Microsoft Exchange creates tracking log files to record all mail activity and usage. Each day, beginning at midnight UTC (Coordinated Universal Time), every inbound and outbound message for an Exchange server creates an entry (called an event) in an Exchange server's tracking log. Each routing step from message submission to delivery to a local mailbox or external gateway is recorded as a separate event.
Twenty-four hours later, Microsoft Exchange closes the current log and opens a new log for the next day. The closed log is now available for MessageStats to gather and process. When you schedule gatherings, you should consider that daily tracking logs are closed by default at midnight UTC each day.
During a gathering task, MessageStats determines the tracking logs that must be gathered. MessageStats gathers the most recently closed tracking log on the Exchange servers, and gathers any tracking log information that was not previously gathered. By default, a server's tracking log share contains tracking logs for seven days and MessageStats automatically selects the tracking logs that have not yet been gathered.
Newer versions of Microsoft Exchange Write multiple tracking log files per day however the gathering behavior has been maintained for backward complatibility.