Protocol logging (records of SMTP conversations) is probably the best source to diagnose mailflow problems. Unfortunately, by default, protocol logging is disabled on all Send connectors and Receive connectors, so remember to enable it!
Exchange Management Shell cmdlets to enable protocol logging on a Receive/Send connector:
-
Set-ReceiveConnector -ProtocolLoggingLevel
-
Set-SendConnector -ProtocolLoggingLevel
There is also a special send connector that exists on every Hub Transport server. To modify it using Exchange Management Shell, run the following cmdlet:
-
Set-TransportServer -IntraOrgProtocolLoggingLevel
After enabling the desired logging level, we have to configure the maximum log age, since Exchange 2007 uses circular logging to help control the used hard disk space. To set the maximum age of the Send/Receive connector protocol log files, run the following cmdlets:
-
Set-TransportServer -ReceiveProtocolLogMaxAge
-
Set-TransportServer -SendProtocolLogMaxAge
By default, the logs are placed in C:\Program Files\Microsoft\Exchange Server\TransportRoles\Logs\ProtocolLog\. There are other settings that you can modify, for more information read How to Configure Protocol Logging.