Reader to Reader - 10 Dec 2001

Tracking DL Usage

[Editor's Note: Email your Exchange Server and Outlook solutions (400 words maximum) to R2R at xadletters@win2000mag .com. Please include your phone number. We edit submissions for style, grammar, and length. If we print your contribution, you'll get $100.]

Many of my users enjoy the convenience of distribution lists (DLs) in Exchange Server 5.5's Global Address List (GAL). However, after years of operation, the GAL is crammed with obsolete DLs.

I've considered several methods for tracking DL usage to locate obsolete DLs. One idea was to include a hidden public folder as a member of every DL, then write a Messaging API (MAPI)— based program to analyze messages in the public folder. Then, I realized that the information I need is already available in Exchange's tracking logs.

When you enable Exchange's message-tracking option, Exchange servers create tracking logs. These tab-delimited ASCII files hold information about message processing and routing. You can find information about these files in the Microsoft articles "XADM: Tracking Log Event Numbers" (http://support .microsoft.com/support/kb/articles/ q173/3/64.asp) and "XADM: Tracking Log Field Descriptions" (http://support .microsoft.com/support/kb/articles/ q173/2/80.asp).

Theoretically, you can use a text editor or spreadsheet program to view these files, but they're barely readable in those forms. Instead, I decided to write an ActiveX DLL in Microsoft Visual Basic (VB) to expose the tracking-log data. This way, I can write other programs that analyze the information. One of these programs records DL usage in a database and monitors the number of messages sent to each DL, as well as the date and time of the most recent message sent.

My DLL, which Listing 1 shows, holds two objects—TlogFile and TlogEntry. TlogFile has three methods: OpenFile, CloseFile, and Read Next, which returns a TlogEntry object that represents one tracking-log entry. TlogEntry has a read-only property for each tracking-log field. Three properties are relevant: EventNum, DateTime, and Recips. EventNum indicates a processing step on the Exchange server; DateTime is the date and time the event occurred; and Recips is a collection of X.400 distinguished names (DNs) of intended recipients.

The analysis program runs automatically in the early morning, processing the previous day's tracking logs for each Exchange server. The program looks for MAPI message-submission (MsgSubmit) and inbound SMTP-transfer (SMTPRptXferIn) events. For each of these events, the program updates the SentToCount and LastSentDate fields in the corresponding recipient's database.

During the 6 months that I've run the program, I've discovered hundreds of DLs that have never received a message. However, just because a DL hasn't directly received a message doesn't mean that you have sufficient justification to delete that DL. The DL could be a member of another DL, or its purpose could be to assign access permissions to public folders. For these reasons, I always check with the DL's owner before performing a deletion.

—Frederick Taverni
[email protected]

Corrections to this Article: