Viewing Exchange Server SMTP logs?

[TimWalker]

Had something come up...

One of the staff here should have received an email on the 1st September but seems certain they didn't, and this is a legal matter that is now rather late.

Reviewing the logs of our spam filter, and our exchange server (using get-messagetrackinglog on powershell) I discovered that our logs only go back a month

Of course we have a full backup, from the 4th September in veeam, and I can see no sign of the email in that persons mailbox/deleted items, so I'm reasonably confident they didn't receive it... but it would be really nice to be sure

I span up instant recovery and found that I couldn't run the powershell commandlets as the server can't authenticate against AD.

I span up instant recovery on a DC also, let them talk to each other on a private switch, and they still wouldn't talk, presumably something about the amount of time passed since the backup.

I guess I could set the clock on my backup server (where I'm spinning up the instant recoveries on hyper-v) back to september and try again, but that feels a bit risky on a working backup server....

Any ideas? Is there some easier way I'm missing with Veeam Explorer for Microsoft Exchange?

[Regnor]

You could start a file level recovery and manually dig through the SMTP(if enabled) and Messagetracking log files.
Those logs can be found in the Transportroles folder, either under Messagetracking or Frontend\SmtpReceive

[TimWalker]

That was the trick, mounted the backup and used Notepad++ to find in files on that directory (TransportRoles\Logs\FrontEnd\ProtocolLog\SmtpReceive), found many emails coming in for the person in question but not the missing one, so can now be certain it was never received.

Cheers

[Regnor]

Glad you were able to find the necessary logs.
One thing you should keep in mind with the spam filter; if it would have blocked the mail or if there would have been some connection error from the external sender, you won't see anything in the Exchange logs.