Where to check/enable for log keeping track of transport rule actions?

Question

I have implemented some transport rules to "journal" all emails from specific clients as per this
thread. 
So there are 4 transport rules to capture all those email:
1. email from Clients (incoming / FROM)
1.1 from users outside the organization.
1.2 sent to member of AD Group
1.3 sent to users inside the organization.
1.4 where the from address contains "domain of our clients list"
1.5 BBC to capture mailbox
2. email to Clients (outgoing/ TO)
2.1 from member of AD Group
2.2 from users inside the org
2.3 sent to users outside the organization.
2.4 where the to address contains "domain of our clients list"
2.5 BBC to capture mailbox
3. email to Clients (outgoing/ CC)
3.1 from member of AD Group
3.2 from users inside the org
3.3 sent to users outside the organization.
3.4 where the cc address contains "domain of our clients list"
3.5 BBC to capture mailbox
4. email to Clients (outgoing/ BCC)
4.1 from member of AD Group
4.2 from users inside the org
4.3 sent to users outside the organization.
4.4 where the bcc address contains "domain of our clients list"
4.5 BBC to capture mailbox
The symptoms are that while I am seeing by selecting random emails that everything seem to run fine (rule filtering from transport does get incoming and outgoing messages to that “capture” mailbox) and I tested this fine with some test emails
in different domains.
Somehow I am no getting the results I want. With business sending some test sets I should be finding in that mailbox, I do not find everything. Some of the email that apparently would logically be captured are not. Is business lying about the test sets they
send? I don’t think so and the fact is that I seem to be missing emails.
Anyhow my questions to you are the following:
1.    Do you know of any logging done by the transport server to check on matches of the filters?
2.    I am using outside and inside condition in the rules. Are they what I think they are?
I hope you can help. I think I am doing this right, but I cannot verify the process 100%. Some logs or additional information would help. Or perhaps I am not using the conditions properly.
Thank you in advance.
and BTW the environment is Exchange 2007

Answer 1

Based on my research, there is no specific log to match the filters. During the mail flow, only SMTP log and Message Tracking log can record the message information.
You can check the two logs if needed. For more information, please refer to the following steps.
Enable Message tracking log
1. Open the Exchange Management Console. 
2. In the console tree, expand Server Configuration, and select Hub Transport.
3. In the action pane, click the Properties link that is directly under the server name.
4. In the Properties page, click the Log Settings tab.
5. In the Message tracking log section, Select Enable message tracking log to enable message tracking.
6. Click Apply to save changes and remain in the Properties page, or click OK to save changes and exit the Properties page.
Enable SMTP Log
1. In the console tree, expand Organization Configuration, and select Hub Transport.
2. In the action pane, click on Sender Connectors and right click on send connector and then click on properties.
3. Select “Verbose” under “Protocol logging level” and then click ok.
Then, you can find the logs from the following location.
Collect Message Tracking Log
On the Exchange server, go to directory “c:\program files\Microsoft\exchange server\TransportRoles\Logs\Message Tracking”
Collect SMTP log
Open the folder on the Hub Server,: C:\Program Files\Microsoft\Exchange Server\TransportRoles\Logs\ProtocolLog\SmtpSend.
Thanks.
Novak
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.