Using Diagnostics Logging | Microsoft Exchange Server 2003 Administrators Companion (Pro-Administrators Companion)

All Exchange Server 2003 services log certain critical events to the Windows Server 2003 application log. For some services, however, you can configure additional levels of diagnostics logging. Diagnostics logging is one of the most useful tools for troubleshooting problems in Exchange Server 2003.

You can modify the levels of diagnostics logging for all services on a particular Exchange server by using the Diagnostics Logging tab of the server’s property sheet in the Exchange System snap-in, as shown in Figure 26-2. On the left side of this tab, you’ll find a hierarchical view of all of the services on the server for which you can enable advanced diagnostics logging. On the right side, you’ll find a list of categories that can be logged for the selected service.

click to expand
Figure 26-2: Viewing diagnostics logging categories.

Real World—Size of the Event Viewer Application Log

Diagnostics logging of Exchange Server 2003 components generates many entries in the Event Viewer application log, especially if you have the diagnostics logging level set to Maximum. You should use diagnostics logging only when you are troubleshooting potential problems in specific components, and you should disable it when you are finished. By default, the application log file is set to a maximum size of 512 KB. We generally recommend setting this size to at least 1 MB for general use and even larger when using diagnostics logging. By default, each log file overwrites events older than seven days.

You can configure the default settings for size and overwriting by changing the Maximum Log Size and Event Log Wrapping options on the property sheet for the log. To see this property sheet, in Event Viewer, right-click the log in question and click Properties. The options are in the Log Size area of the General tab. The Maximum Log Size option can be adjusted in 64-KB increments.

You can choose from among three Event Log Wrapping options. They are Overwrite Events As Needed, Overwrite Events Older Than X Days, and Do Not Overwrite Events. (If you select the last option you must clear the log manually.) Make sure that you have set the wrapping option correctly for what you are trying to accomplish. For example, if you have it set to Overwrite Events As Needed, you could lose critical information that might have helped you solve the problem you had when you turned diagnostics on in the first place.

All the major services are represented on this property sheet, including the following:

IMAP4Svc Provides Internet Message Access Protocol (IMAP4) services to clients. If this service is stopped, clients are unable to connect to this computer using the IMAP4 protocol.
MSExchangeActiveSyncNotify Use diagnostics logging on this service to troubleshoot problems with the synchronization between wireless clients and Exchange Server using ActiveSync.
MSExchangeADDXA (Microsoft Exchange Active Directory Directory Synchronization Agent) Use diagnostics logging on this service to troubleshoot problems with directory synchronization with Active Directory.
MSExchangeAL (Microsoft Exchange Address List) Use diagnostics logging on this service to troubleshoot problems with creation and synchronization of address lists.
MSExchangeDSAccess (Microsoft Exchange Directory Services Access) Use diagnostics logging on this service to troubleshoot problems with Active Directory access and interaction.
MSExchangeIS (Microsoft Exchange Information Store Service) You do not actually enable logging for the Information Store service as a whole. The MSExchangeIS item expands, allowing you to enable diagnostics logging individually for the public folder store and the mailbox store and for the various Internet protocols, as shown in Figure 26-3. Use diagnostics logging on this service to monitor background tasks that occur in Exchange, such as information store maintenance.

Figure 26-3: Enabling diagnostics logging for components of the information store.
MSExchangeMTA (Microsoft Exchange Message Transfer Agent) Use diagnostics logging on this service to troubleshoot problems with message delivery and gateway connectivity.
MSExchangeSA (Microsoft Exchange System Attendant) Provides monitoring, maintenance, and Active Directory lookup services, for example, monitoring of services and connectors, defragmenting the Exchange store, and forwarding Active Directory lookups to a Global Catalog server. If this service is stopped, monitoring, maintenance, and lookup services are unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
POP3Svc Provides Post Office Protocol version 3 (POP3) Services to clients. If this service is stopped, clients are unable to connect to this computer using the POP3 protocol.

You can enable four distinct levels of logging. All events that occur in Exchange Server 2003 are given an event level of 0, 1, 3, or 5. The logging level you set will determine which levels of events are logged. Those levels are:

None Only events with a logging level of 0 are logged. These events include application and system failures.
Minimum All events with a logging level of 1 or lower are logged.
Medium All events with a logging level of 3 or lower are logged.
Maximum All events with a logging level of 5 or lower are logged. All events concerning a particular service are logged.

Real World—Using High Levels of Diagnostics Logging

Although diagnostics logging can be a very useful tool in some circumstances, at other times it can be more of a hindrance than a help. Enabling high levels of diagnostics logging, such as Medium or Maximum, can fill up your event log quickly, often hiding important level 0 events in a flood of trivial events. In addition, many events are logged that might seem like errors but actually are not. These events include the routine errors and timeouts that occur in normal Exchange Server 2003 operation.

Finally, many events will be logged that are really not documented anywhere in the product literature. Exchange developers often use these undocumented events to perform diagnostics.

Our recommendation is to leave diagnostics logging set to None for general purposes. If you need to troubleshoot malfunctions of particular services, try setting the diagnostics logging level to Low or Medium for brief periods.