3.5 Event Viewer

---

Most Windows services and layered products record errors and events in log files kept on the server. There are several separate log files, including logs for applications, security, system, directory service, and file replication service. Like other Windows products, all Exchange services record informational, warning, and error events in the server's logs-primarily in the Application Log.

Windows Server includes an MMC Event Viewer console for viewing the errors and events recorded in the log files (Figure 3.9). The Event Viewer should be the first tool used to look for problems with any Exchange component.

Figure 3.9: Event Viewer window

The Exchange administrator controls the type and quantity of events recorded in the log files. The diagnostic logging level that is defined for each Exchange component determines which types of events are written to the event log. Under most circumstances, minimum or medium log level is adequate. This still allows for error events and critical events to be written to the log file. The log files should be examined regularly. Informational or warning messages that

appear in the log may be a precursor to an impending problem. A daily review of the log files can help to avoid potential problems. When a problem does occur, the log files should be the first place to look for clues. The Event Viewer allows you to filter the event list based on the event ID or source to facilitate monitoring and finding specific events. When investigating a problem, the diagnostic log level can be increased for the service that is being investigated.

These log files require disk space, and the system administrator can specify parameters for each of the log files. These parameters include the maximum size for the log file, the length of time that entries will be saved, and what to do when the log file reaches its maximum size. When the log file becomes full, the options are either to automatically overwrite existing events or to manually clear the entries.

You can launch the Event Viewer from the Windows Start menu by selecting All Programs →Administrative Tools →Event Viewer.

---