Message Tracking Logs field descriptions in Exchange 2000 Server (246965)


The information in this article applies to:

  • Microsoft Exchange 2000 Server
This article was previously published under Q246965

SUMMARY

Tracking logs in Microsoft Exchange 2000 Server have a significantly different format then Microsoft Exchange Server 5.5 tracking logs. This article discusses the information format in the tracking log files that are generated by Exchange 2000.

MORE INFORMATION

The tracking log file is stamped with the following information at the very start of the file.

# Message Tracking Log File
# Exchange System Attendant Version 6.0.xxxx

The following is a list of all the information available in columnar form in the tracking log file:

Field numberField nameDescription
1DateDate of the event.
2TimeGreenwich mean time of the event.
3Client-IPIP of connecting client.
4Client-hostnameHostname of connecting client.
5Partner-nameName of the messaging service that the message is handed off to. In Exchange 2000, the service can be: SMTP, X400, MAPI, IMAP4, POP3, STORE. This is essentially the same as Exchange Server 5.5, but in Exchange 2000, there are more possibilities for this field.
6Server-hostnameHostname of the server that is making the log entry.
7Server-IPIP of the server that is making the log entry.
8Recipient-addressMessage recipient (SMTP or X.400 address).
9Event-IDInteger corresponding to the Event ID of the action logged, for example: sent, received, delete, retrieve.
10MSGIDMessage ID.
11PriorityThe priority is represented by -1 if low, 0 if normal, 1 if high
12Recipient-Report-StatusA number representing the result of an attempt to deliver a report to the recipient: 0 if delivered, 1 if not delivered. This is used only for reports (non-delivery reports [NDRs], delivery receipts [DRs]). On other events, it is blank.
13Total-bytesMessage size (in bytes).
14Number-recipientsTotal number of recipients.
15Origination-timeDelivery time (in seconds) representing the time it takes to deliver the message. Determined from the difference between the timestamp and time encoded in Message ID. Only valid for messages within the Exchange organization (all versions); there is no requirement to decode other product message IDs such as Sendmail, and so on.
16EncryptionFor the primary body part: 0 if no encryption, 1 if signed only, 2 if encrypted. This is per message, not per recipient.
17Service-version Version of the service making the log entry.
18Linked-MSGIDIf there is a MSG ID from another service, it is given here to link the message across services.
19Message-subjectThe subject of the message, truncated to 256 bytes.
20Sender-addressPrimary address of the originating mailbox, if known. This could be SMTP, X.400, or Distinguished Name (DN), depending on transport.
Modification Type:MajorLast Reviewed:2/27/2006
Keywords:kbinfo KB246965
©2004 Microsoft Corporation. All rights reserved.