Sometimes, when we turn on the auditing, we see that the audit not work or not return any result. Below are the step for troubleshooting :
1) Do the mailbox already enable the audit?
issue below command : Get-Mailbox -Identity ‘
If yes, continue step 2
If no, perform again the Set-Mailbox : Set-Mailbox -Identity ‘
2) Do the audit folder created and have item?
issue command : Get-MailboxFolderStatistics -Identity “
If yes, continue step 3
If no, maybe there are no action taken yet for specific audit? You can check further by simulating in another test mailbox to check either no issue with your step.
3) Do the indexing are working fine for specific database?
issue command : Get-MailboxDatabaseCopyStatus * | where {$_.ContentIndexState -eq “Failed”}
If yes (have failed), check event viewer and consider to rebuild back the CI catalog folder. below are the step :
1. Stop the Windows Services: “Microsoft Exchange Search service”, “Microsoft Exchange Host Controller”
2. Delete the Existing CI catalog folder or move it to a new location.
3. Start the Services: “Microsoft Exchange Search service”, “Microsoft Exchange Host Controller” again.
If no, review the Event viewer and check any related event when you trigger the search function.Google may help you then 🙂
Useful Reference : http://windowsitpro.com/exchange-server-2010/mailbox-auditing-exchange-server-2010