Diagnostic Logging of Exchange Processes
Microsoft Exchange Server 2007 will reach end of support on April 11, 2017. To stay supported, you will need to upgrade. For more information, see Resources to help you upgrade your Office 2007 servers and clients.
Applies to: Exchange Server 2007, Exchange Server 2007 SP1
The process logging level for each Exchange process determines which events are written to the Application event log in the Microsoft Windows Server 2003 Event Viewer. The Event Viewer is a tool that you can use to help monitor hardware and software activities. You can change process logging levels to increase the volume and type of events that are reported, including those related to authentication, connections, and user actions. You can use these events to assist with server diagnostics and troubleshooting.
Exchange Server 2007 Service Pack 3 (SP3), the Manage Diagnostic Logging Properties wizard is added to the Exchange Management Console. In Exchange Server 2007 Service Pack 1 or an earlier version, you must use the Exchange Management Shell to change diagnostic logging levels.
When you use the Exchange Management Shell, the first step in modifying the process logging level of an Exchange process is to determine if the process is configurable and what its current logging level value is by using the Exchange Management Shell Get-EventLogLevel cmdlet.
After selecting the processes you are interested in, the next step is to set the logging levels for those processes. There are five logging levels of detail, which are described in the table below. When Exchange generates an event that is less than or equal to the configured logging level, the event is logged. Events range from significant events (such as application failures) to moderately important events (such as the receipt of messages across a gateway) to events that are relevant only to debugging activities.
The Manage Diagnostic Logging Properties wizard can be used in the Exchange Management Console in Exchange 2007 SP3 or later version. When you run the Manage Diagnostic Logging Properties wizard, use the wizard's user interface to select the process for which you want to change the logging level, and then select the logging level that you want to apply to the process. The Manage Diagnostic Logging Properties wizard can also be used to restore the default logging level for the processes that were changed after you finish troubleshooting the issue.
Typically, you log only critical events. However, when problems occur, increasing the process logging level can help to increase the number and detail of events that are captured by the event log, which you can then use for detailed diagnostics. After changing a logging level, logging begins automatically whenever you start Exchange. You can view the log entries in the Event Viewer.
Note
Process logging levels are configured separately for each process and on a per-Exchange server basis. If you want to change the logging level for a process on all Exchange servers in your organization, you must change the logging level on each server individually.
Logging levels for Exchange events
| Logging level | Description |
|---|---|
Lowest |
Only critical events, error events, and events with a logging level of zero are logged. Note This is the default level for all services on Exchange servers except MSExchange ADAccess\Topology and MSExchange ADAccess\Validation, which have a default level of Low. |
Low |
Events with a logging level of 1 or lower are logged. |
Medium |
Events with a logging level of 3 or lower are logged. |
Maximum |
Events with a logging level of 5 or lower are logged. |
Expert |
Events with a logging level of 7 or lower are logged. |
For More Information
For more information about configuring diagnostics logging, see How to Change Logging Levels for Exchange Processes.
For a complete list of Exchange processes that have configurable logging levels, see Processes with Configurable Event Logging Levels.
For more information about the Exchange Management Shell Get-EventLogLevel cmdlet, see Get-EventLogLevel and Operation Fails When An Asterisk is Used in ECIdParameter of the Get-EventLogLevel Cmdlet.
For more information about troubleshooting the Exchange System Attendant, see How to Increase Diagnostic Logging for the Exchange 2007 System Attendant When it Does Not Start and Exchange Services Do Not Start on a Computer that is Running Exchange 2007 After You Rename a Windows Server 2003 Domain.