Microsoft KB Archive/173364

= XADM: Exchange 5.0 and 5.5 Tracking Log Event Numbers =

Article ID: 173364

Article Last Modified on 10/27/2006

-

APPLIES TO


 * Microsoft Exchange Server 5.5 Standard Edition
 * Microsoft Exchange Server 5.0 Standard Edition

-



This article was previously published under Q173364



SUMMARY
Tracking logs are created when message tracking is enabled on a Microsoft Exchange Server component. These logs can be read and edited by any text editor. The logs are tab delimited and can be loaded into spreadsheet programs like Microsoft Excel. You can also write an application to interpret message tracking logs.

For a list of the tracking log events generated by Microsoft Exchange Server, version 4.0, please refer to the following article in the Microsoft Knowledge Base:

174078 XADM: Tracking Log Event Numbers for Exchange 4.0

The events 1010 thru 1018 were not available in previous versions of Microsoft Exchange Server.



MORE INFORMATION
Message tracking must be enabled for a component to begin recording activity in the tracking log. When you enable message tracking for any component, all similar components on servers in that site write to the tracking log.

To Enable Message Tracking for the Information Store

 * 1) In the Exchange Server Administrator program, double-click Information Store Site Configuration.
 * 2) Click the General tab, and click to select the Enable message tracking check box.

To Enable Message Tracking for the MTA

 * 1) In the Exchange Server Administrator program, double-click MTA Site Configuration.
 * 2) Click the General tab, and click to select the Enable message tracking check box.

To Enable Message Tracking for the Internet Mail Connector

 * 1) Double-click on the Internet mail connector for this site.
 * 2) Click the Internet Mail tab, and click to select the Enable message tracking check box.

Tracking logs are located in Exchsrvr\Tracking.log. Each daily log is named by the date on which it was created in yyyymmdd.log format. The file name date, like all time in the tracking log, is in Greenwich mean time.

The following table defines the event numbers in the tracking logs. Event#  Event Type                    Description

0       Message transfer in           The message was received from a                                       server, connector, or gateway.

1       Probe transfer in             An X.400 Probe was received from a                                       gateway, link, or MTA.

2       Report transfer in            A delivery receipt or NDR was received from a server, connector, or gateway.

4       Message submission            The message was sent by the client.

5       Probe submission              An X.400 Probe was received from a                                       user.

6       Probe transfer out            An X.400 Probe was sent to a                                        gateway, link, or MTA.

7       Message transfer out          The message was sent to a server, connector, or gateway.

8       Report transfer out           A delivery receipt or NDR was sent to a server, connector, or gateway.

9       Message delivered             The message was delivered to a                                       mailbox or public folder.

10      Report delivered              A delivery receipt or NDR was delivered to a mailbox.

26      Distribution list expansion   A recipient distribution list was expanded so the message could be                                      sent to different addresses.

28      Message redirected            The message was sent to a mailbox other than those of the recipients.

29      Message rerouted              The message was routed to an                                       alternate path.

31      Downgrading                   An X.400 message was downgraded to                                       1984 format prior to relay.

33      Report absorption             The number of delivery receipts or                                       NDRs exceeded a threshold, and the reports were deleted.

34      Report generation             A delivery receipt or NDR was created.

43      Unroutable report discarded   A delivery receipt or NDR could not be routed and was deleted from the queue.

50      Gateway deleted message       The Administrator deleted an X.400 message queued for a gateway.

51      Gateway deleted probe         The Administrator deleted an X.400 probe queued for a gateway.

52      Gateway deleted report        The administrator deleted an X.400 report queued for a gateway.

1000    Local Delivery                The sender and recipient are on the same server.

1001    Backbone transfer in          Mail was received from another MAPI system across a connector or                                      gateway.

1002    Backbone transfer out         Mail was sent to another MAPI system across a connector or                                      gateway.

1003    Gateway transfer out          The message was sent through a                                       gateway.

1004    Gateway transfer in           The message was received from a                                       gateway.

1005    Gateway report transfer in    A delivery receipt or NDR was received from a gateway.

1006    Gateway report transfer out   A delivery receipt or NDR was sent through a gateway.

1007    Gateway report generation     A gateway generated an NDR for a                                       message.

1010    SMTP Queued Outbound          Outbound mail was queued for delivery by the Internet Mail Service.

1011    SMTP Transferred              Outbound Outbound mail was transferred to an Internet recipient.

1012    SMTP Received                 Inbound Inbound mail was received from by the Internet Mail Service.

1013    SMTP Transferred              Inbound Mail received by the Internet Mail Service was transferred to the Information Store.

1014    SMTP Message Rerouted         An Internet message is being rerouted or forwarded to the proper location.

1015    SMTP Report Transferred In    A delivery receipt or NDR was received by the Internet Mail Service.

1016    SMTP Report Transferred Out   A delivery receipt or NDR was sent to the Internet Mail Service.

1017    SMTP Report Generated         A delivery receipt or NDR was created.

1018    SMTP Report Absorbed          The receipt or NDR could not be                                       delivered, and was absorbed. (It is                                      not possible to send an NDR for an                                       NDR.)

Keywords: kbinfo KB173364

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.