Article ID: 311739 - View products that this article applies to.
This article was previously published under Q311739
This article has been archived. It is offered "as is" and will no longer be updated.
Tracking logs are created when message tracking is enabled on a Microsoft Exchange 2000 Server component. Message tracking logs are tab-delimited text files. You can view these logs in the Message Tracking Center in the Exchange System Manager, or you can load the logs into a spreadsheet program, such as Microsoft Excel. You can also write an application to interpret message tracking logs.
Tracking logs are located in the \Exchsrvr\ServerName.log folder. Each daily log is named according to the date that it was created (in the yyyymmdd.log format). Like all times in the tracking log, the file name date is in coordinated universal time (UTC, or Greenwich Mean Time [GMT]).
The following table defines the fields in the Exchange 2000 tracking logs:
For additional information about Microsoft Exchange message tracking, click the following article numbers to view the articles in the Microsoft Knowledge Base:
Event# Event Type Description 0 Message transfer in The message was received from a server, connector, or gateway. 1 Probe transfer in An X.400 Probe was received from a gateway, link, or MTA. 2 Report transfer in A delivery receipt or NDR was received from a server, connector, or gateway. 4 Message submission The message was sent by the client. 5 Probe submission An X.400 Probe was received from a user. 6 Probe transfer out An X.400 Probe was sent to a gateway, link, or MTA. 7 Message transfer out The message was sent to a server, connector, or gateway. 8 Report transfer out A delivery receipt or NDR was sent to a server, connector, or gateway. 9 Message delivered The message was delivered to a mailbox or public folder. 10 Report delivered A delivery receipt or NDR was delivered to a mailbox. <BR/> NEW NEW NEW 18 StartAssocByMTSUser 23 ReleaseAssocByMTSUse 28 Message redirected The message was sent to a mailbox other than those of the recipients. 29 Message rerouted The message was routed to an alternate path. 31 Downgrading An X.400 message was downgraded to 1984 format prior to relay. 33 Report absorption The number of delivery receipts or NDRs exceeded a threshold, and the reports were deleted. 34 Report generation A delivery receipt or NDR was created. 43 Unroutable report discarded A delivery receipt or NDR could not be routed and was deleted from the queue. 50 Gateway deleted message The Administrator deleted an X.400 message queued for a gateway. 51 Gateway deleted probe The Administrator deleted an X.400 probe queued for a gateway. 52 Gateway deleted report The administrator deleted an X.400 report queued for a gateway. 1000 Local Delivery The sender and recipient are on the same server. 1001 Backbone transfer in Mail was received from another MAPI system across a connector or gateway. 1002 Backbone transfer out Mail was sent to another MAPI system across a connector or gateway. 1003 Gateway transfer out The message was sent through a gateway. 1004 Gateway transfer in The message was received from a gateway. 1005 Gateway report transfer in A delivery receipt or NDR was received from a gateway. 1006 Gateway report transfer out A delivery receipt or NDR was sent through a gateway. 1007 Gateway report generation A gateway generated an NDR for a message. 1010 SMTP Queued Outbound Outbound mail was queued for delivery by the Internet Mail Service. 1011 SMTP Transferred Outbound Outbound mail was transferred to an Internet recipient. 1012 SMTP Received Inbound Inbound mail was received from by the Internet Mail Service. 1013 SMTP Transferred Inbound Mail received by the Internet Mail Service was transferred to the Information Store. 1014 SMTP Message Rerouted An Internet message is being rerouted or forwarded to the proper location. 1015 SMTP Report Transferred In A delivery receipt or NDR was received by the Internet Mail Service 1016 SMTP Report Transferred Out A delivery receipt or NDR was sent to the Internet Mail Service. 1017 SMTP Report Generated A delivery receipt or NDR was created. 1018 SMTP Report Absorbed The receipt or NDR could not be delivered, and was absorbed. (It is not possible to send an NDR for an NDR.) NEW NEW NEW 1019 SMTP Submit Message to AQ SMTP: Message Submitted to Advanced Queuing 1020 SMTP Begin Outbound Transfer SMTP: Started Outbound Transfer of Message 1021 SMTP BadMail SMTP: Message Sent to Badmail 1022 SMTP AQ Failure SMTP: Advanced Queue Failure 1023 SMTP Local Delivery SMTP: Message Delivered Locally 1024 SMTP Submit Message To Cat SMTP: Message Submitted to Categorizer 1025 SMTP Begin Submit Message SMTP: Started Message Submission to Advanced Queue 1026 SMTP AQ Failed Message SMTP: Advanced Queue Failed to Deliver Message 1027 SMTP Submit Message To SD SMTP Store Driver: Message Submitted from Store 1028 SMTP SD Local Delivery SMTP Store Driver: Message Delivered Locally to Store 1029 SMTP SD Gateway Delivery SMTP Store Driver Submitted Message to MTA 1030 SMTP NDR All SMTP: Non-Delivered Report (NDR) Generated 1031 SMTP End Outbound Transfer SMTP: Ending Outbound Transfer
(http://support.microsoft.com/kb/246856/ )How to enable message tracking in Exchange 2000 Server
(http://support.microsoft.com/kb/262162/ )Using the Message Tracking Center to track a message
(http://support.microsoft.com/kb/317700/ )How to change the location of the message tracking logs in Exchange 2000 Server
Related Questions and AnswersQ: When a message is initially generated in the system, what event is associated in the tracking log?
A: There are different events for different paths of submission of the message to Exchange 2000. For example, for messages that are submitted through SMTP, the first event ID in the tracking log is 1019, whereas for messages that are submitted through Store the first event ID in the tracking log is 1027.
Q: Is there one event ID that covers the creation of all messages and only appears one time per message?
A: There is no one event that "covers the creation of all messages," because messages can be created in a variety of ways, including various clients, remote servers and pickup directory. It would either make no sense or be impossible to use same event for all these code paths. However, event 1019 is logged when any message enters the Inetinfo side transport processing.
Understand that in many cases it is possible for the tracking log to contain multiple 1019 events in the tracking log that have the same message ID. For example, this may occur if the server is restarted multiple times during a period when the remote destination for the particular message is down. On each restart, the message is resubmitted, and event 1019 is logged. This is expected and is the best behavior you can hope for.
Q: Why are there multiple 1020 and 1031 events logged for the same message ID?
A: This is typical because the same message ID can be transferred out (which generates events 1020 and 1031) multiple times, for example, to email@example.com.