I'm using Message Tracking in Exchange 2007, but I don't think emails coming from outside are being logged. I can run a query and see messages internal to the domain, but I get no results when trying to find messages that were sent from outside the domain to someone in the org. Is this enabled by default? Where is this setting controlled?
In Exchange 2007 you cannot modify the message tracking settings in the Exchange Management Console (EMC). You have to use the Exchange Management Shell (EMS):
Check to see if message tracking is turned on with this PowerShell command:
Turn it on with:
Message tracking can only be configured on Exchange servers that have the Hub Transport, Edge Transport or Mailbox roles.
EDIT 1
Since message tracking is enabled, but doesn't appear to be logging external mail, let's try a few things.
Test your server health and post the results in your original post. In the EMS, run the following two cmdlets:
Check your event logs for any Exchange related errors. I'm interested in seeing if the log files are being properly written to.
A slightly scorched earth possibility that I've heard of is to disable message tracking, disable Exchange services that are pertinent, move the tracking log to a new folder, and restart Exchange services thus creating a new log file.
The default location for message tracking logs is:
Drive:\Program Files\Microsoft\Exchange Server\TransportRoles\Logs\MessageTracking
(Disclaimer! Do the following at your own risk!)
Set-TransportServer [servername] –MessageTrackingLogEnabled $false
(Make sure you're on the hub transport server!)Set-TransportServer [servername] –MessageTrackingLogEnabled $true