You want to capture more information on the operation of the various Exchange protocols and components to aid in your diagnosis and troubleshooting efforts.
Launch the Exchange System Manager (Exchange System Manager.msc).
Choose the administrative group in which the server you wish to troubleshoot resides. Expand the Server node.
Right-click your selected server and choose Properties from the menu. Click the Diagnostics Logging tab.
In the left pane, you will see a listing of the various services and components that are running on that server. As you select different services, the right pane will update the specific categories or actions that the service provides logging for, and will list what level of logging is currently configured for each one.
Select a category and choose the radio button under Logging Level at which you wish that category to be logged: None, Minimum, Medium, or Maximum.
When you have finished setting new levels for each service and category desired, click OK to close the server properties dialog and activate your new logging settings. (Note that unlike Exchange 5.5, Exchanges 2000 and 2003 don't require that the services be restarted after changing the logging level.)
Each component listed in Table 4-2 has its own
registry key under HKLM\System\CurrentControlSet\Services\<servicename>\Diagnostics. Each category of the
component has a DWORD value that sets the logging level for that
particular component. Annoyingly, there's no real naming scheme for
the category values; one component might use "1 General" as the name
of the logging control value for general logging, while another
might use "9005 General." Some complex components, like the
information store, actually have subkeys under the Diagnostics key,
so the best way to write a script to set logging values is to spend
a couple of minutes locating the exact component value you want to
toggle.
Once that's done, you can set the value using a script like this:
' This code sets diagnostic logging to "maximum" on the Logons
' component of the information store
' ------ SCRIPT CONFIGURATION ------
strDiagKey = "HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Services\MSExchangeIS\Diagnostics\"
' ------ END CONFIGURATION ---------
Set objWSH = wscript.CreateObject("WScript.Shell")
objWSH.RegWrite strDiagKey & "90015 Logons", 5, "REG_DWORD"The actual value you attach to the category value can be any of the values described in the Discussion section.
Exchange provides granular level of control over diagnostic logging for the various components within the Exchange server. Events generated by diagnostic logging are stored in the application event log. The log settings themselves are helpfully gathered, for the most part, in one convenient place. That these controls are accessible only via the GUI is less convenient, especially when problems may involve multiple servers in your organization; having to adjust multiple sets of categories by hand is somewhat annoying and possibly prone to errors. Every category can have one of five logging values associated with it:
0No logging. Use this value to disable logging on a category. Critical errors and warnings will still be logged.
1Minimum. This value produces log entries for informational and warning events, but without much detail.
3Medium. This value adds more informational events and gives you more details for those events that would have been logged at minimum logging.
5Maximum. This value logs pretty much everything that happens in the category.
7Field engineering. This value, which isn't accessible through the ESM GUI, logs everything that happens in the category. Normally, you'll turn this on only when Microsoft support is working with you to troubleshoot a problem.
The following components are included in the default Exchange installation and are available for detailed diagnostic logging:
- IMAP4Svc
The IMAP4 protocol service.
- MSExchangeActiveSyncNotify
The ActiveSync service for PocketPC and SmartPhone users.
- MSExchangeADDXA
The Active Directory Synchronization service keeps Active Directory properly updated when running in a mixed Exchange 5.5/200x organization.
- MSExchangeAL
The Recipient Update Service.
- MSExchangeDSAccess
The DSAccess component is the central Active Directory proxy for all other Exchange services.
- MSExchangeIS
The Information Store controls the storage of mailboxes and public folders and is broken into three subservices: System, Public Folder, and Mailbox.
- MSExchangeMTA
The Message Transport Agent provides X.400 and Exchange 5.5-compatible RPC transports.
- MSExchangeMU
This service keeps the Exchange server information in Active Directory and the local IIS metabase synchronized.
- MSExchangeSA
The System Attendant performs important monitoring and housekeeping tasks.
- MSExchangeSRS
Active only in mixed-mode organization, the Site Replication service allows the replication of site and server information with Exchange 5.5 servers.
- MSExchangeTransport
The Transport service handles the default SMTP transport and maintains the routing tables.
- POP3Svc
The POP3 protocol service.
There are several additional services that make up the various connectors; these services and their corresponding categories will only be present on servers that have these connectors installed:
The Microsoft Exchange Calendar Connector (MSExchangeCalCon) replicates free/busy information with both Lotus Notes and Novell GroupWise.
The Microsoft Exchange Connector for Novell GroupWise (LME-GWISE) provides message flow between Exchange and GroupWise. There is also the Microsoft Exchange Router for Novell GroupWise (MSExchangeGWRtr).
The Microsoft Exchange Connector for Lotus Notes (LME-NOTES) provides message flow between Exchange and Notes.
Generally, you will want to leave all logging levels at None; running them at higher levels can quickly generate an abnormally large number of event log entries. Keep careful track of which services and categories are being logged in more detail and be sure to reset them to no extra logging as soon as you have gathered the necessary information.
Note that even with the services and categories that provide logging for protocols such as IMAP and SMTP, these options do not provide logging of the actual commands being issued and received on these connections. Troubleshooting an inbound SMTP connection, for example, may require an actual look at the SMTP commands the client connection is attempting to use. If this is the kind of logging you need, you need to enable protocol logging; see Recipe 8.23 for more details.
Table 4-3 provides a list of the default services in Exchange Server 2003 SP1 and the categories provided by each of them.
Table 4-3. Services and categories for diagnostic logging
Service | Category |
|---|---|
IMAP4Svc | ConnectionsAuthenticationClient ActionConfigurationContent EngineGeneral |
MSExchangeActiveSyncNotify | OMA Push CategorizerOMA Push Event Sink |
MSExchangeADDXA | ReplicationAccount managementAttribute mappingService ControllerLDAP Operations |
MSExchangeAL | LDAP OperationsService ControlAttribute MappingAccount managementAddress List Synchronization |
MSExchangeDSAccess | GeneralCacheTopologyConfigurationLDAP |
MSExchangeIS\System | RecoveryGeneralConnectionsTable CacheContent EnginePerformance MonitorMove MailboxDownloadVirus ScanningExchange VSS WriterExchange Backup RestoreExchange Client Monitoring |
MSExchangeIS\Public Folder | Transport GeneralGeneralReplication AD UpdatesReplication Incoming MessagesReplication Outgoing MessagesNon-delivery ReportsTransport SendingTransport DeliveringMTA ConnectionsLogonsAccess ControlSend On Behalf OfSend AsRulesStorage LimitsReplication Site FoldersReplication ExpiryReplication ConflictsReplication BackfillBackground CleanupReplication ErrorsIS/AD SynchronizationViewsReplication GeneralDownloadLocal Replication |
MSExchangeIS\Mailbox | Transport GeneralGeneralTransport SendingTransport DeliveringTransfer Into GatewayTransfer Out Of GatewayMTA ConnectionsMTA ConnectionsLogonsAccess ControlSend On Behalf OfSend AsRulesStorage LimitsBackground CleanupReplication ErrorsIS/AD SynchronizationViewsDownloadLocal Replication |
MSExchangeMTA | X.400 ServiceResourceSecurityInterfaceField EngineeringMTA AdministrationConfigurationDirectory AccessOperating SystemInternal ProcessingInteroperabilityAPDU |
MSExchangeMU | General |
MSExchangeSA | Mailbox ManagementNSPI ProxyRFR InterfaceOAL GeneratorProxy GenerationRPC CallsRPC-HTTP Management |
MSExchangeSRS | Knowledge Consistency CheckerSecurityExDS InterfaceReplicationGarbage CollectionInternal ConfigurationDirectory AccessInternal ProcessingLDAP InterfaceInitialization/TerminationService ControlField EngineeringSite Consistency Checker |
MSExchangeTransport | Routing Engine/ServiceCategorizerConnection ManagerQueuing EngineExchange Store DriverSMTP ProtocolNTFS Store DriverNDRAuthentication |
POP3Svc | ConnectionsAuthenticationClient ActionConfigurationContent EngineGeneral |
Recipe 8.23 for using protocol logging, MS KB 821912 (How to Collect Diagnostic Data to Help Troubleshoot Information Store Issues), MS KB 555232 (Exchange server diagnostic logging levels), and MS KB 295307 (How to Enable and Increase Logging for Microsoft Exchange Connectivity Controller Connectors)
Get Exchange Server Cookbook now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
