Using Diagnostics Logging

[Previous] [Next]

All Exchange 2000 Server services log certain critical events to the Windows 2000 application log. For some services, however, you can configure additional levels of diagnostics logging. Diagnostics logging is one of the most useful tools for troubleshooting problems in Exchange 2000 Server.

You can modify the levels of diagnostics logging for all services on a particular Exchange server by using the Diagnostics Logging tab of the server's property sheet in the Exchange System snap-in, as shown in Figure 23-2. On the left side of this tab, you'll find a hierarchical view of all of the services on the server for which you can enable advanced diagnostics logging. On the right side, you'll find a list of categories that can be logged for the selected service.

REAL WORLD   Size of the Event View Application Log

Diagnostics logging of Exchange 2000 Server components generates many entries in the Event Viewer application log, especially if you have the diagnostics logging level set to Maximum. You should use diagnostics logging only when you are troubleshooting potential problems in specific components, and you should disable it when you are finished. By default, the application log file is set to a maximum size of 512 KB. We generally recommend setting this size to at least 1 MB for general use and even larger when using diagnostics logging. By default, each log file overwrites events older than seven days.

You can configure the default settings for size and overwriting by changing the Maximum Log Size and Event Log Wrapping options on the property sheet for the log. To see this property sheet, in Event Viewer, right-click the log in question and click Properties. The options are in the Log Size area of the General tab. The Maximum Log Size option can be adjusted in 64-KB increments.

You can choose from among three Event Log Wrapping options. They are Overwrite Events As Needed, Overwrite Events Older Than X Days, and Do Not Overwrite Events. (You must clear the log manually with the last option.) Make sure that you have set the wrapping option correctly for what you are trying to accomplish. For example, if you have it set to Overwrite Events As Needed, you could lose critical information that might have helped you solve the problem you had when you turned diagnostics on in the first place.

Figure 23-2. Viewing diagnostics logging categories.

All of the major services are represented on this property sheet, including the following:

• MSExchangeCCMC (Microsoft Exchange cc:Mail Connector) Use diagnostics logging on this service to troubleshoot problems with message delivery between Exchange 2000 Server and a cc:Mail post office.
• MSExchangeDX (Microsoft Exchange Directory Synchronization Agent) Use diagnostics logging on this service to troubleshoot problems with directory synchronization of foreign mail systems.
• MSExchangeIS (Microsoft Exchange Information Store service) You do not actually enable logging for the Information Store service as a whole. The MSExchangeIS item expands, allowing you to enable diagnostics logging individually for the public folder store and the mailbox store and for the various Internet protocols, as shown in Figure 23-3. Use diagnostics logging on this service to monitor background tasks that occur in Exchange, such as information store maintenance.



Figure 23-3. Enabling diagnostics logging for components of the information store.

• MSExchangeMSMI (Microsoft Exchange Microsoft Mail Connector) The acronym MSMI stands for Microsoft Mail Interchange. Use diagnostics logging on this service to troubleshoot problems with message delivery between Exchange 2000 Server and Microsoft Mail post offices.
• MSExchangeMTA (Microsoft Exchange Message Transfer Agent) Use diagnostics logging on this service to troubleshoot problems with message delivery and gateway connectivity.

You can enable four distinct levels of logging. All events that occur in Exchange 2000 Server are given an event level of 0, 1, 3, or 5. The logging level you set will determine which levels of events are logged.

Those levels are:

• None Only events with a logging level of 0 are logged. These events include application and system failures.
• Minimum All events with a logging level of 1 or lower are logged.
• Medium All events with a logging level of 3 or lower are logged.
• Maximum All events with a logging level of 5 or lower are logged. All events concerning a particular service are logged.

REAL WORLD   Using High Levels of Diagnostics Logging

Although diagnostics logging can be a very useful tool in some circumstances, at other times it can be more of a hindrance than a help. Enabling high levels of diagnostics logging, such as Medium or Maximum, can fill up your event log quickly, often hiding important level 0 events in a flood of trivial events. In addition, many events are logged that may seem like errors but actually are not. These events include the routine errors and timeouts that occur in normal Exchange 2000 Server operation.

Finally, many events will be logged that are really not documented anywhere in the product literature. Exchange developers often use these undocumented events to perform diagnostics.

Our recommendation is to leave diagnostics logging set to None for general purposes. If you need to troubleshoot malfunctions of particular services, try setting the diagnostics logging level to Low or Medium for brief periods.