Article ID: 246965
Article Last Modified on 2/21/2007
APPLIES TO
- Microsoft Exchange 2000 Server Standard Edition
This article was previously published under Q246965
SUMMARY
Tracking logs in Microsoft Exchange 2000 Server have a significantly different format then Microsoft Exchange Server 5.5 tracking logs. This article discusses the information format in the tracking log files that are generated by Exchange 2000.
MORE INFORMATION
The tracking log file is stamped with the following information at the very start of the file.
- Message Tracking Log File
- Exchange System Attendant Version 6.0.xxxx
The following is a list of all the information available in columnar form in the tracking log file:
| Field number | Field name | Description |
|---|---|---|
| 1 | Date | Date of the event. |
| 2 | Time | Greenwich mean time of the event. |
| 3 | Client-IP | IP of connecting client. |
| 4 | Client-hostname | Hostname of connecting client. |
| 5 | Partner-name | Name of the messaging service that the message is handed off to. In Exchange 2000, the service can be: SMTP, X400, MAPI, IMAP4, POP3, STORE. This is essentially the same as Exchange Server 5.5, but in Exchange 2000, there are more possibilities for this field. |
| 6 | Server-hostname | Hostname of the server that is making the log entry. |
| 7 | Server-IP | IP of the server that is making the log entry. |
| 8 | Recipient-address | Message recipient (SMTP or X.400 address). |
| 9 | Event-ID | Integer corresponding to the Event ID of the action logged, for example: sent, received, delete, retrieve. |
| 10 | MSGID | Message ID. |
| 11 | Priority | The priority is represented by -1 if low, 0 if normal, 1 if high |
| 12 | Recipient-Report-Status | A number representing the result of an attempt to deliver a report to the recipient: 0 if delivered, 1 if not delivered. This is used only for reports (non-delivery reports [NDRs], delivery receipts [DRs]). On other events, it is blank. |
| 13 | Total-bytes | Message size (in bytes). |
| 14 | Number-recipients | Total number of recipients. |
| 15 | Origination-time | Delivery time (in seconds) representing the time it takes to deliver the message. Determined from the difference between the timestamp and time encoded in Message ID. Only valid for messages within the Exchange organization (all versions); there is no requirement to decode other product message IDs such as Sendmail, and so on. |
| 16 | Encryption | For the primary body part: 0 if no encryption, 1 if signed only, 2 if encrypted. This is per message, not per recipient. |
| 17 | Service-version | Version of the service making the log entry. |
| 18 | Linked-MSGID | If there is a MSG ID from another service, it is given here to link the message across services. |
| 19 | Message-subject | The subject of the message, truncated to 256 bytes. |
| 20 | Sender-address | Primary address of the originating mailbox, if known. This could be SMTP, X.400, or Distinguished Name (DN), depending on transport. |
Keywords: kbinfo KB246965
