Exchange 2010 Message Tracking Event-IDs

Aus dem Microsoft Artikel ein Auszug zu den einzelnen Event IDs die im Messagetracking Log auftauchen können.

Deliver ist wohl die wichtigste ID, wenn’s mal wieder heißt: „…ich habe eine Mail nicht bekommen..“ 🙂

Event name Description
BADMAIL A message was submitted by the Pickup directory or the Replay directory that cannot be delivered or returned.
DELIVER A message was delivered to a mailbox.
DEFER Message delivery was delayed.
DSN A delivery status notification (DSN) was generated.
DUPLICATEDELIVER A duplicate message was delivered to the recipient. Duplication may occur if a recipient is a member of two distribution groups. Duplicate messages are detected and removed by the information store.
EXPAND A distribution group was expanded.
FAIL Message delivery failed.
POISONMESSAGE A message is put in the poison message queue or removed from the poison message queue.
RECEIVE A message was received and committed to the database. The RECEIVE event can be SMTP receive (Source: SMTP) or mail submitted by STOREDRIVER (Source: STOREDRIVER).SMTP RECEIVE can be from any source that submits a message by using SMTP. For example, it can be a Hub Transport server role, an Edge Transport server role, a third-party message transfer agent (MTA), or a POP/IMAP client.STOREDRIVER RECEIVE is logged by the EdgeTransport.exe process, and is the event that corresponds to a STOREDRIVER SUBMIT event. STOREDRIVER SUBMIT is logged by the Mail Submission process. These events can be on the same server if both server roles are installed locally, or they can be on different servers.

EdgeTransport.exe and MSExchangeTransport.exe are the executable files that are used by the Microsoft Exchange Transport service. This service runs on every Hub Transport server or Edge Transport server.
REDIRECT A message was redirected to an alternative recipient after an Active Directory directory service lookup.
RESOLVE A message’s recipients were resolved to a different e-mail address after an Active Directory lookup.
SEND A message was sent by Simple Mail Transfer Protocol (SMTP) to a different server.
SUBMIT A SUBMIT event is logged by the Mail Submission service on an Exchange 2007 computer that is running the Mailbox server role. The SUBMIT event is logged when the service has successfully notified a Hub Transport server that a message is awaiting submission in the mailbox store.The SourceContext property provides the Messaging Database (MDB) GUID, Mailbox GUID, Event sequence number, Message class, Creation time stamp of the client submission to store, and Client type. The Client type can be User (Outlook direct MAPI), RPCHTTP (Outlook Anywhere), Outlook Web Access, Exchange Web Services (EWS), Exchange ActiveSync, Assistants, or Transport. The message tracking logs that are generated by the Mailbox server role contain only SUBMIT events.
TRANSFER Recipients were moved to a forked message because of content conversion, message recipient limits, or agents.