Exchange Server 2010 : Performing Tracking and Logging Activities in an Organization (part 2) - Using Protocol Logging & Using Connectivity Logging

2. Using Protocol Logging

Protocol logging allows you to track Simple Mail Transfer Protocol (SMTP) communications that occur between servers as part of message routing and delivery. These communications could include both Exchange servers and non-Exchange servers. When non-Exchange servers send messages to an Exchange server, Exchange does the protocol logging of the communications.

You use protocol logging to troubleshoot problems with the Send and Receive connectors that are configured on Hub Transport and Edge Transport servers. However, you shouldn't use protocol logging to monitor Exchange activity. This is primarily because protocol logging can be processor intensive and resource intensive, which means that an Exchange server may have to perform a lot of work to log protocol activity. The overhead required for protocol logging depends on the level of messaging activity on the Exchange server.

2.1. Configuring Protocol Logging

By default, Hub Transport and Edge Transport servers do not perform protocol logging. As long as you know the identity of the connector with which you want to work, you can configure protocol logging for a specified connector. To retrieve a list of available Send and Receive connectors for a server, use the Get-SendConnector and Get-ReceiveConnector cmdlets, respectively. If you run either cmdlet without specifying additional parameters, a list of all available Send or Receive connectors is returned.

You enable or disable protocol logging on a per-connector basis. For Send connectors, you use the Set-SendConnector cmdlet to enable protocol logging. For Receive connectors, you use the Set-ReceiveConnector cmdlet to enable protocol logging. Both cmdlets have a –ProtocolLoggingLevel parameter that you can set to Verbose to enable protocol logging or to None to disable protocol logging. Here is an example:

Set-ReceiveConnector -Identity "Corpsvr127\Custom Receive Connector"
 -ProtocolLoggingLevel 'Verbose'

Although you enable protocol logging on a per-connector basis, you configure the other protocol logging parameters on a per-server basis for either all Send connectors or all Receive connectors using the Set-TransportServer cmdlet. As it does with message tracking logs, Exchange Server overwrites the oldest protocol logs automatically when tracking logs reach a maximum age or when the maximum log directory size is reached. If you decide to move the protocol log directories, you should create the directories you want to use and then set the following required permissions:

• Full Control For Administrator

• Full Control For Local System

• Read, Write, And Delete Subfolders And Files For Network Service

Because the parameters are similar to those for message tracking, I'll summarize the available parameters. Table 2 shows the Send connector parameters for configuring protocol logging. Table 3 shows the Receive connector parameters for configuring protocol logging.

Tip:

You can configure send and receive protocol log paths in the Exchange Management Console. Expand the Server Configuration node, and then select the Hub Transport node. In the main pane, double-click the server you want to configure to display the related Properties dialog box. On the Log Settings tab, the Protocol log panel shows the current send and receive protocol log paths. You can specify the log file path by entering the desired directory path for logging or accept the default setting.

2.2. Working with Protocol Logging Properties and Fields

When protocol logging is enabled, a Mailbox server or a transport server creates protocol logs daily. Mailbox and transport servers store logs in either the %ExchangeInstallPath%\TransportRoles\Logs\ProtocolLog\SmtpSend or %ExchangeInstallPath%\TransportRoles\Logs\ProtocolLog\SmtpReceive directory as appropriate for the type of connector being logged. For POP, IMAP, and Hotmail content aggregation, related logs are in the %ExchangeInstallPath%\TransportRoles\Logs\ProtocolLog\HTTPClient directory. Each log file is named by the date on which it was created, using the format SENDYYYYMMDD-N.log or RECVYYYYMMDD-N.log, such as SEND20100925-1.log for the first Send connector log created on September 25, 2010. Additional protocol logs are found in subdirectories of the %ExchangeInstallPath%\Logging directory. In the AddressBook Service subdirectory, you'll find logs for the Address Book service. In the RPC Client Access subdirectory, you'll find logs for Remote Procedure Calls for Client Access services.

The protocol log stores each SMTP protocol event on a single line. The information on a particular line is organized by comma-separated fields. Logs begin with a header that shows the following information:

• A statement that identifies the file as either a Send connector protocol log or a Receive connector protocol log

• The date on which the log file was created

• The version of the Exchange Server that created the file

• A comma-delimited list of fields contained in the body of the log file

Table 4 summarizes SMTP event fields and their meanings. Not all of the fields are tracked for all protocol events. You can view the protocol log files with any standard text editor, such as Notepad. You can also import the protocol log files into a spreadsheet or a database.

2.3. Enabling Protocol Logging for HTTP

Client Access servers have Web-based applications and virtual directories that use Microsoft Internet Information Services (IIS) to provide the related services. In IIS 7.0 or IIS 7.5, protocol logging for HTTP is a feature is available when HTTP Logging module is installed and logging is enabled. By default, this module is installed with IIS and enabled. The default configuration is to use one log file per Web site per day.

You can view and manage the logging settings by completing the following steps:

2.4. Working with HTTP Protocol Logs

On Client Access servers, HTTP protocol log files can help you detect and trace problems with HTTP, Outlook Web App, Exchange ActiveSync, and Outlook Anywhere. By default, Exchange Server writes protocol log files to a subdirectory of %SystemDrive%\inetpub\logs\LogFiles. You can use the logs to determine the following:

• Whether a client was able to connect to a specified server and, if not, what problem occurred

• Whether a client was able to send or receive protocol commands and, if not, what error occurred

• Whether a client was able to send or receive data

• How long it took to establish a connection

• How long it took to send or receive protocol commands

• How long it took to send or receive data

• Whether server errors are occurring and, if so, what types of errors are occurring

• Whether server errors are related to Windows or to the protocol itself

• Whether a user is connecting to the server using the proper logon information

Most protocol log files are written as ASCII text. This means you can view them in Notepad or another text editor. You can import these protocol log files into Office Excel 2007 in much the same way as you import tracking logs.

Log files, written as space-delimited or tab-delimited text, begin with a header that shows the following information:

• A statement that identifies the protocol or service used to create the file

• The protocol, service, or software version

• A date and timestamp

• A space-delimited or tab-delimited list of fields contained in the body of the log file

3. Using Connectivity Logging

Connectivity logging allows you to track the connection activity of outgoing message delivery queues. You use connectivity logging on transport servers to troubleshoot problems with messages reaching their designated destination Mailbox server or recipient.

3.1. Configuring Connectivity Logging

By default, Hub Transport and Edge Transport servers do not perform connectivity logging. You can enable or disable connectivity logging on a per-server basis by setting the –ConnectivityLogEnabled parameter of the Set-TransportServer cmdlet to $true or $false, as appropriate. The following example enables connectivity logging on MailServer16:

Set-TransportServer -Identity "MailServer16"
 -ConnectivityLogEnabled $false

Tip:

You can configure basic connectivity logging options in the Exchange Management Console. Expand the Server Configuration node and then select the Hub Transport node. In the main pane, double-click the server you want to configure to display the related Properties dialog box. On the Log Settings tab, select or clear the Enable Connectivity Logging check box. If you enable connectivity logging, you can specify the log file path and then click OK.

Each transport server in your organization can have different connectivity logging settings:

• Use the –ConnectivityLogPath parameter to move the log directory to a new location. The default location is %ExchangeInstallPath%\TransportRoles\Logs\Connectivity directory.

• Use the –ConnectivityLogMaxFileSize parameter to set the maximum log file size. The default maximum log file size is 10 MB.

• Use the –ConnectivityLogMaxDirectorySize parameter to set the maximum log directory size. The default maximum log directory size is 250 MB.

• Use the –ConnectivityLogMaxAge parameter to set the maximum log file age. The default maximum age is 30.00:00:00.

As it does with other logs, Exchange Server overwrites the oldest connectivity logs automatically when tracking logs reach a maximum age or when the maximum log directory size is reached. If you decide to move the protocol log directories, you should create the directories you want to use and set the following required permissions:

• Full Control For Administrator

• Full Control For Local System

• Read, Write, And Delete Subfolders And Files For Network Service

3.2. Working with Connectivity Log Properties and Fields

Exchange Server creates connectivity logs daily and stores them in the %ExchangeInstallPath%\TransportRoles\Logs\Connectivity directory. Each log file is named by the date on which it was created, using the format CONNECTLOGYYYYMMDD-N.log, such as CONNECTLOG20100325-1.log for the first connectivity log created on March 25, 2010.

The connectivity log stores outgoing queue connection events on a single line. The information on a particular line is organized by comma-separated fields. Logs begin with a header that shows the following information:

• A statement that identifies the file as a connectivity log

• The date on which the log file was created

• The version of Exchange Server that created the file

• A comma-delimited list of fields contained in the body of the log file

Table 5 summarizes connectivity logging fields and their meanings. Not all of the fields are tracked for all outgoing queue connection events. You can view the connectivity log files with any standard text editor, such as Notepad. You can also import the connectivity log files into a spreadsheet or a database, as discussed previously.