Tracking Exchange Messages
Tracking a message through an Exchange system can be a powerful way of finding link malfunctions. Message tracking can assist support professionals in pinpointing the exact servers or links at fault. It can also be used to determine the quality of service of the Exchange system in areas such as performance, round trips between two servers, alternate route setup, and usage and reliability issues such as lost mail. Exchange provides tools to follow a message through its journey to verify transmissions at certain points of your organization. The following are some common uses for Exchange message tracking:
Analyzing a message's path through the system to test for proper routing
Determining the time delay for messages to pass through each connector in their path
Finding mail that was not appropriately delivered (also called "lost" mail)
All message-tracking information is stored by the system attendant on each server when tracking is enabled. The Exchange server component that actually writes the entries to the log file is the System Attendant.
The location of this log is drive letter \EXCHSRVR\SERVERNAME.LOG, where the servername is the name of your server.
By default, the message-tracking log files are shared, and everyone in the domain has read rights. You can manually change this access by going to the Security tab on the share's properties, removing the entry Everyone, and replacing it with All the Exchange Administrators group entry.
Tracking logs are kept for an entire day, and a new log is created the next day. Each daily log is named according to the date the log was created, using yyyymmdd.log format. You should remove log files periodically. However, be sure to leave log files on the server long enough that you can review files if a message flow problem occurs. Tracking must be enabled on each component through which the message flows occur.