Hello everyone !
I create this new topic today beacause I have an issue with message tracking in Exchange logs. Indeed I want to make a top10 senders for example but when I am looking to Exchange's logs there are many event-id just for 1 e-mail. Look at the following picture :
I sent 1 e-mail but there are 10 events. So if i look for the sender firstname.lastname@example.org filtering by sender-address.keyword, it will returns me that this user sent 10 e-mails, however it's only one.
Moreover, the number of event is not the same if it is an external / internal e-mail. Sometimes for notifications from any server the number could be 6 for example without "submit" event-id.
I think there is something i didn't understand about Exchange message tracking, maybe i can't get the exact number of e-mails using these logs.
Thanks for reading and have a nice week !