

Configure Protocol Log Location

  • Within the EAC go to Servers > Servers.
  • Pick the Mailbox server to configure and click Edit.
  • On the server properties page, tap Transport logs.
  • There you will find the Protocol log section, set the following:
  • Send protocol log path
  • Receive protocol log path

Specify a local folder on the server. If the folder doesn’t exist, it is created when you save.

Click Save.

You can also use the Exchange Management Shell to Enable or Disable Protocol Logging for Connectors. Here is the list of cmdlets.

Send or Receive Connector:

Set-SendConnector "ConnectorName" -ProtocolLoggingLevel Verbose  # Enable
Set-SendConnector "ConnectorName" -ProtocolLoggingLevel None     # Disable
Set-ReceiveConnector "ConnectorName" -ProtocolLoggingLevel Verbose  # Enable
Set-ReceiveConnector "ConnectorName" -ProtocolLoggingLevel None     # Disable

Intra-organization Send Connector:

Set-TransportService ServerName -IntraOrgConnectorProtocolLoggingLevel Verbose
Set-FrontEndTransportService ServerName -IntraOrgConnectorProtocolLoggingLevel None

Mailbox Delivery Receive Connector:

Set-MailboxTransportService ServerName -MailboxDeliveryConnectorProtocolLoggingLevel Verbose
Set-MailboxTransportService ServerName -MailboxDeliveryConnectorProtocolLoggingLevel None

Configure Protocol Log Settings

Set Log Path, Max File Size, Directory Size, and Log Age:

Set-TransportService ServerName -ReceiveProtocolLogPath "D:\Logs\Receive" `
                                -ReceiveProtocolLogMaxFileSize 20MB `
                                -ReceiveProtocolLogMaxDirectorySize 400MB `
                                -ReceiveProtocolLogMaxAge 45.00:00:00 `
                                -SendProtocolLogPath "D:\Logs\Send" `
                                -SendProtocolLogMaxFileSize 20MB `
                                -SendProtocolLogMaxDirectorySize 400MB `
                                -SendProtocolLogMaxAge 45.00:00:00

Verification

This can be done manually by visiting the paths specified during the setup 

  • Mailbox Server:
    • Front End Transport Service:
      • Receive Connectors: <ExchangeInstallPath>\TransportRoles\Logs\FrontEnd\ProtocolLog\SmtpReceive
      • Send Connectors: <ExchangeInstallPath>\TransportRoles\Logs\FrontEnd\ProtocolLog\SmtpSend
    • Transport Service (Hub Transport):
      • Receive Connectors: <ExchangeInstallPath>\TransportRoles\Logs\Hub\ProtocolLog\SmtpReceive
      • Send Connectors: <ExchangeInstallPath>\TransportRoles\Logs\Hub\ProtocolLog\SmtpSend
  • Edge Transport Server:
    • Receive Connector: <ExchangeInstallPath>\TransportRoles\Logs\Edge\ProtocolLog\SmtpReceive
    • Send Connector: <ExchangeInstallPath>\TransportRoles\Logs\Edge\ProtocolLog\SmtpSend

Or by using the Exchange Management Shell

Verify Protocol Logging Settings and Connectors:

Write-Host "Send Connectors:" -ForegroundColor yellow
Get-SendConnector | Format-List Name,ProtocolLoggingLevel

Write-Host "Receive Connectors:" -ForegroundColor yellow
Get-ReceiveConnector | Format-List Name,TransportRole, ProtocolLoggingLevel

Write-Host "Mailbox Transport Delivery service:" -ForegroundColor yellow
Get-MailboxTransportService | Format-List *ProtocolLoggingLevel

Check Routing Table Logging in the Exchange Server

This is a legacy log that is available inside the old Exchange Server (2013 and before). Moreover, to set up this logging-in eligible servers admin needs to define the location, set up max-age, and add a directory size. 

All of this can only be done via the PowerShell commands there are no GUI settings for this. You can alter the following commands to fit into your environment.

Set-TransportService Server01 -RoutingTableLogPath "C:\RoutingLogs" -RoutingTableLogMaxDirectorySize 100MB -RoutingTableLogMaxAge 30.00:00:00

Interval configuration: Edit <RoutingConfigReloadInterval> in EdgeTransport.exe.config:

<add key="RoutingConfigReloadInterval" value="08:00:00" />

Restart Transport service:

net stop MSExchangeTransport && net start MSExchangeTransport

Then, verify settings using:

Get-TransportService Server01 | Format-List RoutingTableLog*

As the routing table recalculates early on connector changes or Kerberos renewal it becomes quite large in a small amount of time. As storage is a premium inside servers coupled with the fact that in newer Exchange Servers this became largely redundant. So keeping it was not useful and hence it was decommissioned from all versions that came after the 2013 edition.

If you still operate an old edition you can check the logs in the following locations:

  • Mailbox Server:
    • Front End Transport Service: <ExchangeInstallPath>\TransportRoles\Logs\FrontEnd\Routing
    • Transport Service (Hub Transport): <ExchangeInstallPath>\TransportRoles\Logs\Hub\Routing
    • Mailbox Transport Service: <ExchangeInstallPath>\TransportRoles\Logs\Mailbox\Routing
  • Edge Transport Server: <ExchangeInstallPath>\TransportRoles\Logs\Edge\Routing
  • Log File Prefixes:
    • MDRoutingConfig: Mailbox Transport Delivery Service
    • MSRoutingConfig: Mailbox Transport Submission Service

Conclusion

Now admins should not face any trouble in answering how to view Exchange Server logs. We gave a clear-cut explanation of what all log types are available how to set them up and where admins could find the logs. Moreover, log monitoring is just a small part of keeping the Exchange Server healthy. Sometimes, they might have to recover corrupted Exchange Server mailboxes too. For that, it’s best to rely on trusted solutions like the SysTools Exchange Repair Tool.