|Maintenance and Troubleshooting||<<||>>|
The Internet Mail Service on each Microsoft Exchange Server computer establishes multiple connections, each of which can generate events. When a problem arises, a trace of those events is a useful diagnostic tool. Use the Diagnostics Logging property page for the Internet Mail Service to set or change logging levels, log SMTP information, and create message archives.
SMTP protocol logs and message archives are triggered by the levels set in diagnostics logging. You generate these files by increasing the logging levels of the SMTP Protocol Log and Message Archival categories.
Important When you change a logging level, the Logging Level box displays the new level. However, events are logged at the previous level until the Internet Mail Service is restarted. Once you restart the Internet Mail Service, the change is effective immediately.
The application name for the Internet Mail Service, MSExchangeIMC, is listed in the Services column. All events are logged under this name in the application event log. The categories listed in the Internet Mail Service Diagnostics Logging property page match the categories of events shown in the application event log.
Important You must restart the Internet Mail Service after changing logging levels. New logging levels do not take effect until the connector is restarted.
For more information, see "Changing the Diagnostics Logging Levels" earlier in this chapter.
For more information, see "Changing the Diagnostics Logging Level" earlier in this chapter.
SMTP events are generated by Internet Mail Service connections. When you increase the diagnostics logging level for the SMTP Protocol Log category, Microsoft Exchange Server writes these events to text files. Each concurrent connection logs its events to a separate file. You can find these files in Exchsrvr\Imcdata\Log.
Tip A quick way to tell if SMTP logging is enabled is to check the application event log when the Internet Mail Service is started. If enabled, event 2004 is written to the event log. To locate this event in Event Viewer, search the application event log for the ID or the source, MSExchangeIMC, and the category, SMTP Protocol Log, of the event.
The headers and body of outgoing messages cannot be logged. However, the entire text of incoming messages is included.
|None||No text logs are created. This is the default.|
|Minimum||Connection information is written to the SMTP log.|
|Medium||SMTP commands and headers are written to the SMTP log.|
|Maximum||Complete, unformatted protocol packets are written to the SMTP log. This can log a large amount of information, which can affect server performance.|
When the diagnostics logging level of the SMTP protocol log category is Maximum, the complete incoming message transfer is written to the log. This can include several input/output (I/O) lines per command, each representing one packet. Normal transmission messages are preceded by a 2xx or 3xx message code. Level 4xx codes are temporary problems that can be resolved by resending the message. Level 5xx codes are permanent negative responses requiring some repair before another attempt to send. Level 4xx and 5xx codes are accompanied by text describing the problem.
For more information, see Request for Comments (RFC) 821.
To solve some Internet mail problems, you may need to examine the entire text of an SMTP message. When you set the diagnostics logging level of the Message Archival category to Medium or Maximum, each message sent or received by the Internet Mail Service is moved to the Archive directory. Inbound messages are in Imcdata\In\Archive; outbound messages in Imcdata\Out\Archive.
Tip To quickly determine if message archiving is enabled, check the event log when the Internet Mail Service is started. If enabled, event 2005 is written to the event log. To locate this in Event Viewer, search for the event ID or the source, MSExchangeIMC, and the category, Message Archival, of the event.
|None||No messages are archived. This is the default.|
|Minimum||No messages are archived (same as None).|
|Medium||A copy of each message processed by the Internet Mail Service is written to a text file (same as Maximum).|
|Maximum||A copy of each message processed by the Internet Mail Service is written to a text file (same as Medium). This can log a large amount of information, which can affect server performance.|