Microsoft KB Archive/822930

= Tracking Log Event Numbers for Exchange Server 2003 =

PSS ID Number: 822930

Article Last Modified on 4/6/2004

-

The information in this article applies to:


 * Microsoft Exchange Server 2003 Enterprise Edition
 * Microsoft Exchange Server 2003 Standard Edition

-





SUMMARY
Tracking logs are created when message tracking is enabled on a Microsoft Exchange Server 2003 component. Message tracking logs are tab-delimited text files. You can view these logs in the Message Tracking Center in Exchange System Manager, or you can load the logs into a spreadsheet program such as Microsoft Excel. You can also write a program to interpret message tracking logs.



MORE INFORMATION
Tracking logs are located in the \Exchsrvr\ .log folder. Each daily log is named according to the date that it was created (in the yyyymmdd.log format). Like all times in the tracking log, the file name date is in coordinated universal time (UTC, or Greenwich Mean Time [GMT]).

The following table defines the fields that are in the Exchange 2003 tracking logs:



Related Questions and Answers
Q: When a message is initially generated in the system, what event is associated with that message in the tracking log?

A: There are different events for different message submission paths to Exchange Server 2003. For example, for messages that are submitted through the SMTP component, the first event ID in the tracking log is 1019. For messages that are submitted through the Store component, the first event ID in the tracking log is 1027.

Q: Is there one event ID that covers the creation of all messages and that only appears one time per message?

A: There is no one event that covers the creation of all messages, because messages can be created in a variety of ways by various clients, remote servers, and pickup directory. It would make no sense to use the same event for all these code paths, or it would be impossible to do so. However, event 1019 is logged when any message enters Inetinfo-side transport processing.

In many cases, the tracking log may contain multiple 1019 events that have the same message ID. For example, this may occur if the server is restarted multiple times during a period when the remote destination for the particular message is down. On each restart, the message is resubmitted, and event 1019 is logged. This is expected behavior.

Q: Why are there multiple 1020 and 1031 events that are logged for the same message ID?

A: This is expected behavior. The same message ID can be transferred out multiple times. When the same message ID is transferred out multiple times, events 1020 and 1031 are generated.

Additional query words: XADM

Keywords: kbinfo KB822930

Technology: kbExchangeSearch kbExchangeServ2003Ent kbExchangeServ2003Search kbExchangeServ2003St

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.