Microsoft KB Archive/821905

= Message tracking event IDs in Exchange Server 2003 =

Article ID: 821905

Article Last Modified on 12/3/2007

-

APPLIES TO


 * Microsoft Exchange Server 2003 Enterprise Edition
 * Microsoft Exchange Server 2003 Standard Edition
 * Microsoft Windows Small Business Server 2003 Premium Edition
 * Microsoft Windows Small Business Server 2003 Standard Edition

-





SUMMARY
This article contains information about message tracking in Microsoft Exchange Server 2003 and includes a list of some of the event IDs that are logged to message tracking log files. You can enable message tracking logs to track or to troubleshoot the flow or status of a message in Exchange Server 2003. You can record information about the sender, the message, and the recipient. If you want to log more detailed information, you can also record the subject line of messages.



MORE INFORMATION
Exchange Server 2003 enhances message tracking functionality in the following ways:
 * Exchange Server 2003 automatically creates a shared folder to the message tracking logs. You can also use Exchange System Manager to change the location of the message tracking logs.
 * You can to track a message beyond the categorization phase, when the recipient address is verified in the Active Directory directory service and its route is determined.

To enable message tracking in Exchange Server 2003:
 * 1) Start Exchange System Manager.
 * 2) Expand Administrative Groups, expand  , expand Servers, expand  , and then click Properties.
 * 3) Click the General tab.
 * 4) To log information about the sender, about the time the message was sent or received, about the message size and priority, or about the message recipients, click to select the Enable message tracking check box.
 * 5) To record the subject of any message sent to, sent from, or sent through the server, click to select the Enable subject logging and display check box.

Note By default, the tracking logs are located in the C:\Program Files\Exchsrvr\ .log folder. Each daily log is named in the yyyymmdd.log format according to the date that the log was created. The file name date is in Coordinated Universal Time (UTC).

The event IDs that are used in Exchange Server 2003 message tracking logs include the following:

Q1: When a message is generated in the system for the first time, what event is associated with that message in the tracking log?
A1: There are different events for different message submission paths to Exchange Server 2003. For example, for messages that are submitted through the SMTP component, the first event ID in the tracking log is 1019. For messages that are submitted through the Store component, the first event ID in the tracking log is 1027.

Q2: Is there one event ID that covers the creation of all messages and that only appears one time per message?
A2: There is no one event that covers the creation of all messages because messages can be created in various ways by various clients, remote servers, and pickup directory. It would make no sense to use the same event for all these code paths. Or, it would be impossible to use the same event for all these code paths. However, event 1019 is logged when any message enters Inetinfo-side transport processing. The tracking log may frequently contain multiple 1019 events that have the same message ID. For example, this may occur if the server is restarted multiple times during a period when the remote destination for the particular message is down. On each restart, the message is resubmitted, and event 1019 is logged. This is expected behavior.

Q3: Why are there multiple 1020 and 1031 events that are logged for the same message ID?
A3: This is expected behavior. The same message ID can be transferred out multiple times. When the same message ID is transferred out multiple times, events 1020 and 1031 are generated.

Additional query words: XADM

Keywords: KB821905

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.