Understanding Message Tracking Log Data
The easiest way to begin to understand the data held in the tracking log is to take a copy of a log from a test server, load it into Excel, then examine the different events that occur as the Routing Engine processes a message from submission to final dispatch.
Of course, you can review log data from a production system, but typically these logs are large (more than 50MB), so picking a particular message and then tracking its progress is more difficult. Large logs slow tracking down, especially if the message was sent to a long DL or if you must track a message across a number of different servers within an organization.
Servers that host active Public Folders can generate heavy replication traffic, which is noted in the message tracking logs. You can identify replication messages by sender name, which is either the Exchange 2000 internal X.500 address for the Public Folder Replication Agent (e.g., EX:/O=Acme/OU=Central/CN=Configuration/CN=Servers/CN=Server1/CN=Microsoft Public MDB) or the SMTP address for the Public Folder Replication Agent (e.g., Server1-IS@acme.org). The message tracking logs store the name of the destination server (the replication partner) in the Recipient-Address field. The message tracking logs also store data for incoming messages, including nondelivery notifications and delivery and read receipts.
The Excel spreadsheet that Figure 6 shows contains the raw message tracking log data that the Message History dialog box in Figure 5 shows. The message originates from a MAPI client and goes to two external SMTP recipients. Therefore, the logical processing that the Routing Engine performs is straightforward. The engine accepts the message, checks the SMTP addresses, and routes the message onward to either an SMTP connector on the same server (if present) or an SMTP connector on the server that has the lowest possible routing cost. You can track the events in the figures as follows, noting that entries exist for each recipient address on the message:
event ID 1027: The client submits the message to the Store Driver.
event ID 1019: The Store Driver submits the message to Advanced Queuing.
event ID 1025: Advanced Queuing processes the message.
event ID 1024: The Categorizer receives and begins to process the message.
event ID 1020: The Routing Engine places the message on a destination queue
and prepares it for transfer off the server.
event ID 1031: The Routing Engine successfully
transfers the message and processing is completed.
In comparison, the sequence of events for a message delivered to a mailbox on the same server is as follows. The same events occur for deliveries to a mailbox in another storage group (SG).
event ID 1027: The client submits the message to the Store Driver.
event ID 1019: The Store Driver submits the message to Advanced Queuing.
event ID 1025: Advanced Queuing processes the message.
event ID 1024: The Categorizer receives and begins to process the message.
event ID 1023: The Routing Engine places the message on the local delivery queue.
event ID 1028: The Store delivers the message to the mailbox.
Prev. page
1
2
3
[4]
5
next page 
