How to activate protocol logging for POP3 and IMAP4

When you run Exchange 2000 Server, you can log Post Office Protocol 3 (POP3) and Internet Message Access Protocol 4 (IMAP4) protocol activity to a log file. This article describes how to enable and locate this logging.

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

To enable logging for the IMAP4 protocol

1. Start Registry Editor (Regedt32.exe).
2. Locate the IMAP Protocol Log Level value under the following key in the registry:
   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Imap4svc\Parameters
   Note The preceding registry key is one path; it has been wrapped for readability.
   
   
3. On the Edit menu, click DWORD, type: 5, and then click OK.
4. Quit Registry Editor.

Note The value for IMAP Protocol Log Level can be from 0 (zero) through 5: Zero (0) is no logging and 5 is maximum logging. You can also modify the POP3 Protocol Log Path value to specify a different path for the log files.

To enable logging for the POP3 protocol

1. Start Registry Editor (Regedt32.exe).
2. Locate the POP3 Protocol Log Level value under the following key in the registry:
   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Pop3svc\Parameters
   Note The preceding registry key is one path; it has been wrapped for readability.
   
   
3. On the Edit menu, click DWORD, type: 5, and then click OK.
4. Quit Registry Editor.

Note The value for POP3 Protocol Log Level can be from zero (0) through 5: Zero (0) is no logging and 5 is maximum logging. You can also modify the POP3 Protocol Log Path value to specify a different path for the log files.

Note The logging feature is designed to be used for short periods of time while you gather troubleshooting information, and then turned off. If you leave protocol logging turned on, the system resources may become exhausted. As bursts of traffic occur, new log files are created. Each new log file uses two file handles in kernel memory. These file handles are not released until the IMAP service stops, the Inetinfo process stops, or the server is restarted. If frequent bursts of traffic occur and create new log files and new handles, the server eventually runs out of non-paged pool memory and does not respond. When the non-paged pool memory runs out, you may experience the following symptoms:

• The server stops responding (hangs).
• The server does not respond to ping commands.
• You may not be able to run any program on the server.

If you want to investigate the effect of these symptoms on file handles while the logging feature is turned on, use Task Manager to monitor the number of handles that are owned by Inetinfo.exe.