Maintenance and Troubleshooting << >>

Internet Mail Service

The Internet Mail Service on each Microsoft Exchange Server computer establishes multiple connections, each of which can generate events. When a problem arises, a trace of those events is a useful diagnostic tool. Use the Diagnostics Logging property page for the Internet Mail Service to set or change logging levels, log SMTP information, and create message archives.

SMTP protocol logs and message archives are triggered by the levels set in diagnostics logging. You generate these files by increasing the logging levels of the SMTP Protocol Log and Message Archival categories.

Important    When you change a logging level, the Logging Level box displays the new level. However, events are logged at the previous level until the Internet Mail Service is restarted. Once you restart the Internet Mail Service, the change is effective immediately.

Getting to the Internet Mail Service Diagnostics Logging property page

  1. In the Administrator window, choose Connections.
  2. Double-click an Internet Mail Service.
  3. Select the Diagnostics Logging tab.

Changing Internet Mail Service Logging Levels

The application name for the Internet Mail Service, MSExchangeIMC, is listed in the Services column. All events are logged under this name in the application event log. The categories listed in the Internet Mail Service Diagnostics Logging property page match the categories of events shown in the application event log.

Important    You must restart the Internet Mail Service after changing logging levels. New logging levels do not take effect until the connector is restarted.

For more information, see "Changing the Diagnostics Logging Levels" earlier in this chapter.

  1. Select the Diagnostics Logging tab.
  2. Select one or more categories.
  3. Select a logging level.
  4. Restart the Internet Mail Service.

For more information, see "Changing the Diagnostics Logging Level" earlier in this chapter.

Logging SMTP Information

SMTP events are generated by Internet Mail Service connections. When you increase the diagnostics logging level for the SMTP Protocol Log category, Microsoft Exchange Server writes these events to text files. Each concurrent connection logs its events to a separate file. You can find these files in Exchsrvr\Imcdata\Log.

Tip   A quick way to tell if SMTP logging is enabled is to check the application event log when the Internet Mail Service is started. If enabled, event 2004 is written to the event log. To locate this event in Event Viewer, search the application event log for the ID or the source, MSExchangeIMC, and the category, SMTP Protocol Log, of the event.

The headers and body of outgoing messages cannot be logged. However, the entire text of incoming messages is included.

  1. Select the Diagnostics Logging tab.
  2. Select SMTP Protocol Log.
  3. Select a logging level.
  4. Restart the Internet Mail Service.

Option Description
None No text logs are created. This is the default.
Minimum Connection information is written to the SMTP log.
Medium SMTP commands and headers are written to the SMTP log.
Maximum Complete, unformatted protocol packets are written to the SMTP log. This can log a large amount of information, which can affect server performance.

Interpreting an SMTP Protocol Log

When the diagnostics logging level of the SMTP protocol log category is Maximum, the complete incoming message transfer is written to the log. This can include several input/output (I/O) lines per command, each representing one packet. Normal transmission messages are preceded by a 2xx or 3xx message code. Level 4xx codes are temporary problems that can be resolved by resending the message. Level 5xx codes are permanent negative responses requiring some repair before another attempt to send. Level 4xx and 5xx codes are accompanied by text describing the problem.

For more information, see Request for Comments (RFC) 821.

Creating a Message Archive

To solve some Internet mail problems, you may need to examine the entire text of an SMTP message. When you set the diagnostics logging level of the Message Archival category to Medium or Maximum, each message sent or received by the Internet Mail Service is moved to the Archive directory. Inbound messages are in Imcdata\In\Archive; outbound messages in Imcdata\Out\Archive.

Tip   To quickly determine if message archiving is enabled, check the event log when the Internet Mail Service is started. If enabled, event 2005 is written to the event log. To locate this in Event Viewer, search for the event ID or the source, MSExchangeIMC, and the category, Message Archival, of the event.

  1. Select the Diagnostics Logging tab.
  2. Select the Message Archival category.
  3. Select a logging level.
  4. Restart the Internet Mail Service.

Option Description
None No messages are archived. This is the default.
Minimum No messages are archived (same as None).
Medium A copy of each message processed by the Internet Mail Service is written to a text file (same as Maximum).
Maximum A copy of each message processed by the Internet Mail Service is written to a text file (same as Medium). This can log a large amount of information, which can affect server performance.