Hello, I'm using an Exchange 2013 CU3 server and when I retrieve the tracking logs with Get-MessageTrackingLog it shows the ClientIP and ClientHostname to be the the IP address and hostname of the Exchange server and not the actual host/ip that sent the message. When I set the client to relay through an Exchange 2010 server and retrieve the tracking logs it shows the true client ip/hostname. Am I seeing this because the Exchange 2013 server has both CAS and Mailbox roles?
The actual command I am running is:
Get-MessageTrackingLog -Server exch13.domain.local -ResultSize Unlimited | select-object clientip,clienthostname,serverip,eventid,connectorid,timestamp,messageid,sender,recipients,messagesubject | Out-GridView
Any insight would be appreciated.
EDIT: I discovered the OriginalClientIP field in the tracking logs which gives me the true client IP so I guess that's something, but I still can't get the original client hostname. I'm sure the issue is that the tracking logs are ran against the mailbox server role because I also do not see any of the messages using receive Connectors on the FrontendTransport role.