Message tracking event IDs in Exchange Server 2003

Article translations Article translations
Article ID: 821905 - View products that this article applies to.
Expand all | Collapse all

On This Page

Summary

This article contains information about message tracking in Microsoft Exchange Server 2003 and includes a list of some of the event IDs that are logged to message tracking log files. You can enable message tracking logs to track or to troubleshoot the flow or status of a message in Exchange Server 2003. You can record information about the sender, the message, and the recipient. If you want to log more detailed information, you can also record the subject line of messages.

More information

Exchange Server 2003 enhances message tracking functionality in the following ways:
  • Exchange Server 2003 automatically creates a shared folder to the message tracking logs. You can also use Exchange System Manager to change the location of the message tracking logs.
  • You can to track a message beyond the categorization phase, when the recipient address is verified in the Active Directory directory service and its route is determined.
To enable message tracking in Exchange Server 2003:
  1. Start Exchange System Manager.
  2. Expand Administrative Groups, expand AdministrativeGroupName, expand Servers, expand ServerName, and then click Properties.
  3. Click the General tab.
  4. To log information about the sender, about the time the message was sent or received, about the message size and priority, or about the message recipients, click to select the Enable message tracking check box.
  5. To record the subject of any message sent to, sent from, or sent through the server, click to select the Enable subject logging and display check box.

    Note By default, the tracking logs are located in the C:\Program Files\Exchsrvr\YourServerName.log folder. Each daily log is named in the yyyymmdd.log format according to the date that the log was created. The file name date is in Coordinated Universal Time (UTC).
The event IDs that are used in Exchange Server 2003 message tracking logs include the following:
Collapse this tableExpand this table
Event Number Event TypeDescription
0Message transfer inThe message was received from a server, a connector, or a gateway.
1Probe transfer inAn X.400 probe was received from a gateway, a link, or a message transfer agent (MTA).
2Report transfer inA delivery receipt or a non-delivery report (NDR) was received from a server, a connector, or a gateway.
4Message submission The message was sent by the client.
5Probe submissionAn X.400 probe was received from a user.
6 Probe transfer outAn X.400 probe was sent to a gateway, a link, or an MTA.
7Message transfer outThe message was sent to a server, a connector, or a gateway.
8Report transfer outA delivery receipt or an NDR was sent to a server, a connector, or a gateway.
9Message deliveredThe message was delivered to a mailbox or a public folder.
10Report deliveredA delivery receipt or an NDR was delivered to a mailbox.
18 StartAssocByMTSUser
23ReleaseAssocByMTSUse
28Message redirectedThe message was sent to mailboxes other than the mailboxes of the recipients.
29Message reroutedThe message was routed to an alternative path.
31DowngradingAn X.400 message was downgraded to 1984 format before relay.
33Report absorptionThe number of delivery receipts or of NDRs exceeded a threshold and the reports were deleted.
34Report generationA delivery receipt or an NDR was created.
43Unroutable report discardedA delivery receipt or an NDR could not be routed and was deleted from the queue.
50Gateway deleted messageThe administrator deleted an X.400 message that was queued for a gateway.
51Gateway deleted probeThe administrator deleted an X.400 probe that was queued for a gateway.
52Gateway deleted reportThe administrator deleted an X.400 report that was queued for a gateway.
1000Local deliveryThe sender and the recipient are on the same server.
1001Backbone transfer in Mail was received from another MAPI system across a connector or across a gateway.
1002Backbone transfer out Mail was sent to another MAPI system across a connector or across a gateway.
1003Gateway transfer out The message was sent through a gateway.
1004Gateway transfer inThe message was received from a gateway.
1005Gateway report transfer in A delivery receipt or an NDR was received from a gateway.
1006Gateway report transfer out A delivery receipt or an NDR was sent through a gateway.
1007Gateway report generationA gateway generated an NDR for a message.
1010SMTP queued outbound Outgoing mail was queued for delivery by the Internet Mail Service.
1011SMTP transferred outboundOutgoing mail was transferred to an Internet recipient.
1012 SMTP received inboundIncoming mail was received from by the Internet Mail Service.
1013SMTP transferredIncoming mail that was received by the Internet Mail Service was transferred to the information store.
1014SMTP message reroutedAn Internet message is being rerouted or forwarded to the correct location.
1015 SMTP report transferred InA delivery receipt or an NDR was received by the Internet Mail Service
1016SMTP report transferred outA delivery receipt or an NDR was sent to the Internet Mail Service.
1017 SMTP report generatedA delivery receipt or an NDR was created.
1018SMTP report absorbedThe receipt or the NDR could not be delivered and was absorbed. (You cannot send an NDR for an NDR.)
1019 SMTP submit message to AQA new message is submitted to Advanced Queuing.
1020 SMTP begin outbound transferA message is about to be sent over the wire by SMTP.
1021SMTP bad mailThe message was transferred to the Badmail folder.
1022SMTP AQ failureA fatal Advanced Queuing error occurred. Information about the failure was written to the Event Manager.
1023SMTP local deliveryA message was successfully delivered by a store drive (logged by Advanced Queue).
1024SMTP submit message to catAdvanced Queuing submitted a message to the categorizer.
1025SMTP begin submit message A new message was submitted to Advanced Queuing.
1026SMTP AQ failed messageAdvanced Queuing could not process the message. The message caused an NDR to be sent, or the message was put in the Badmail folder.
1027SMTP submit message to SDA message was submitted to the store driver by the MTA.
1028 SMTP SD local deliveryThe store driver successfully delivered a message (logged by store driver).
1029 SMTP SD gateway deliveryThe store driver transferred the message to the MTA.
1030SMTP NDR all All recipients were sent an NDR.
1031SMTP end outbound transferThe outgoing message was successfully transferred.
1032SMTP message scheduled to retry categorization
1033 SMTP message categorized and queued for routing
1034 SMTP message routed and queued for remote delivery
1035SMTP message scheduled to retry routing
1036SMTP message queued for local delivery
1037 SMTP message scheduled to retry local delivery
1038SMTP message routed and queued for gateway delivery
1039SMTP message deleted by Intelligent Message Filtering
1040SMTP message rejected by Intelligent Message Filtering
1041SMTP message archived by Intelligent Message Filtering
1042Message redirected to the alternate recipient

Related questions and answers

Q1: When a message is generated in the system for the first time, what event is associated with that message in the tracking log?

A1: There are different events for different message submission paths to Exchange Server 2003. For example, for messages that are submitted through the SMTP component, the first event ID in the tracking log is 1019. For messages that are submitted through the Store component, the first event ID in the tracking log is 1027.

Q2: Is there one event ID that covers the creation of all messages and that only appears one time per message?

A2: There is no one event that covers the creation of all messages because messages can be created in various ways by various clients, remote servers, and pickup directory. It would make no sense to use the same event for all these code paths. Or, it would be impossible to use the same event for all these code paths. However, event 1019 is logged when any message enters Inetinfo-side transport processing. The tracking log may frequently contain multiple 1019 events that have the same message ID. For example, this may occur if the server is restarted multiple times during a period when the remote destination for the particular message is down. On each restart, the message is resubmitted, and event 1019 is logged. This is expected behavior.

Q3: Why are there multiple 1020 and 1031 events that are logged for the same message ID?

A3: This is expected behavior. The same message ID can be transferred out multiple times. When the same message ID is transferred out multiple times, events 1020 and 1031 are generated.

Properties

Article ID: 821905 - Last Review: September 3, 2013 - Revision: 10.0
Applies to
  • Microsoft Exchange Server 2003 Enterprise Edition
  • Microsoft Exchange Server 2003 Standard Edition
  • Microsoft Windows Small Business Server 2003 Premium Edition
  • Microsoft Windows Small Business Server 2003 Standard Edition
Keywords: 
KB821905

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com