Troubleshooting sharepoint alerts

Method for determining what happens with sharepoint alerts from the serverside.

1. To determined which server is sending the mail.
   (Note that this will be different for different webapps, so best is to monitor the whole farm with ULS)
   run Sysinternals procmon on all servers (usually only the frontends) monitor traffic for :25
2. Activate verbose logging for alerts
   
3. Monitor ULSViewer on specific member or the whole farm for events matching below
   Category contains "Alerts" AND Message contains "Alert for" OR Message contains "Successfully sent"
   
   

Now ULS messages will show successfull and failed (based on securityfiltering) sent emails.

References:
https://blogs.technet.microsoft.com/steve_chen/alerts-in-sharepoint-troubleshooting-mosswss/

http://sharepointalert.info/troubleshooting-sharepoint-alerts/

http://www.sharepointdiary.com/2012/02/sharepoint-alerts-not-working-troubleshooting-checklist.html