Exchange Server 2003 Troubleshooting

If there is a problem with a system, it is important to know where to start looking for errors and to check the process. EXCHANGESERVER2003 provides a wealth of checking and logging options, but the logs are not always in one place. In this article, I'll explain how to find and use information that is easy to diagnose in your application and system logs.

Application log (the application log)

ExchangeServer writes the most important information for diagnostic issues to the application log, which you can access directly through the Windows Event Viewer. The application log contains information from Exchange, the Windows operating system, and other software, so it's a bit like finding a needle in the ocean to find the information you want.

Filtering application Logs

The easiest way to locate the information you need is to filter the application log:

1. Select the "Filter" command from the menu in Event Viewer, and the system displays the Properties menu for the application.

2. Select the appropriate option in the event source Drop-down list and click OK. This allows you to see the event log from the selected application. (Programming Entry Network)

If you try it yourself, you'll find that there are almost 100 different choices in the event source list, unfortunately, we don't have a filter to find Exchange-related events. Exchange itself is very complex, it has many separate parts, so there is no special event filter. Instead, there are 26 different filters that are directly related to ExchangeServer, plus a lot of filters and other related components (such as IIS).

The filters that are directly related to ExchangeServer are all started with msexchange, and they are usually the following:

· MSExchangeAL: All information about Exchange address list management tools

· MSExchangeIS: All information related to exchange information storage

Bitscn_net China Network Management Blog

· MSExchangeSA: Information related to Exchange system services

· Msexchangtranspport: Information related to message delivery and routing

· POP3SVC: Is not a msexchange filter, but Exchange uses it to record information related to post Office protocol.

Because there are 26 different Exchange filters, you can imagine how much data will be written to the application log. To prevent the Exchange server from being filled with logs, the logging level is disabled by default or is set to a minimal level. If you find that there is a problem with Exchange and need more detailed log information, you can temporarily configure Exchange to get more log records.

Feedom.net The earliest network management website in China

Adjust the logging level for Exchange

1. Open Exchange System Administration Tools

2. Navigate through the control tree to the Admin group-> your admin group-> server-> your server.

3. Click the right mouse button on your server and select Properties.

4. In the property interface, the diagnostic log label contains nearly half of the filter's settings associated with Exchange (the rest of the filter is controlled by the program itself).

5. Now you can set the level of any filter, just select the filter you want to set. Each filter is divided into a number of categories, such as the POP3SVC filter contains the "Connection", "Authentication" and "Client action" three categories, and each filter usually contains the "general" category.

6. Select the appropriate category, and then select the logging level you want, available options are "None", "min", "Medium" and "Max".

You can adjust the logging levels for multiple filters and categories as needed, but once you've got the information you need, remember to adjust them to the minimum level (or simply disable them) to prevent logging from filling up your Exchange server.

System log

Exchange works above the Windows operating system level, so if there is a problem with Windows itself, Exchange may also have an error. Therefore, the system log in Event Viewer also records some information that is useful to you. You won't find any filters directly related to exchange here, but you can find valuable information about the OS.

I can't describe the process of checking the Windows system through the system log because the process is too complex. What I can tell you is that there are some filters in the system log that are relevant to exchange, such as SMTPSVC filters that are directly related to SMTP, and the W3SVC filter contains IIS-related log information, and they all have some help for you.

Conclusion

The mechanism by which Exchange writes information to the event log is varied, and if your exchange has a problem, I recommend that you start by viewing and searching the event log for Exchange-related issues to find the problem. You can also get more information and solutions by entering the event ID in the Microsoft Knowledge Base.