A 4 event would occur in the Exchange 5.5 logs only if the message originator was on Exchange 5.5. The issue I am dealing with is programmatically identifying which 1027 events are actual message submissions and which are MTA routing of mail from the 5.5 environment. In a pure 5.5 environment, we had specific events that were only used for message submission and delivery (4 and 9). It seems that in Exchange 2000 the delivery event (1027) can also be flagged as a message traverses the store in transit. I've seen conflicting definitions of event 1027 from Microsoft:
1027: A message was submitted to the store driver by the MTA. 1027: The information store driver has picked up a message from the information store. 1027: Submit to store driver: message goes from the Outlook 2000 outbox to the store driver. The definition varies between the kb, TechNet, msdn and the resource kit. My interpretation is that 1027 means the store driver handled a message. This does not necessarily mean the event in question was a delivery event. -Mike -----Original Message----- From: Coleman, Hunter [mailto:[EMAIL PROTECTED]] Sent: Wednesday, April 17, 2002 12:34 PM To: Exchange Discussions Subject: RE: performance monitoring Are the clients also throwing an event 4 on the same message IDs that are reporting the 1027s? Hunter -----Original Message----- From: IRELAND,MIKE (HP-Corvallis,ex1) [mailto:[EMAIL PROTECTED]] Sent: Wednesday, April 17, 2002 10:59 AM To: Exchange Discussions Subject: RE: performance monitoring It is reported in the E2K logs. See Q246959 for E2K tracking log event descriptions. -Mike -----Original Message----- From: Coleman, Hunter [mailto:[EMAIL PROTECTED]] Sent: Wednesday, April 17, 2002 9:37 AM To: Exchange Discussions Subject: RE: performance monitoring Is that 1027 reported in the 5.5 tracking log, or E2k log? I can't find it in my 5.5 logs and Q173364 doesn't mention it. Hunter -----Original Message----- From: IRELAND,MIKE (HP-Corvallis,ex1) [mailto:[EMAIL PROTECTED]] Sent: Wednesday, April 17, 2002 9:31 AM To: Exchange Discussions Subject: RE: performance monitoring Looking forward to it Chris! Brain teaser: How do you track message submission events (1027) in a mixed mode org where the E2K boxes are talking to 5.5 boxes via the MTA? As best I can tell a 1027 can be logged for both a message submission to the store by a client or the MTA. So, how does one tell if a 1027 event was for a real message submission or just the MTA doing it's thing? I imagine Chris' ace developers have this one licked. Anyone else out there working with tracking logs that has run up against this? -Mike -----Original Message----- From: Chris Scharff [mailto:[EMAIL PROTECTED]] Sent: Wednesday, April 17, 2002 7:49 AM To: Exchange Discussions Subject: RE: performance monitoring And Mike has significantly more hands on experience with parsing that data than I, although I'm doing my best to catch up.[1] [1] Should have something to run by you in May Mike. ;) > -----Original Message----- > From: IRELAND,MIKE (HP-Corvallis,ex1) [mailto:[EMAIL PROTECTED]] > Sent: Tuesday, April 16, 2002 11:00 PM > To: Exchange Discussions > Subject: RE: performance monitoring > > > Heather, > > All of this data (and more) is stored in the tracking logs. With a few > lines of <insert scripting language of choice>, you can parse the logs > and import them into a database for analysis. Once you get > comfortable with the logs and SQL, you can pull some very useful data > from them. Details on the tracking log format can be found in the > knowledge base. > > -Mike > > -----Original Message----- > From: Heather Bellson [mailto:[EMAIL PROTECTED]] > Sent: Tuesday, April 16, 2002 5:44 PM > To: Exchange Discussions > Subject: performance monitoring > > > > I'm trying to determine how many messages/day are delivered to local > recipients from local recipients, as compared to how many messages are > delivered from internet recipients to local recipients and vice versa. > I'm taking my first dive into performance monitoring and I'm a little > overwhelmed with how many different "counters" there are, and each > report different numbers for what appears to me to be the same > thing, with no apparent pattern. I never imagined there'd be > so much to choose from! > > Can any of you give me some guidance on the counters I should add to > performance monitor to get some kind of meaningful data? Or even a > good reference for performance monitoring in exchange? > > fyi, exchange 5.5 sp4, nt4 sp6a, single mail server site. > > Thanks for your time, > Heather > > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED]
