Hi, As per the design, emails will flow from frontend transport service to hub transport service. While analyzing messaging tracking log, I am not getting this information. When I run the following command, I am not getting the results get-messagetrackinglog -server Contoso -start "<get-date> " | ft timestamp, connectorid, eventid, source, clienthostname, sender, recipients What I am getting is the receive connector of hubtransport ( Default contoso ). Can someone please let me know how to capture frontend connector on messaging tracking logs ?

Hi @Surya kumar, Would you please clarify what information on connectors do you need for analysis? Since to analyze SMTP conversations on receive connectors we usually check protocol logs , please make sure protocol log is enabled on the receive connectors and check protocol logs under this path: %ExchangeInstallPath%TransportRoles\Logs\FrontEnd\ProtocolLog\SmtpReceive If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Capturing frontend receive connector on message tracking log using powershell

Accepted answer

Kael Yao-MSFT 37,651 Reputation points Microsoft Vendor

2023-06-26T02:37:51.8466667+00:00

Hi @Surya kumar,

Would you please clarify what information on connectors do you need for analysis?

Since to analyze SMTP conversations on receive connectors we usually check protocol logs, please make sure protocol log is enabled on the receive connectors and check protocol logs under this path:

%ExchangeInstallPath%TransportRoles\Logs\FrontEnd\ProtocolLog\SmtpReceive

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
Surya kumar 345 Reputation points

2023-06-26T03:16:11.15+00:00

Hi @Kael Yao-MSFT

I have multiple dedicated frontend receive connectors in place. I want to know through which front end connector the email was received and through which connector the email was transmitted from front end transport to hub transport

Kael Yao-MSFT 37,651 Reputation points Microsoft Vendor

2023-06-26T05:46:24.99+00:00

To check which connector was used, you can check the protocol log with timestamp (protocol log users UTC), sender, recipient or messageID as filter.

For example:

scenario: user02@domain2.com sends an email to user01@domain1.com

1.in message tracking log we can see the messageID is 4e4d3688a5d5467f9f5e51294f9c52d5@domain2.com

2.in Frontend protocol service logs we can search with this messageID and see the message was received by the Default Frontend receive connector

3.in Transport service protocol logs we can see the message was received by Default receive connector

Surya kumar 345 Reputation points

2023-06-26T06:57:51.3333333+00:00

@Kael Yao-MSFT

Thanks for the clarification. However, why the connector id value is empty when you ran message tracking log on exchange management shell

Surya kumar 345 Reputation points

2023-06-26T07:17:17.7566667+00:00

@Kael Yao-MSFT ,

The message tracking log command which you ran on EMS is checking the logs only on the server on which this command was executed.

Suppose if I have multiple exchange servers, how can I identify which exchange server has relayed the email and what's the next hop?

Kael Yao-MSFT 37,651 Reputation points Microsoft Vendor

2023-06-26T07:45:04.26+00:00

why the connector id value is empty when you ran message tracking log on exchange management shell

Message tracking log logs the message activities in the transport pipeline.

Since not all transport events happen on connectors, it is the expected behavior.

Suppose if I have multiple exchange servers, how can I identify which exchange server has relayed the email and what's the next hop?

If you have multiple Exchange servers, you can append Get-Transportservice before Get-MessageTrackingLog to get the whole mail flow process.

Example:

Get-TransportService | Get-Messagetrackinglog -messagesubject "subject"

Or specify server with -server parameter to check the mail flow process on a specific server.

Surya kumar 345 Reputation points

2023-06-26T08:41:14.13+00:00

@Kael Yao-MSFT

I agree. But if we change the event to SMTP Receive, we will be getting the entry for connectorid, right?

Can you confirm?

Kael Yao-MSFT 37,651 Reputation points Microsoft Vendor

2023-06-26T08:52:24.6566667+00:00

Yes it is the same in my lab.

Surya kumar 345 Reputation points

2023-06-30T07:35:41.85+00:00

@Kael Yao-MSFT ,

I am left with one doubt. For knowing which receive connector was used during email transmission, we will check smtp protocol logs.

If I have multiple receive connectors with similar configuration, then under what basis a connector will be chosen? Do we have any priority?

Please help me with this!!!

Kael Yao-MSFT 37,651 Reputation points Microsoft Vendor

2023-06-30T07:46:09.36+00:00

If I have multiple receive connectors with similar configuration, then under what basis a connector will be chosen? Do we have any priority?

Yes. It is documentated here: Receive connector remote addresses

Multiple Receive connectors on the server can have overlapping remote IP address ranges as long as one range is completely overlapped by another. When remote IP address ranges overlap, the remote IP address range that has the most specific match to the connecting server's IP address is used.

Surya kumar 345 Reputation points

2023-06-30T09:40:36.1966667+00:00

@Kael Yao-MSFT ,

Thanks for the quick response. How would be the situation if custom connector A has remote IP like 192.168.1.75 and custom connector B has remote IP like 192.168.1.75

In this case, which connector will be used. Will it go with alphabetical order?

Kael Yao-MSFT 37,651 Reputation points Microsoft Vendor

2023-06-30T09:44:49.08+00:00

You cannot have two connectors with the exact same listening port and remote ip address.

It would return error message like:

The values that you specified for the Bindings and RemoteIPRanges parameters conflict with the settings on Receive connector "conflicted connector". A Receive connector must have a unique combination of a local IP address & port bindings and remote IP address ranges. Change at least one of these values.

Surya kumar 345 Reputation points

2023-06-30T09:53:03.58+00:00

@Kael Yao-MSFT

Thank you very much for solving all of my queries
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Capturing frontend receive connector on message tracking log using powershell

0 additional answers

Your answer