How to track specific messages in your email traffic

Last week, we received a support call from a customer who needed to spot mailboxes that had stored, sent or received emails with a specific subject line back in 2018. Our client was somewhat in a hurry as his management had requested an immediate response. Fortunately, tracking specific messages in your email traffic is an easy task with Promodag Reports.

The hard way: searching Message Tracking Logs with PowerShell

In a first approach, the most obvious solution would be to use the native Exchange message tracking log explorer, or to run the Get-MessageTrackingLog cmdlet. Unfortunately, oldest file data are overwritten by default before 30 days in on-premise versions of Microsoft Exchange!

Even worse, the data can be accessed till 7 days and 90 days for “Historical Search” if using Office 365 and the get-MessageTrace cmdlet. All in all, that won’t be sufficient to go back to 2018. Too bad.

A better way: using Promodag Reports

We advised our client to get the most of his database by tracking these messages in his mailbox traffic. The most relevant report in this case is Find Specific Messages, in the Templates > Mailbox Traffic menu. Here is why:

1. Tracking emails sent or received a long time ago is possible, whether you use on-premise Exchange or Office 365, as long as you have regularly imported Exchange tracking logs in the Promodag database.
2. Obtaining a result is way faster than scanning the content of several thousand mailboxes.
3. Another advantage of this method is that ALL sent/received messages with that particular word in the 'Subject' line would appear - as long as he had imported message tracking files to cover the whole reporting period - even if users deleted those messages from their mailboxes.

We were looking for a message whose subject line contained the word “confidential”. This requirement can be easily translated into a filter:

We also needed to filter sent messages only, and view the name of each recipient of these messages:

And this is the report we obtained within a minute. It displays the message timestamp in local time along with the message subject line, the display name of the sender and the list of each single recipient.

Try Promodag Reports - your Exchange reporting ally

Since 20 years Promodag has been developing accurate Microsoft Exchange email reporting solution. Starting with Exchange server 5.5 in 1998 Promodag reports has regularly evolved to a mature product that now supports Office 365. Please consult our homepage for more information about our Exchange and Office 365 reporting products.