In the Know: Message Tracking

Tracking down messages is part of every Exchange Server administrator's job. With the advent of the Sarbanes-Oxley (SOX) Act, the ability to find lost messages has taken on even more importance. Exchange Server offers message-tracking capabilities, but to get the most out of them, you need to know how they work.

How Exchange Uses Tracking Logs
Exchange uses tracking-log data to follow the path of messages within an Exchange organization. You can follow this process via the Message Tracking Center, which is now available through the Exchange System Manager (ESM) console's Tools menu. Exchange records every step in a message's path—from submission through the Exchange routing engine to final delivery to an external gateway or local mailbox—as events in the log. Different events record each processing step—for example, event 1027 indicates that a client has submitted a message to the Information Store—and each message has a unique message identifier that lets you select all the recorded events for a specific message. (Events for a message aren't grouped together in the log because Exchange writes events as messages pass through the different components of the routing and delivery systems. Thus, the events for any message can be interwoven with events relating to other messages.) The Microsoft article "Tracking Log Event Numbers for Exchange Server 2003" (http://support.microsoft.com/?kbid=822930) provides a list of the events that Exchange logs as messages pass through the routing system. . . .