What a Tracking Log Tells You

To better understand the data in message tracking logs, let's go through the entries for the message tracked in Screen 4, page 3. Every message has a unique identifier (e.g., the Message ID field shown in Screen 4). NT stores tracking logs in tracking.log, a subdirectory of EXCHSRVR. You can identify the relevant tracking log from the date coded into the Message ID (980304 or March 4, 1998, in this instance). To locate the entries examined here, I loaded the tracking log into WordPad and searched for the string 980304111409Z. (For clarity, I have removed superfluous information.)

C=IE;A=eirmail400;P=digital;L=DBO-EXCHANGE-  980304111409Z-23655     4     1998.3.4 11:14:10/O=DIGITAL EQUIPMENT CORPORATION/OU=DUBLIN/  CN=CONFIGURATION/CN=SERVERS/CN=DBO-EXCHANGEIST/CN=  MICROSOFT PRIVATE MDB/o=DIGITAL EQUIPMENT CORPORATION/ou=DUBLIN/cn=  RECIPIENTS/cn=TONYR     0     2302     0  0     1/o=DIGITAL EQUIPMENT CORPORATION/ou=DUBLIN/cn=  RECIPIENTS/cn=ExchangeIST

Event 4: (The event number appears in the second line of the entry): Exchange sends the message from the Private Information Store (/CN=MICROSOFT PRIVATE MBD) on behalf of the mailbox with the alias TonyR to the Exchange IST recipient. In this case, Exchange IST is the alias for a distribution list. Note that the log always lists complete distinguished names from the directory. Some confusion can exist, because a distinguished name might not be similar to the display name used in the Message Tracking Center. In this instance, the alias is Exchange IST, and the display name is European Messaging Team.

C=IE;A=eirmail400;P=digital;L=DBO-EXCHANGE-  980304111409Z-23655     7     1998.3.4 11:14:10  /O=DIGITAL EQUIPMENT CORPORATION/OU=DUBLIN/CN=  CONFIGURATION/CN=SERVERS/CN=PLATINUM/CN=MICROSOFT  MTA

Event 7: The MTA on this server routes all distribution lists that the MTA on another server (PLATINUM, shown as /CN=PLATINUM) will expand. A more common practice is to expand distribution lists locally, but system designs often feature dedicated servers when organizations depend on very large or nested distribution lists.

C=IE;A=eirmail400;P=digital;L=DBO-EXCHANGE-  980304111409Z-23655     0     1998.3.4 11:14:11     /O=DIGITAL EQUIPMENT CORPORATION/OU=DUBLIN/CN=  CONFIGURATION/CN=SERVERS/CN=PLATINUM/CN=MICROSOFT  MTA          /o=DIGITAL EQUIPMENT CORPORATION/  ou=DUBLIN/cn=RECIPIENTS/cn=TONYR     02302     0  0     27/o=DIGITAL EQUIPMENT CORPORATION/ou=DUBLIN/cn=  RECIPIENTS/cn=TYNAN/o=DIGITAL EQUIPMENT CORPORATION/ou=DUBLIN/cn=  RECIPIENTS/cn=AUBREYM/o=DIGITAL EQUIPMENT CORPORATION/ou=DUBLIN/cn=  RECIPIENTS/cn=D'HOSE/o=DIGITAL EQUIPMENT CORPORATION/ou=DUBLIN/cn=  RECIPIENTS/cn=PAULC/o=DIGITAL EQUIPMENT CORPORATION/ou=DUBLIN/cn=  RECIPIENTS/cn=IANB

Event 0: The MTA on the PLATINUM server expands the list, and the server responds with the set of recipients. In this case, the list contains 27 recipients (the extract doesn't show all of them), and the expansion server responded in approximately 1 second. The expansion server is in the same site, so servers communicate via RPCs over a LAN. Exchange 5.5 expands distribution lists much faster than previous versions do.

C=IE;A=eirmail400;P=digital;L=DBO-EXCHANGE-  980304111409Z-23655     28     1998.3.4 11:14:12  /o=DIGITAL EQUIPMENT CORPORATION/ou=DUBLIN/cn=  RECIPIENTS/cn=TONYR     0     2302     0  0     1/O=DIGITAL EQUIPMENT CORPORATION/OU=DUBLIN/CN=  EXTERNAL PEOPLE/CN=DARAGHM

Event 28: One of the recipients (alias = DaraghM) has an Inbox Assistant rule set to autoforward any new messages to another address. The Information Store detects the rule and redirects the message.

C=IE;A=eirmail400;P=digital;L=DBO-EXCHANGE-  980304111409Z-23655     9     1998.3.4 11:14:14/O=DIGITAL EQUIPMENT CORPORATION/OU=DUBLIN/  CN=CONFIGURATION/CN=SERVERS/CN=DBO-EXCHANGEIST/  CN=MICROSOFT PRIVATE MDB     /o=DIGITAL  EQUIPMENT CORPORATION/ou=DUBLIN/cn=RECIPIENTS/cn=  TONYR     0     2302     0     0          1/o=DIGITAL EQUIPMENT CORPORATION/ou=DUBLIN/cn=  RECIPIENTS/cn=DARAGHM

Event 9: Redirection via an Inbox Assistant rule does not prevent a message from being delivered to the recipient's mailbox; therefore, the Information Store delivers a copy of the message.

C=IE;A=eirmail400;P=digital;L=DBO-EXCHANGE-  980304111409Z-23655     7     1998.3.4 11:14:15/O=DIGITAL EQUIPMENT CORPORATION/OU=DUBLIN/  CN=CONFIGURATION/CN=CONNECTIONS/CN=INTERNET MAIL  SERVICE (DBO-EXCHANGEIST)          /o=DIGITAL  EQUIPMENT CORPORATION/ou=DUBLIN/cn=RECIPIENTS/  cn=TONYR     0     2302     0       0     1/o=DIGITAL EQUIPMENT CORPORATION/ou=DUBLIN/cn=  RECIPIENTS/cn=DARAGHM

Event 7: The rule set on the DaraghM mailbox forwards messages out of the Exchange organization. The MTA delivers a copy of the message to a connector (i.e., the Internet Mail Service­IMS).

C=IE;A=eirmail400;P=digital;L=DBO-EXCHANGE-  980304111409Z-23655     1010     1998.3.4 11:14:16  /O=DIGITAL EQUIPMENT CORPORATION/OU=DUBLIN/CN=CONFIGURATION/CN=CONNECTIONS/CN=INTERNET MAILSERVICE (DBO-EXCHANGEIST) [FXCJ98NV]

Event 1010: The IMS accepts the message and places it on its outbound queue.

C=IE;A=eirmail400;P=digital;L=DBO-EXCHANGE-  980304111409Z-23655     1011     1998.3.4 11:14:17  /O=DIGITAL EQUIPMENT CORPORATION/OU=DUBLIN/CN=  CONFIGURATION/CN=CONNECTIONS/CN=INTERNET MAIL  SERVICE (DBO-EXCHANGEIST)     ml.com   [FXCJ98NV]

Event 1011: The IMS successfully sends the message to the specified SMTP address (which doesn't appear here).

C=IE;A=eirmail400;P=digital;L=DBO-EXCHANGE-  980304111409Z-23655     9     1998.3.4 11:14:27  /O=DIGITAL EQUIPMENT CORPORATION/OU=DUBLIN/CN=  CONFIGURATION/CN=SERVERS/CN=DBO-EXCHANGEIST/CN=  MICROSOFT PRIVATE MDB  /o=DIGITAL EQUIPMENT  CORPORATION/ou=DUBLIN/cn=RECIPIENTS/cn=TONYR  2302     0     0     26/o=DIGITAL EQUIPMENT CORPORATION/ou=DUBLIN/cn=  RECIPIENTS/cn=TYNAN/o=DIGITAL EQUIPMENT CORPORATION/ou=DUBLIN/cn=  RECIPIENTS/cn=AUBREYM/o=DIGITAL EQUIPMENT CORPORATION/ou=DUBLIN/cn=  RECIPIENTS/cn=D'HOSE/o=DIGITAL EQUIPMENT CORPORATION/ou=DUBLIN/cn=  RECIPIENTS/cn=PAULC/o=DIGITAL EQUIPMENT CORPORATION/ou=DUBLIN/cn=  RECIPIENTS/cn=IANB

Event 9: The Information Store delivers copies of the message to all the other local recipients.