Q173364: XADM: Exchange 5.0 and 5.5 Tracking Log Event Numbers
Article: Q173364
Product(s): Microsoft Exchange
Version(s): 5.0,5.5
Operating System(s):
Keyword(s): exc5 exc55
Last Modified: 12-JUL-2002
-------------------------------------------------------------------------------
The information in this article applies to:
- Microsoft Exchange Server, versions 5.5, 5.0
-------------------------------------------------------------------------------
SUMMARY
=======
Tracking logs are created when message tracking is enabled on a Microsoft
Exchange Server component. These logs can be read and edited by any text editor.
The logs are tab delimited and can be loaded into spreadsheet programs like
Microsoft Excel. You can also write an application to interpret message tracking
logs.
For a list of the tracking log events generated by Microsoft Exchange Server,
version 4.0, please refer to the following article in the Microsoft Knowledge
Base:
Q174078 XADM: Tracking Log Event Numbers for Exchange 4.0
The events 1010 thru 1018 were not available in previous versions of Microsoft
Exchange Server.
MORE INFORMATION
================
Message tracking must be enabled for a component to begin recording activity in
the tracking log. When you enable message tracking for any component, all
similar components on servers in that site write to the tracking log.
To Enable Message Tracking for the Information Store
----------------------------------------------------
1. In the Exchange Server Administrator program, double-click Information Store
Site Configuration.
2. Click the General tab, and click to select the "Enable message tracking"
check box.
To Enable Message Tracking for the MTA
--------------------------------------
1. In the Exchange Server Administrator program, double-click MTA Site
Configuration.
2. Click the General tab, and click to select the "Enable message tracking"
check box.
To Enable Message Tracking for the Internet Mail Connector
----------------------------------------------------------
1. Double-click on the Internet mail connector for this site.
2. Click the Internet Mail tab, and click to select the "Enable message
tracking" check box.
Tracking logs are located in Exchsrvr\Tracking.log. Each daily log is named by
the date on which it was created in yyyymmdd.log format. The file name date,
like all time in the tracking log, is in Greenwich mean time.
The following table defines the event numbers in the tracking logs.
Event# Event Type Description
0 Message transfer in The message was received from a
server, connector, or gateway.
1 Probe transfer in An X.400 Probe was received from a
gateway, link, or MTA.
2 Report transfer in A delivery receipt or NDR was
received from a server, connector,
or gateway.
4 Message submission The message was sent by the client.
5 Probe submission An X.400 Probe was received from a
user.
6 Probe transfer out An X.400 Probe was sent to a
gateway, link, or MTA.
7 Message transfer out The message was sent to a server,
connector, or gateway.
8 Report transfer out A delivery receipt or NDR was sent
to a server, connector, or gateway.
9 Message delivered The message was delivered to a
mailbox or public folder.
10 Report delivered A delivery receipt or NDR was
delivered to a mailbox.
26 Distribution list expansion A recipient distribution list was
expanded so the message could be
sent to different addresses.
28 Message redirected The message was sent to a mailbox
other than those of the recipients.
29 Message rerouted The message was routed to an
alternate path.
31 Downgrading An X.400 message was downgraded to
1984 format prior to relay.
33 Report absorption The number of delivery receipts or
NDRs exceeded a threshold, and the
reports were deleted.
34 Report generation A delivery receipt or NDR was
created.
43 Unroutable report discarded A delivery receipt or NDR could not
be routed and was deleted from the
queue.
50 Gateway deleted message The Administrator deleted an X.400
message queued for a gateway.
51 Gateway deleted probe The Administrator deleted an X.400
probe queued for a gateway.
52 Gateway deleted report The administrator deleted an X.400
report queued for a gateway.
1000 Local Delivery The sender and recipient are on the
same server.
1001 Backbone transfer in Mail was received from another MAPI
system across a connector or
gateway.
1002 Backbone transfer out Mail was sent to another MAPI
system across a connector or
gateway.
1003 Gateway transfer out The message was sent through a
gateway.
1004 Gateway transfer in The message was received from a
gateway.
1005 Gateway report transfer in A delivery receipt or NDR was
received from a gateway.
1006 Gateway report transfer out A delivery receipt or NDR was sent
through a gateway.
1007 Gateway report generation A gateway generated an NDR for a
message.
1010 SMTP Queued Outbound Outbound mail was queued for
delivery by the Internet Mail
Service.
1011 SMTP Transferred Outbound Outbound mail was
transferred to an Internet
recipient.
1012 SMTP Received Inbound Inbound mail was received
from by the Internet Mail Service.
1013 SMTP Transferred Inbound Mail received by the
Internet Mail Service was
transferred to the Information
Store.
1014 SMTP Message Rerouted An Internet message is being
rerouted or forwarded to the proper
location.
1015 SMTP Report Transferred In A delivery receipt or NDR was
received by the Internet Mail
Service.
1016 SMTP Report Transferred Out A delivery receipt or NDR was sent
to the Internet Mail Service.
1017 SMTP Report Generated A delivery receipt or NDR was
created.
1018 SMTP Report Absorbed The receipt or NDR could not be
delivered, and was absorbed. (It is
not possible to send an NDR for an
NDR.)
Additional query words:
======================================================================
Keywords : exc5 exc55
Technology : kbExchangeSearch kbExchange500 kbExchange550 kbZNotKeyword2
Version : :5.0,5.5
Issue type : kbinfo
=============================================================================
THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.
Copyright Microsoft Corporation 1986-2002.