Performing Message Tracking

Maintenance and Troubleshooting	<<	>>

Performing Message Tracking

The Track Message command automates tracing a message through the network. Daily tracking logs are searched for events generated when the components of each server handled the message. The message is followed through the logs of all Microsoft Exchange Server computers on the same physical network. You can repeatedly select and track messages until you have determined the source of the problem.

To track a message, you must first connect to a server to locate the message. Select a server that has the sender or recipient of the message in its global address list. If the sender and recipient are only in your personal address book (PAB) or are Microsoft Exchange Server components, connect to any server in the site. Once a message is found, the logs of all servers in the site are searched to follow the message path through the network.

Starting Message Tracking

From the Tools menu in the Administrator window, choose Track Message.
Type the name or browse for the server you want to connect to.
Specify a message, and then choose OK.
Choose From, and then select the name of the sender.
Choose Sent To and select the name of a recipient in the global address list, and then choose Add. Repeat this for all recipients.
Specify the appropriate options.
Choose Find Now.

Option Description

From Searches for messages sent from this mailbox. Only one mailbox can appear in this box. If the box is blank, it searches for all messages to the recipients.

Sent To Searches for messages sent to one or more mailboxes. More than one mailbox can be selected. Distribution lists can be recipients. If the box is blank, it searches for all messages from the sender.

Look back Determines how many daily logs are searched. If 0, it searches the current day's log only. Daily logs begin and end at midnight Coordinated Universal Time (UTC), so you may have to look back one log to get today's log in local time.

Start date The date of the first log to be searched. This is determined by the entry in the Look back box and cannot be edited.

Search on server Searches the log of the server selected for the message to be tracked. The sender's home server is the default.

Time The symbol represents the event type. Event types are described in "Tracking Log" later in this chapter. The time and date the message was sent as recorded by the information store on the sending server. It is displayed in local time.

Size Message size in bytes.

No. recp. The number of mailboxes to which the message was sent. A distribution list counts as one recipient.

Recipients The first mailbox in the recipients list. An ellipsis follows the names in messages that have more than one recipient. Choose Properties to see the entire recipients list.

Option	Description
From	Searches for messages sent from this mailbox. Only one mailbox can appear in this box. If the box is blank, it searches for all messages to the recipients.
Sent To	Searches for messages sent to one or more mailboxes. More than one mailbox can be selected. Distribution lists can be recipients. If the box is blank, it searches for all messages from the sender.
Look back	Determines how many daily logs are searched. If 0, it searches the current day's log only. Daily logs begin and end at midnight Coordinated Universal Time (UTC), so you may have to look back one log to get today's log in local time.
Start date	The date of the first log to be searched. This is determined by the entry in the Look back box and cannot be edited.
Search on server	Searches the log of the server selected for the message to be tracked. The sender's home server is the default.
Time	The symbol represents the event type. Event types are described in "Tracking Log" later in this chapter. The time and date the message was sent as recorded by the information store on the sending server. It is displayed in local time.
Size	Message size in bytes.
No. recp.	The number of mailboxes to which the message was sent. A distribution list counts as one recipient.
Recipients	The first mailbox in the recipients list. An ellipsis follows the names in messages that have more than one recipient. Choose Properties to see the entire recipients list.

Displaying Message Detail

The Message Properties dialog box for each event shows detailed information about the message at the time the event was generated. Use this information to select a message to track or to refine the search criteria. The Message Properties dialog box is different for each type of mail handling event.

From the Tools menu in the Administrator window, choose Track Message.
Type the name or browse for the server you want to connect to.
Specify a message, and then choose OK.

Option Description

Event type A description of the message tracking event.

From The distinguished name of the originator.

Time The time the mail message was sent or received is displayed in time local to the Administrator program.

Transferred to The Microsoft Exchange Server component that generated this event.

Size The message size, in bytes.

Priority The importance level assigned to the message by the originator.

Recipients List All addresses the message was sent to.

Option	Description
Event type	A description of the message tracking event.
From	The distinguished name of the originator.
Time	The time the mail message was sent or received is displayed in time local to the Administrator program.
Transferred to	The Microsoft Exchange Server component that generated this event.
Size	The message size, in bytes.
Priority	The importance level assigned to the message by the originator.
Recipients List	All addresses the message was sent to.

Using the Message Tracking Center

Once a message is found in a tracking log, its path through the network is traced through the logs of all servers that handled it. At each step, the process determines which service is expected to receive the message next and searches the logs on that server to find other events. The trace is complete when the message leaves the network or is delivered.

From the Tools menu in the Administrator window, choose Track Message.
Type the name or browse for the server you want to connect to, and then choose OK.
Specify a message, and then choose OK.

Option Description

Message ID The ID of the message selected for tracking. To change it, choose Advanced Search, which will track a different message.

Originator The mailbox that sent the message. To search for messages from a different originator, choose Search.

Start on server The message trace begins from the log of this server. An event was found in the server's tracking log indicating that the message was sent from or entered the network through this server.

Start date The date the search begins. According to the tracking log, this is the date the selected message was sent or entered the network. Daily tracking logs begin and end at midnight UTC.

Search Opens the Select Message to Track window so that you can search for a message.

Advanced Search Opens the Advanced Search dialog box so you can search for a message by its ID, search for a message sent from outside the network, or search for a message from a Microsoft Exchange Server component.

Track Activates message tracking for the selected message. When the search is complete, it displays the message tracking events found for the message in the Tracking History window.

Find Recipient in Tracking History Finds events involving a recipient that you specify and displays them in bold.

Properties Displays details of the event selected.

Option	Description
Message ID	The ID of the message selected for tracking. To change it, choose Advanced Search, which will track a different message.
Originator	The mailbox that sent the message. To search for messages from a different originator, choose Search.
Start on server	The message trace begins from the log of this server. An event was found in the server's tracking log indicating that the message was sent from or entered the network through this server.
Start date	The date the search begins. According to the tracking log, this is the date the selected message was sent or entered the network. Daily tracking logs begin and end at midnight UTC.
Search	Opens the Select Message to Track window so that you can search for a message.
Advanced Search	Opens the Advanced Search dialog box so you can search for a message by its ID, search for a message sent from outside the network, or search for a message from a Microsoft Exchange Server component.
Track	Activates message tracking for the selected message. When the search is complete, it displays the message tracking events found for the message in the Tracking History window.
Find Recipient in Tracking History	Finds events involving a recipient that you specify and displays them in bold.
Properties	Displays details of the event selected.

Searching for Microsoft Exchange Server Messages

Use message tracking to search for messages sent from components of Microsoft Exchange Server. It can be used for any function that involves sending messages, such as following a link monitor ping message from the system attendant or tracing a directory replication message beyond the site.

Note Each line in the display represents an event. Some messages appear in more than one event. It does not matter which you select because the message is tracked, not the event.

In the Message Tracking Center, choose Advanced Search.
Select Sent by Microsoft Exchange Server.
Choose Browse to select a server.
In the From box, select a Microsoft Exchange Server component.
Change the Look back date, if desired.
Choose Find Now to begin the search.

Option Description

Search on server Searches the log of the server selected for the message to be tracked. The server you are connected to is the default.

From Searches for messages sent from this Microsoft Exchange Server core component. You must type a component name in this box.

Look back Determines how many daily logs are searched. If 0, it searches the current day's log only. Daily logs begin and end at midnight UTC, so you may have to look back one log to get today's log in local time.

Start date Displays the date of the first log to be searched. This is determined by the entry in the Look Back box and cannot be edited.

Option	Description
Search on server	Searches the log of the server selected for the message to be tracked. The server you are connected to is the default.
From	Searches for messages sent from this Microsoft Exchange Server core component. You must type a component name in this box.
Look back	Determines how many daily logs are searched. If 0, it searches the current day's log only. Daily logs begin and end at midnight UTC, so you may have to look back one log to get today's log in local time.
Start date	Displays the date of the first log to be searched. This is determined by the entry in the Look Back box and cannot be edited.

Searching Outside of an Organization

You can search for a message when either the sender or recipients are not in a global address list. You can type the names of recipients and search for messages originating at gateways.

Note Each line represents an entry event for a message. Some messages can appear in more than one event. It does not matter which you select because the message is tracked, not the event.

In the Message Tracking Center, choose Advanced Search.
Select Transferred into this site.
In the Select Inbound Message to Track dialog box, type the e-mail address of the sender, or choose From to select one in the global address list.
Type the e-mail address of one or more recipients, or choose Sent To to select a recipient in the global address list. Use a semicolon to separate addresses.
In the Transferred from box, select the connector used to transport the message.
Change the Look back date and server, if appropriate.
Choose Find Now.

Option Description

From Searches for messages sent from this e-mail address. Only one address can appear in this box.
Type the address in the appropriate format for the gateway, for example,

SMTP:johnd@ferguson.com

You can also select from the global address list if the sender is in it but the recipient is not.

If the box is blank, it searches for all messages to the recipients.

Sent To Searches for messages sent to one or more e-mail addresses, including distribution lists.
Type the address in the appropriate format for the gateway. You can also select from the global address list if the recipient is in it but the sender is not.

If the box is blank, it searches for all messages from the sender.

Transferred from Lists all connectors in the site. Select from the list to search the log of the server where the connector is installed.

Look back Determines how many daily logs are searched. If 0, it searches the current day's log only. Daily logs begin and end at midnight UTC, so you may have to look back one log to get today's log in local time.

Start date Displays the date of the first log to be searched. This is determined by the entry in the Look back box and cannot be edited.

Search on server Searches the log of the server selected for the message to be tracked. The home server of the connector is the default.

Option	Description
From	Searches for messages sent from this e-mail address. Only one address can appear in this box. Type the address in the appropriate format for the gateway, for example, SMTP:johnd@ferguson.com You can also select from the global address list if the sender is in it but the recipient is not. If the box is blank, it searches for all messages to the recipients.
Sent To	Searches for messages sent to one or more e-mail addresses, including distribution lists. Type the address in the appropriate format for the gateway. You can also select from the global address list if the recipient is in it but the sender is not. If the box is blank, it searches for all messages from the sender.
Transferred from	Lists all connectors in the site. Select from the list to search the log of the server where the connector is installed.
Look back	Determines how many daily logs are searched. If 0, it searches the current day's log only. Daily logs begin and end at midnight UTC, so you may have to look back one log to get today's log in local time.
Start date	Displays the date of the first log to be searched. This is determined by the entry in the Look back box and cannot be edited.
Search on server	Searches the log of the server selected for the message to be tracked. The home server of the connector is the default.

Searching by Message ID

Use the Advanced Search button in the Message Tracking Center to find a message by its message ID.

Each message handled by Microsoft Exchange Server is assigned a message ID when it is created or enters the system from a gateway. Microsoft Exchange Server message IDs have a standard format, which includes the name of the originating server and the date and time the message was sent.

For example:

c=US;a=;p=Ferguson;l=NEWYORK0196012020010800000CDE

In the Message Tracking Center, choose Advanced Search.
Select By Message ID.
Type the message ID.
Choose Browse to select a server whose tracking log will be searched.
Change the Look back information, if appropriate.

Option Description

Message ID Type the message ID.

Look back Determines how many daily logs are searched. If 0, it searches the current day's log only. Daily logs begin and end at midnight UTC, so you may have to look back one log to get today's log in local time.

Start date Displays the date of the first log to be searched. This is determined by the entry in the Look back box and cannot be edited.

Search on server Searches the log of the server selected for the message to be tracked. The server you are connected to is the default.

Option	Description
Message ID	Type the message ID.
Look back	Determines how many daily logs are searched. If 0, it searches the current day's log only. Daily logs begin and end at midnight UTC, so you may have to look back one log to get today's log in local time.
Start date	Displays the date of the first log to be searched. This is determined by the entry in the Look back box and cannot be edited.
Search on server	Searches the log of the server selected for the message to be tracked. The server you are connected to is the default.

Interpreting a Message Track

Message tracking results are displayed as a hierarchy of the mail handling events found in the tracking logs. Each line represents one event. Each level in the hierarchy represents a branch in the path of a message, some of which are concurrent.

To get more information, you can:

Double-click a plus (+) or minus (-) button to expand or collapse the hierarchy.
Select an event and choose Properties to see event detail.
In the Message Tracking Center, choose Find Recipient in Tracking History to search for recipients specified in the message search. Events involving those recipients appear in bold.
In the Message Tracking Center, choose Search to return to the Select Message to Track dialog box, and then select another message to track.
In the Message Tracking Center, choose Advanced Search to return to the Advanced Search dialog box.

To follow up on a problem message, you can consult the message queues of affected components, raise the diagnostics logging level of a component or service, consult the Windows NT application event log, or change the configuration of a component.