When I enabled the centralized management of ESA message tracking, I found that I could only search the last two days' mail_logs through the command line grep command.
Enabling centralized management of message tracking has no impact on mail_logs of the ESA since they are different databases.
Logs from the ESA are not transferrable to the SMA.
Also mail_logs on the ESA is different from mail_logs on the SMA.
To increase retention size for either you can configure it under System Administration -> Log Subscriptions.
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: