A useful report to generate from the Exchange Server 2010 message tracking logs is a summary of the different message tracking events that have occurred.
Each message tracking log entry records an event ID from the following list:
Each event means different things. Healthy messages may record multiple receive, send, transfer, submit or deliver events, depending on your environment. Unhealthy messages may record badmail or fail events.
While there is no hard and fast rules about what percentage of each event you should see, it is still useful to take a look at a summary of the different events IDs in case you notice something that may warrant further investigation.
[PS] C:\>Get-MessageTrackingLog -ResultSize Unlimited | Group-Object -Property:EventId | Sort-Object Count -Desc | Select Name,Count Name Count ---- ----- RECEIVE 58679 DELIVER 47496 NOTIFYMAPI 20812 SUBMIT 20806 SEND 19863 RESUBMIT 8679 HAREDIRECT 6826 TRANSFER 351 DSN 96 FAIL 95 SUBMITDEFER 6 BADMAIL 2
Incidentally you may find this type of summary report to be faster to generate using Log Parser instead. In my tests the PowerShell command took almost 5 minutes to complete, whereas Log Parser took only 9 seconds on the same server. Your mileage may vary. You can check out the Log Parser query here.