Microsoft KB Archive/311739

= Tracking log event numbers for Exchange 2000 Server =

Article ID: 311739

Article Last Modified on 2/27/2007

-

APPLIES TO


 * Microsoft Exchange 2000 Server Standard Edition

-



This article was previously published under Q311739



SUMMARY
Tracking logs are created when message tracking is enabled on a Microsoft Exchange 2000 Server component. Message tracking logs are tab-delimited text files. You can view these logs in the Message Tracking Center in the Exchange System Manager, or you can load the logs into a spreadsheet program, such as Microsoft Excel. You can also write an application to interpret message tracking logs.



MORE INFORMATION
Tracking logs are located in the \Exchsrvr\ .log folder. Each daily log is named according to the date that it was created (in the .log format). Like all times in the tracking log, the file name date is in coordinated universal time (UTC, or Greenwich Mean Time [GMT]).

The following table defines the fields in the Exchange 2000 tracking logs:

Event#  Event Type                     Description 0       Message transfer in            The message was received from a server, connector, or gateway. 1       Probe transfer in              An X.400 Probe was received from a gateway, link, or MTA. 2       Report transfer in             A delivery receipt or NDR was received from a server, connector, or gateway. 4       Message submission             The message was sent by the client. 5       Probe submission               An X.400 Probe was received from a user. 6       Probe transfer out             An X.400 Probe was sent to a gateway, link, or MTA. 7       Message transfer out           The message was sent to a server, connector, or gateway. 8       Report transfer out            A delivery receipt or NDR was sent to a server, connector, or gateway. 9       Message delivered              The message was delivered to a mailbox or public folder. 10      Report delivered               A delivery receipt or NDR was delivered to a mailbox. 

NEW     NEW                            NEW

18      StartAssocByMTSUser 23      ReleaseAssocByMTSUse 28      Message redirected             The message was sent to a mailbox other than those of the recipients. 29      Message rerouted               The message was routed to an alternate path. 31      Downgrading                    An X.400 message was downgraded to 1984 format prior to relay. 33      Report absorption              The number of delivery receipts or NDRs exceeded a threshold, and the reports were deleted. 34      Report generation              A delivery receipt or NDR was created. 43      Unroutable report discarded    A delivery receipt or NDR could not be routed and was deleted from the queue. 50      Gateway deleted message        The Administrator deleted an X.400 message queued for a gateway. 51      Gateway deleted probe          The Administrator deleted an X.400 probe queued for a gateway. 52      Gateway deleted report         The administrator deleted an X.400 report queued for a gateway. 1000    Local Delivery                 The sender and recipient are on the same server. 1001    Backbone transfer in           Mail was received from another MAPI system across a connector or gateway. 1002    Backbone transfer out          Mail was sent to another MAPI system across a connector or gateway. 1003   Gateway transfer out            The message was sent through a gateway. 1004   Gateway transfer in             The message was received from a gateway. 1005   Gateway report transfer in      A delivery receipt or NDR was received from a gateway. 1006   Gateway report transfer out     A delivery receipt or NDR was sent through a gateway. 1007   Gateway report generation       A gateway generated an NDR for a message. 1010   SMTP Queued Outbound            Outbound mail was queued for delivery by the Internet Mail Service. 1011   SMTP Transferred Outbound       Outbound mail was transferred to an Internet recipient. 1012   SMTP Received Inbound           Inbound mail was received from by the Internet Mail Service. 1013   SMTP Transferred                Inbound Mail received by the Internet Mail Service was transferred to the Information Store. 1014   SMTP Message Rerouted           An Internet message is being rerouted or forwarded to the proper location. 1015   SMTP Report Transferred In      A delivery receipt or NDR was received by the Internet Mail Service 1016   SMTP Report Transferred Out     A delivery receipt or NDR was sent to the Internet Mail Service. 1017   SMTP Report Generated           A delivery receipt or NDR was created. 1018   SMTP Report Absorbed            The receipt or NDR could not be delivered, and was absorbed. (It is not possible to send an NDR for an NDR.)

NEW    NEW                             NEW

1019   SMTP Submit Message to AQ       SMTP: Message Submitted to Advanced Queuing 1020   SMTP Begin Outbound Transfer    SMTP: Started Outbound Transfer of Message 1021   SMTP BadMail                    SMTP: Message Sent to Badmail 1022   SMTP AQ Failure                 SMTP: Advanced Queue Failure 1023   SMTP Local Delivery             SMTP: Message Delivered Locally 1024   SMTP Submit Message To Cat      SMTP: Message Submitted to Categorizer 1025   SMTP Begin Submit Message       SMTP: Started Message Submission to Advanced Queue 1026   SMTP AQ Failed Message          SMTP: Advanced Queue Failed to Deliver Message 1027   SMTP Submit Message To SD       SMTP Store Driver: Message Submitted from Store 1028   SMTP SD Local Delivery          SMTP Store Driver: Message Delivered Locally to Store 1029   SMTP SD Gateway Delivery        SMTP Store Driver Submitted Message to MTA 1030   SMTP NDR All                    SMTP: Non-Delivered Report (NDR) Generated 1031   SMTP End Outbound Transfer      SMTP: Ending Outbound Transfer

For additional information about Microsoft Exchange message tracking, click the following article numbers to view the articles in the Microsoft Knowledge Base:

246856 How to enable message tracking in Exchange 2000 Server

262162 Using the Message Tracking Center to track a message

317700 How to change the location of the message tracking logs in Exchange 2000 Server

Related Questions and Answers
Q: When a message is initially generated in the system, what event is associated in the tracking log?

A: There are different events for different paths of submission of the message to Exchange 2000. For example, for messages that are submitted through SMTP, the first event ID in the tracking log is 1019, whereas for messages that are submitted through Store the first event ID in the tracking log is 1027.

Q: Is there one event ID that covers the creation of all messages and only appears one time per message?

A: There is no one event that &quot;covers the creation of all messages,&quot; because messages can be created in a variety of ways, including various clients, remote servers and pickup directory. It would either make no sense or be impossible to use same event for all these code paths. However, event 1019 is logged when any message enters the Inetinfo side transport processing.

Understand that in many cases it is possible for the tracking log to contain multiple 1019 events in the tracking log that have the same message ID. For example, this may occur if the server is restarted multiple times during a period when the remote destination for the particular message is down. On each restart, the message is resubmitted, and event 1019 is logged. This is expected and is the best behavior you can hope for.

Q: Why are there multiple 1020 and 1031 events logged for the same message ID?

A: This is typical because the same message ID can be transferred out (which generates events 1020 and 1031) multiple times, for example, to someone@example.com.

Additional query words: XADM

Keywords: kbinfo KB311739

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.