Message Tracking log for Distribution Group Emails

Question

I'm running into an issue with trying to see emails sent to Distribution Groups in our MS Exchange 2016 (on-premise) server. When I go through the message tracking log here's what I'm noticing:
Emails sent via Outlook clients to a Distribution Group will show a Receive Event for the distribution group SMTP address used in the email to the group.
Emails sent via standard SMTP protocols (either internal or external) appear to show up just as individual message events to every person on the distribution group.

This is making it incredibly difficult to write some powershell scripts to give us a count of the actual usage of our Distribution Groups given we're not seeing an "Expand" event in the Message Tracking Log.

Is there any additional logging we can turn up on Exchange to ensure these events are recorded or do we need to look at a journaling product to have a better idea of the hits we're seeing on our DGs in Exchange?

Answer 1

Hi @Dougbert107 ,

Emails sent via standard SMTP protocols (either internal or external) appear to show up just as individual message events to every person on the distribution group.
This is making it incredibly difficult to write some powershell scripts to give us a count of the actual usage of our Distribution Groups given we're not seeing an "Expand" event in the Message Tracking Log.

Does the email address of the distribution list appear in the message tracking log of the message sent "via tandard SMTP protocols"?
Could you please run the command below for one of the messages sent via "standard SMTP protocol" so that we can learn how its message tracking log looks like? Please do remember to remove any private data involved like email address or domain name to protect your personal information:

Get-MessageTrackingLog -MessageSubject <subject>  

Furthermore, if you only need to count the messages sent to a particular distribution group, based on my test, you can have a go with the following command:

Get-MessageTrackingLog | ? {$_.RelatedRecipientAddress -like "******@contoso.com"} | measure-object | fl count  

Update：
Using the command below instead (Get-TransportService|Get-MessageTrackingLog)：

 Get-TransportService|Get-MessageTrackingLog -Start <starttime> -End <endtime> -MessageSubject <subject>  

---

If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.