Hey Team, so I'm trying to figure out where the logs are for when you click the check box "Audit this rule with severity level" and the value in the box is set to "High". I've found some posts elsewhere that mention the location would be "%ExchangeInstallPath%\TransportRoles\Hub\AgentLog" but that seems to be only for the Anti-spam agent. I also found a different article that mentions looking at the AGENTINFO event ID in message tracking logs. That still only tells me if a transport rule applied or not, but it doesn't mention why the rule failed to apply.
The whole point of this post is that we are trying to figure out why a transport rule is only working some of the time. I will send an email from and to the same people, one after the other, and the rule will get applied to the first email, but not the second email. The conditions of the rule are that it is sent to a particular user and that there are message headers that shows it came from one of two specific servers. These servers are the only ones possible for it to come from and checking the headers, it meets the conditions of the transport rule. The headers look essentially the same between the two emails.