XADM: Exchange 5.0 and 5.5 Tracking Log Event Numbers (173364)


The information in this article applies to:

  • Microsoft Exchange Server 5.5
  • Microsoft Exchange Server 5.0
This article was previously published under Q173364

SUMMARY

Tracking logs are created when message tracking is enabled on a Microsoft Exchange Server component. These logs can be read and edited by any text editor. The logs are tab delimited and can be loaded into spreadsheet programs like Microsoft Excel. You can also write an application to interpret message tracking logs.

For a list of the tracking log events generated by Microsoft Exchange Server, version 4.0, please refer to the following article in the Microsoft Knowledge Base:

174078 XADM: Tracking Log Event Numbers for Exchange 4.0

The events 1010 thru 1018 were not available in previous versions of Microsoft Exchange Server.

MORE INFORMATION

Message tracking must be enabled for a component to begin recording activity in the tracking log. When you enable message tracking for any component, all similar components on servers in that site write to the tracking log.

To Enable Message Tracking for the Information Store

  1. In the Exchange Server Administrator program, double-click Information Store Site Configuration.
  2. Click the General tab, and click to select the Enable message tracking check box.

To Enable Message Tracking for the MTA

  1. In the Exchange Server Administrator program, double-click MTA Site Configuration.
  2. Click the General tab, and click to select the Enable message tracking check box.

To Enable Message Tracking for the Internet Mail Connector

  1. Double-click on the Internet mail connector for this site.
  2. Click the Internet Mail tab, and click to select the Enable message tracking check box.
Tracking logs are located in Exchsrvr\Tracking.log. Each daily log is named by the date on which it was created in yyyymmdd.log format. The file name date, like all time in the tracking log, is in Greenwich mean time.

The following table defines the event numbers in the tracking logs. 
Event#   Event Type                    Description

0        Message transfer in           The message was received from a
                                       server, connector, or gateway.

1        Probe transfer in             An X.400 Probe was received from a
                                       gateway, link, or MTA.

2        Report transfer in            A delivery receipt or NDR was
                                       received from a server, connector,
                                       or gateway.

4        Message submission            The message was sent by the client.

5        Probe submission              An X.400 Probe was received from a
                                       user.

6        Probe transfer out            An X.400 Probe was sent to a 
                                       gateway, link, or MTA.

7        Message transfer out          The message was sent to a server,
                                       connector, or gateway.

8        Report transfer out           A delivery receipt or NDR was sent
                                       to a server, connector, or gateway.

9        Message delivered             The message was delivered to a
                                       mailbox or public folder.

10       Report delivered              A delivery receipt or NDR was
                                       delivered to a mailbox.

26       Distribution list expansion   A recipient distribution list was
                                       expanded so the message could be
                                       sent to different addresses.

28       Message redirected            The message was sent to a mailbox
                                       other than those of the recipients.

29       Message rerouted              The message was routed to an
                                       alternate path.

31       Downgrading                   An X.400 message was downgraded to
                                       1984 format prior to relay.

33       Report absorption             The number of delivery receipts or
                                       NDRs exceeded a threshold, and the
                                       reports were deleted.

34       Report generation             A delivery receipt or NDR was
                                       created.

43       Unroutable report discarded   A delivery receipt or NDR could not
                                       be routed and was deleted from the
                                       queue.

50       Gateway deleted message       The Administrator deleted an X.400
                                       message queued for a gateway.

51       Gateway deleted probe         The Administrator deleted an X.400
                                       probe queued for a gateway.

52       Gateway deleted report        The administrator deleted an X.400
                                       report queued for a gateway.

1000     Local Delivery                The sender and recipient are on the
                                       same server.

1001     Backbone transfer in          Mail was received from another MAPI
                                       system across a connector or
                                       gateway.

1002     Backbone transfer out         Mail was sent to another MAPI
                                       system across a connector or
                                       gateway.

1003     Gateway transfer out          The message was sent through a
                                       gateway.

1004     Gateway transfer in           The message was received from a
                                       gateway.

1005     Gateway report transfer in    A delivery receipt or NDR was
                                       received from a gateway.

1006     Gateway report transfer out   A delivery receipt or NDR was sent
                                       through a gateway.

1007     Gateway report generation     A gateway generated an NDR for a
                                       message.

1010     SMTP Queued Outbound          Outbound mail was queued for
                                       delivery by the Internet Mail
                                       Service.

1011     SMTP Transferred              Outbound Outbound mail was
                                       transferred to an Internet
                                       recipient.

1012     SMTP Received                 Inbound Inbound mail was received
                                       from by the Internet Mail Service.

1013     SMTP Transferred              Inbound Mail received by the
                                       Internet Mail Service was
                                       transferred to the Information
                                       Store.

1014     SMTP Message Rerouted         An Internet message is being
                                       rerouted or forwarded to the proper
                                       location.

1015     SMTP Report Transferred In    A delivery receipt or NDR was
                                       received by the Internet Mail
                                       Service.

1016     SMTP Report Transferred Out   A delivery receipt or NDR was sent
                                       to the Internet Mail Service.

1017     SMTP Report Generated         A delivery receipt or NDR was
                                       created.

1018     SMTP Report Absorbed          The receipt or NDR could not be
                                       delivered, and was absorbed. (It is
                                       not possible to send an NDR for an
                                       NDR.)
Modification Type:MinorLast Reviewed:4/21/2005
Keywords:kbinfo KB173364
©2004 Microsoft Corporation. All rights reserved.