DOCUMENT:Q173364 12-JUL-2002 [exchange] TITLE :XADM: Exchange 5.0 and 5.5 Tracking Log Event Numbers PRODUCT :Microsoft Exchange PROD/VER::5.0,5.5 OPER/SYS: KEYWORDS:exc5 exc55 ====================================================================== ------------------------------------------------------------------------------- The information in this article applies to: - Microsoft Exchange Server, versions 5.5, 5.0 ------------------------------------------------------------------------------- SUMMARY ======= Tracking logs are created when message tracking is enabled on a Microsoft Exchange Server component. These logs can be read and edited by any text editor. The logs are tab delimited and can be loaded into spreadsheet programs like Microsoft Excel. You can also write an application to interpret message tracking logs. For a list of the tracking log events generated by Microsoft Exchange Server, version 4.0, please refer to the following article in the Microsoft Knowledge Base: Q174078 XADM: Tracking Log Event Numbers for Exchange 4.0 The events 1010 thru 1018 were not available in previous versions of Microsoft Exchange Server. MORE INFORMATION ================ Message tracking must be enabled for a component to begin recording activity in the tracking log. When you enable message tracking for any component, all similar components on servers in that site write to the tracking log. To Enable Message Tracking for the Information Store ---------------------------------------------------- 1. In the Exchange Server Administrator program, double-click Information Store Site Configuration. 2. Click the General tab, and click to select the "Enable message tracking" check box. To Enable Message Tracking for the MTA -------------------------------------- 1. In the Exchange Server Administrator program, double-click MTA Site Configuration. 2. Click the General tab, and click to select the "Enable message tracking" check box. To Enable Message Tracking for the Internet Mail Connector ---------------------------------------------------------- 1. Double-click on the Internet mail connector for this site. 2. Click the Internet Mail tab, and click to select the "Enable message tracking" check box. Tracking logs are located in Exchsrvr\Tracking.log. Each daily log is named by the date on which it was created in yyyymmdd.log format. The file name date, like all time in the tracking log, is in Greenwich mean time. The following table defines the event numbers in the tracking logs. Event# Event Type Description 0 Message transfer in The message was received from a server, connector, or gateway. 1 Probe transfer in An X.400 Probe was received from a gateway, link, or MTA. 2 Report transfer in A delivery receipt or NDR was received from a server, connector, or gateway. 4 Message submission The message was sent by the client. 5 Probe submission An X.400 Probe was received from a user. 6 Probe transfer out An X.400 Probe was sent to a gateway, link, or MTA. 7 Message transfer out The message was sent to a server, connector, or gateway. 8 Report transfer out A delivery receipt or NDR was sent to a server, connector, or gateway. 9 Message delivered The message was delivered to a mailbox or public folder. 10 Report delivered A delivery receipt or NDR was delivered to a mailbox. 26 Distribution list expansion A recipient distribution list was expanded so the message could be sent to different addresses. 28 Message redirected The message was sent to a mailbox other than those of the recipients. 29 Message rerouted The message was routed to an alternate path. 31 Downgrading An X.400 message was downgraded to 1984 format prior to relay. 33 Report absorption The number of delivery receipts or NDRs exceeded a threshold, and the reports were deleted. 34 Report generation A delivery receipt or NDR was created. 43 Unroutable report discarded A delivery receipt or NDR could not be routed and was deleted from the queue. 50 Gateway deleted message The Administrator deleted an X.400 message queued for a gateway. 51 Gateway deleted probe The Administrator deleted an X.400 probe queued for a gateway. 52 Gateway deleted report The administrator deleted an X.400 report queued for a gateway. 1000 Local Delivery The sender and recipient are on the same server. 1001 Backbone transfer in Mail was received from another MAPI system across a connector or gateway. 1002 Backbone transfer out Mail was sent to another MAPI system across a connector or gateway. 1003 Gateway transfer out The message was sent through a gateway. 1004 Gateway transfer in The message was received from a gateway. 1005 Gateway report transfer in A delivery receipt or NDR was received from a gateway. 1006 Gateway report transfer out A delivery receipt or NDR was sent through a gateway. 1007 Gateway report generation A gateway generated an NDR for a message. 1010 SMTP Queued Outbound Outbound mail was queued for delivery by the Internet Mail Service. 1011 SMTP Transferred Outbound Outbound mail was transferred to an Internet recipient. 1012 SMTP Received Inbound Inbound mail was received from by the Internet Mail Service. 1013 SMTP Transferred Inbound Mail received by the Internet Mail Service was transferred to the Information Store. 1014 SMTP Message Rerouted An Internet message is being rerouted or forwarded to the proper location. 1015 SMTP Report Transferred In A delivery receipt or NDR was received by the Internet Mail Service. 1016 SMTP Report Transferred Out A delivery receipt or NDR was sent to the Internet Mail Service. 1017 SMTP Report Generated A delivery receipt or NDR was created. 1018 SMTP Report Absorbed The receipt or NDR could not be delivered, and was absorbed. (It is not possible to send an NDR for an NDR.) Additional query words: ====================================================================== Keywords : exc5 exc55 Technology : kbExchangeSearch kbExchange500 kbExchange550 kbZNotKeyword2 Version : :5.0,5.5 Issue type : kbinfo ============================================================================= THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY. Copyright Microsoft Corporation 2002.