Exchange 2007 Message Tracking Logs and enters in subjects (generated by Journaling)
- Hello,
Is anybody knows any official definition Exchange Tracking Logs? (for now for Exchange Server 2007 more than SP1 R8)
:/.
I read http://technet.microsoft.com/en-us/library/bb124375.aspx and related pages and nowhere I did not found confirmation that field separator is CR/LF.
It contains only statement:
The message tracking log files are text files that contain data in the comma separated value (CSV) format.
I meet at customer with following case:
#Software: Microsoft Exchange Server
#Version: 8.0.0.0
#Log-type: Message Tracking Log
#Date: 2009-08-24T14:14:30.399Z
#Fields: date-time,client-ip,client-hostname,server-ip,server-hostname,source-context,connector-id,source,event-id,internal-message-id,message-id,recipient-address,recipient-status,total-bytes,recipient-count,related-recipient-address,reference,message-subject,sender-address,return-path,message-info
2009-08-24T14:40:59.513Z,,,,HUB12,Journaling,,AGENT,RECEIVE,45042261,< 3a673d47-985c-45ce-9dbd-0acdef703390@journal.report.generator >,Journaling@companyname.com,,15192,1,,45042260,"2km | 6:00
6km | 4:30
2km | 6:00",MicrosoftExchange329e71ec88ae4615bbc36ab6ce41109e@companyname.com,<>,
2009-08-24T14:40:59.513Z,,,,HUB12,,,ROUTING,REDIRECT,45042261,<3a673d47-985c-45ce-9dbd-0acdef703390@journal.report.generator >,Journaling@companyname.com,,15192,1,Journaling@companyname.com,,"2km | 6:00
6km | 4:30
2km | 6:00",MicrosoftExchange329e71ec88ae4615bbc36ab6ce41109e@companyname.com,<>,
2009-08-24T14:40:59.513Z,,,,HUB12,,,ROUTING,REDIRECT,45042261,<3a673d47-985c-45ce-9dbd-0acdef703390@journal.report.generator >,Journaling@companyname.com,,15192,1,EmailX-NEX@nex.INT.companyname.com,,"2km | 6:00
6km | 4:30
2km | 6:00",MicrosoftExchange329e71ec88ae4615bbc36ab6ce41109e@companyname.com,<>,
And our custom software for give message tracking logs for helpdesk failed L (it was based on SQL 2005, with SSIS, and we assume that CSV value has record end at CR/LF).
Is quite strange but it looks that standard Exchange engine for journaling has change that subject. Because line in tracking logs for original mail looks that:
2009-08-24T14:35:47.353Z,10.93.11.14,MBOX8.INT.companyname.com,10.2.20.57,HUB12,,,STOREDRIVER,RECEIVE,45040927,< D3FD82914B22E44184F1A88E83FA5D2B06BF712A@MBOX8.INT.companyname.com >,ola@customer.domain.com,,13346,1,,,2km | 6:00 6km | 4:30 2km | 6:00,SUser@companyname.com,SUser@companyname.com,04I:
And now I try to find reason why it is failed? Why there are adtional CR-LF visible in subject after processing by journaling agent, but not visible in original mail log line.
Regards,
Ziemek Borowski
http://ziembor.pl/
Answers
The issue only happened once? Yes, such situation shouldn’t happen, per my knowledge
James Luo
TechNet Subscriber Support (http://technet.microsoft.com/en-us/subscriptions/ms788697.aspx)
If you have any feedback on our support, please contact tngfb@microsoft.com- Marked As Answer byZiemek BorowskiMVPThursday, November 12, 2009 7:37 AM
All Replies
Per my test, there’s no CR/LF among the subjects. (Lab: Exchange 2007 SP2)
===============
#Software: Microsoft Exchange Server
#Version: 8.0.0.0
#Log-type: Message Tracking Log
#Date: 2009-11-09T02:49:39.729Z
#Fields: date-time,client-ip,client-hostname,server-ip,server-hostname,source-context,connector-id,source,event-id,internal-message-id,message-id,recipient-address,recipient-status,total-bytes,recipient-count,related-recipient-address,reference,message-subject,sender-address,return-path,message-info
2009-11-09T02:49:39.729Z,10.0.0.2,EX07.Contoso.com,10.0.0.2,EX07,,,STOREDRIVER,RECEIVE,3,<,renee@contoso.com,,6527,1,,,,MicrosoftExchange329e71ec88ae4615bbc36ab6ce41109e@contoso.com,:
2009-11-09T02:49:42.167Z,,,,EX07,Journaling,,AGENT,RECEIVE,4,<,james@contoso.com,,7584,1,,3,,MicrosoftExchange329e71ec88ae4615bbc36ab6ce41109e@contoso.com">77e9fcd0-fbfb-4e49-941b-b717b89350b5@journal.report.generator>,james@contoso.com,,7584,1,,3,,MicrosoftExchange329e71ec88ae4615bbc36ab6ce41109e@contoso.com,<>,
===============
Does the CR/LF only exist for all log traces that records the journaling messages?
Does the symptom happen permanently?
Does the issue happen to all hubs, or specific one?
Please use “Set-EventLogLevel” to increase the “MSExchange Messaging Policies\Journaling” category and reproduce the issue, and then check the application log on the exchange server for related event
James Luo
TechNet Subscriber Support (http://technet.microsoft.com/en-us/subscriptions/ms788697.aspx)
If you have any feedback on our support, please contact tngfb@microsoft.com- How's the issue currently?
James Luo
TechNet Subscriber Support (http://technet.microsoft.com/en-us/subscriptions/ms788697.aspx)
If you have any feedback on our support, please contact tngfb@microsoft.com - It not happen in typical journaling, I'm afraid. It happens once on system which process about 250k dailly mails (all journaled). Practicly I make workaround for our software: we addtionally validate date-time field, if not valid that line is copied to badrows table (to check and revalidate, also with parsing original logs and so on).
I intentionally ask for formal Message Tracking Log format for makre sure (not from any basic reading and kind of reverse engeenering but from official spec) that such situation should not happen.
http://ziembor.pl/ The issue only happened once? Yes, such situation shouldn’t happen, per my knowledge
James Luo
TechNet Subscriber Support (http://technet.microsoft.com/en-us/subscriptions/ms788697.aspx)
If you have any feedback on our support, please contact tngfb@microsoft.com- Marked As Answer byZiemek BorowskiMVPThursday, November 12, 2009 7:37 AM
- Yes, it happens once, and as you can see from logs few months ago.
http://ziembor.pl/
