How to enable SMTP protocol logging in Exchange 2000 Server and in Exchange Server 2003

This article discusses how to install and enable Simple Mail Transfer Protocol (SMTP) protocol logging in Microsoft Exchange 2000 Server and in Microsoft Exchange Server 2003.

Description of the Protolog.dll file

The Protolog.dll file is a protocol sink that can log SMTP errors, including Xexch50, Exps, and X-Linkstate2 errors, to the application event log. Because the logs are actually events, you are only required to open the application event log to see the protocol level logs that this sink generates.

Installing SMTP protocol logging

Exchange 2000

To install SMTP protocol logging on an Exchange 2000 computer, you must copy the Protolog.dll file to the Program Files\Exchsrvr\Bin folder and then register the .dll file. This procedure registers the Component Object Model (COM) object, and also binds the sink to all existing SMTP virtual servers in the metabase.

The Protolog.dll file is not included with Exchange 2000. To obtain the Protolog.dll file, contact Microsoft Product Support Services. For a complete list of Microsoft Product Support Services phone numbers and information about support costs, visit the following Microsoft Web site:To register the .dll file, copy the Protolog.dll file to the Exchsrvr\Bin folder and then run the following command at a command prompt:Note You must restart the Internet Information Services (IIS) Admin service for the sink to work correctly.

To unregister the Protolog.dll file, run the following command at a command prompt: Note If you create a new virtual server after you register the .dll file, you must re-register the Protolog.dll file for the sink to work on that virtual server.

Exchange 2003

The Protolog.dll file is installed and registered with Exchange 2003. The file is located in the Exchsrvr\Bin folder.

Available logging levels

Exchange 2000

• None: Nothing is logged. This is the default.
• Minimum: Fatal (500 level) SMTP protocol errors are logged. Duplicates are not logged.
• Medium or Maximum: Transient (400 level) and fatal (500 level) SMTP protocol errors are logged. Duplicates are not logged.
• Field Engineering: All events are logged, including duplicates.

Note If you set the logging level to Maximum, you receive the same information as when the logging level is set to Medium. No additional benefits are gained by changing the logging level from Medium to Maximum.

Exchange 2003

• None: Nothing is logged. This is the default.
• Minimum: Fatal (500 level) SMTP protocol errors are logged. Duplicates are not logged.
• Medium: Transient (400 level) and fatal (500 level) SMTP protocol errors are logged. Duplicates are not logged.
• Maximum: Transient (400 level) and fatal (500 level) SMTP protocol errors are logged. Duplicates are logged.
• Field Engineering: All events are logged, including duplicates.

Setting the logging level

To set the logging level, follow these steps:

1. Start the Exchange System Manager tool.
2. If administrative groups are enabled, expand Administrative Groups, and then expand your administrative group.
3. Expand Servers.
4. Right-click your Exchange computer, and then click Properties.
5. Click the Diagnostics Logging tab.
6. In the Services column, click MSExchangeTransport.
7. In the Categories column, click SMTP Protocol.
8. Under Logging level, click the appropriate level.
9. Click OK.

If you want to enable the field engineering logging level, you must configure a registry value. To do this, follow these steps.

Warning If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

1. Click Start, click Run, type regedit in the Open box, and then click OK.
2. Locate and then click the following registry subkey:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeTransport\Diagnostics
3. In the right pane, right-click 6 SMTP Protocol, and then click Modify.
4. In the Value data box, type a value of 7, and then click OK.
5. Quit Registry Editor.