Microsoft KB Archive Search

Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.

  1. Home
  2. Tracking log event numbers for Exchange 2000 Server

Tracking log event numbers for Exchange 2000 Server

View products that this article applies to.

This article was previously published under Q311739

↑ Back to the top

Summary

Tracking logs are created when message tracking is enabled on a Microsoft Exchange 2000 Server component. Message tracking logs are tab-delimited text files. You can view these logs in the Message Tracking Center in the Exchange System Manager, or you can load the logs into a spreadsheet program, such as Microsoft Excel. You can also write an application to interpret message tracking logs.

↑ Back to the top

More information

Tracking logs are located in the \Exchsrvr\ServerName.log folder. Each daily log is named according to the date that it was created (in the yyyymmdd.log format). Like all times in the tracking log, the file name date is in coordinated universal time (UTC, or Greenwich Mean Time [GMT]).

The following table defines the fields in the Exchange 2000 tracking logs: 
Event#   Event Type                     Description
		
0        Message transfer in            The message was received from a server, connector, or gateway. 
1        Probe transfer in              An X.400 Probe was received from a gateway, link, or MTA. 
2        Report transfer in             A delivery receipt or NDR was received from a server, connector, or gateway. 
4        Message submission             The message was sent by the client. 
5        Probe submission               An X.400 Probe was received from a user. 
6        Probe transfer out             An X.400 Probe was sent to a gateway, link, or MTA. 
7        Message transfer out           The message was sent to a server, connector, or gateway. 
8        Report transfer out            A delivery receipt or NDR was sent to a server, connector, or gateway. 
9        Message delivered              The message was delivered to a mailbox or public folder. 
10       Report delivered               A delivery receipt or NDR was delivered to a mailbox. <BR/>

NEW      NEW                            NEW 

18       StartAssocByMTSUser 	
23       ReleaseAssocByMTSUse 	
28       Message redirected             The message was sent to a mailbox other than those of the recipients. 
29       Message rerouted               The message was routed to an alternate path. 
31       Downgrading                    An X.400 message was downgraded to 1984 format prior to relay. 
33       Report absorption              The number of delivery receipts or NDRs exceeded a threshold, and the reports were deleted. 
34       Report generation              A delivery receipt or NDR was created. 
43       Unroutable report discarded    A delivery receipt or NDR could not be routed and was deleted from the queue. 
50       Gateway deleted message        The Administrator deleted an X.400 message queued for a gateway. 
51       Gateway deleted probe          The Administrator deleted an X.400 probe queued for a gateway. 
52       Gateway deleted report         The administrator deleted an X.400 report queued for a gateway. 
1000     Local Delivery                 The sender and recipient are on the same server. 
1001     Backbone transfer in           Mail was received from another MAPI system across a connector or gateway. 
1002     Backbone transfer out          Mail was sent to another MAPI system across a connector or gateway. 
1003    Gateway transfer out            The message was sent through a gateway. 
1004    Gateway transfer in             The message was received from a gateway. 
1005    Gateway report transfer in      A delivery receipt or NDR was received from a gateway. 
1006    Gateway report transfer out     A delivery receipt or NDR was sent through a gateway. 
1007    Gateway report generation       A gateway generated an NDR for a message. 
1010    SMTP Queued Outbound            Outbound mail was queued for delivery by the Internet Mail Service. 
1011    SMTP Transferred Outbound       Outbound mail was transferred to an Internet recipient. 
1012    SMTP Received Inbound           Inbound mail was received from by the Internet Mail Service. 
1013    SMTP Transferred                Inbound Mail received by the Internet Mail Service was transferred to the Information Store.
1014    SMTP Message Rerouted           An Internet message is being rerouted or forwarded to the proper location.
1015    SMTP Report Transferred In      A delivery receipt or NDR was received by the Internet Mail Service 
1016    SMTP Report Transferred Out     A delivery receipt or NDR was sent to the Internet Mail Service.
1017    SMTP Report Generated           A delivery receipt or NDR was created.
1018    SMTP Report Absorbed            The receipt or NDR could not be delivered, and was absorbed. (It is not possible to send an NDR for an NDR.)

NEW     NEW                             NEW 

1019    SMTP Submit Message to AQ       SMTP: Message Submitted to Advanced Queuing 
1020    SMTP Begin Outbound Transfer    SMTP: Started Outbound Transfer of Message 
1021    SMTP BadMail                    SMTP: Message Sent to Badmail 
1022    SMTP AQ Failure                 SMTP: Advanced Queue Failure 
1023    SMTP Local Delivery             SMTP: Message Delivered Locally 
1024    SMTP Submit Message To Cat      SMTP: Message Submitted to Categorizer 
1025    SMTP Begin Submit Message       SMTP: Started Message Submission to Advanced Queue 
1026    SMTP AQ Failed Message          SMTP: Advanced Queue Failed to Deliver Message 
1027    SMTP Submit Message To SD       SMTP Store Driver: Message Submitted from Store 
1028    SMTP SD Local Delivery          SMTP Store Driver: Message Delivered Locally to Store 
1029    SMTP SD Gateway Delivery        SMTP Store Driver Submitted Message to MTA 
1030    SMTP NDR All                    SMTP: Non-Delivered Report (NDR) Generated 
1031    SMTP End Outbound Transfer      SMTP: Ending Outbound Transfer
For additional information about Microsoft Exchange message tracking, click the following article numbers to view the articles in the Microsoft Knowledge Base:
246856� How to enable message tracking in Exchange 2000 Server
262162� Using the Message Tracking Center to track a message
317700� How to change the location of the message tracking logs in Exchange 2000 Server

Related Questions and Answers

Q: When a message is initially generated in the system, what event is associated in the tracking log?
A: There are different events for different paths of submission of the message to Exchange 2000. For example, for messages that are submitted through SMTP, the first event ID in the tracking log is 1019, whereas for messages that are submitted through Store the first event ID in the tracking log is 1027.

Q: Is there one event ID that covers the creation of all messages and only appears one time per message?
A: There is no one event that "covers the creation of all messages," because messages can be created in a variety of ways, including various clients, remote servers and pickup directory. It would either make no sense or be impossible to use same event for all these code paths. However, event 1019 is logged when any message enters the Inetinfo side transport processing.

Understand that in many cases it is possible for the tracking log to contain multiple 1019 events in the tracking log that have the same message ID. For example, this may occur if the server is restarted multiple times during a period when the remote destination for the particular message is down. On each restart, the message is resubmitted, and event 1019 is logged. This is expected and is the best behavior you can hope for.

Q: Why are there multiple 1020 and 1031 events logged for the same message ID?
A: This is typical because the same message ID can be transferred out (which generates events 1020 and 1031) multiple times, for example, to someone@example.com.

↑ Back to the top

Keywords: KB311739, kbinfo

↑ Back to the top

Article Info
Article ID : 311739
Revision : 9
Created on : 2/27/2007
Published on : 2/27/2007
Exists online : False
Views : 311