locked
change SMTP log interval RRS feed

  • Question

  • Hi all,

    I would like to know if it is possible to change the logging interval for the Exchange SMTP logfile to something other than 5 minutes (which is the default)?

    The reason is that I sometimes need to look at this file frequently for debugging purposes, and it isn't nice having to wait five minutes everytime, to see *if* the changes you just made did help anything..

    So: does anyone know how to change the SMTP logging interval?

     

    Thanks, Dennis

    Thursday, April 14, 2011 1:27 PM

Answers

  • Hi Dennis,

    You need to set the SmtpSendLogFlushInterval and SmtpRecvLogFlushInterval values in EdgeTransport.exe.config and restart the Microsoft Exchage Transport service on every one of your Hub Transport servers in your lab/dev environment. You are correct, the default in 5 minutes, though Im sure 2010 RTM did not do this - but 2010 SP1 is doing it again. Not sure if the previous keys (which are both to have timespans as values) work in 2007.

    For example:

        <add key="SmtpSendLogFlushInterval" value="0:00:30" />

    Yours,

    Brian Reid, Microsoft Certified Master | Exchange 2010, MCM Transport Instructor


    Brian Reid C7 Solutions Ltd (www.c7solutions.com)
    Tuesday, October 4, 2011 6:10 AM

All replies

  • Hi

    What version of Exchange are you using?

    Sukh

    Thursday, April 14, 2011 2:08 PM
  • Hi,

    We are using mostly 2007 and 2010 (and some of our customers still have 2003). Can I change the logging interval with *any* version of Exchange at all?

    Thursday, April 14, 2011 2:58 PM
  • Hi

    Just to confirm, are you referring to IIS SMTP logging?

    Sukh

     

    Thursday, April 14, 2011 3:06 PM
  • Hi

    SMTP logging is pretty much real time, as and when transactions occur they are logged.

    Sukh

    Thursday, April 14, 2011 3:10 PM
  • I don't know - I mean those logfiles that can be found in the folder  "%SYSTEMROOT%\system32\LogFiles\SMTPSVC1" on Exchange 2003,
    with Exchange 2010 these log files are stored at the following location: "C:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs\ProtocolLog"

    I think these are Exchange logs, not IIS logs?

     

    Thursday, April 14, 2011 3:25 PM
  • Hi

    Yes they are.  And like I said, these are logged as and when transactions take place.  The level of details depends on what you have set.  So if the level of details in the logs is fine, then you will be OK.

    Sukh

    Thursday, April 14, 2011 3:27 PM
  • This logfile is written/refreshed only every five minutes. I want to know if I can manually change this to, let's say, "every 2 minutes"?
    Thursday, April 14, 2011 3:30 PM
  • Hi

    What makes you think it is refreshed every five minutes?

    Even, so the log file is still be written to, so you can copy it and then open it.

    Sukh

    Thursday, April 14, 2011 3:32 PM
  • Hi

    Does that make sense?

    Sukh

    Thursday, April 14, 2011 3:51 PM
  • Sry for being unclear.. the log file is written to every five minutes. I can open it all the time, but the events are written to the log file in five minute intervals.

    When I test out something and want to know if a specific mail has been received (for example), I need to wait up to five minutes until I can see this in the log file. This is quite annoying sometimes, specifically when I use the log file for debugging some email notification script - every change of my script means I need to wait five minutes to see if it worked (or why it didn't).

    BTW I think the file is refreshed every five minutes because I can see the time stamp of the file, and it says "last modified", and this time stamp changes every five minutes. :)

    so- anyone know how to change smtp log interval?

    Thursday, April 14, 2011 4:43 PM
  • Hi

    When you send you email via a script, is that sent instantly or does that get set at intervals, i.e every 5 minutes?

    As e.g, is your script relaying off a Exchange 2003 mailbox server, if yes, as soon as your script has sent the email, can you check the SMTP logs?

    This should be instant.  Maybe your script is sending it out every 5 mins?

    Sukh

     

    Thursday, April 14, 2011 6:38 PM
  • That's not correct the buffer to flush to log file is by default 1 minute and has always been the default in IIS. I've also verified in Exchange as well from testing. In IIS you can manipulate the buffer behavior; size, time, disable etc. However for Exchange I'm not sure this is possible or it's just not documented.

    Is this occuring on all versions of your Exchange? Are you sure it's occuring exactly 5 minutes on the dot? You need to try to isolate which systems are doing this, maybe it's not Exchange or SMTP controlling this, maybe you have some other caching mechanism that is going on.

     


    James Chong MCITP | EA | EMA; MCSE | M+, S+ Security+, Project+, ITIL msexchangetips.blogspot.com
    Thursday, April 14, 2011 7:38 PM
  • @James - Thank you for the correction.

    See http://support.microsoft.com/kb/930907 for reg settings.

    You may be able to flush the buffer straight away by using the command below.

    netsh http flush logbuffer

    http://msdn.microsoft.com/en-us/library/cc307232(v=vs.85).aspx

    Sukh

    Thursday, April 14, 2011 7:52 PM
  • flushing log buffer? does this write content of the buffer to the log file, or is the buffer just cleared without writing to file?

    And for Exchange 2003 this will help, but not for Exchange 2007/2010 since they do nut use IIS logging - Exchange from 2007 on has its own smtp stack, logging is done for all send/receive connectors separately.

    @Jamestechman: the system in question is Exchange 2010/Win2008R2. And yes, the log files are written exactly every fives minutes, +- 2 seconds.

    I suspect it might be hard-coded to 5 minutes, but wanted to ask here before I give up. :)


    Friday, April 15, 2011 10:07 PM
  • @DennisSchulze - For 2003, yes.  I just tested this.

    Sukh

    Friday, April 15, 2011 10:28 PM
  • Hi DenneisSchulze,

     

    Based on my experience, the SMTP logs may not have this settings.

     

    Understanding Protocol Logging

    http://technet.microsoft.com/en-us/library/aa997624.asp

     

    I also try to involve someone familiar with this topic to further look at this issue, there might be some time delay.

     

    Thanks,

     

    Evan


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Thursday, April 21, 2011 5:07 AM
    Moderator
  • Have you made any progress with this testing? I've done some reading/reviewing and this does not appear to be a configurable option in Exchange 2007 or Exchange 2010.

    From what i have read, any activity on port 25 is supposed to get logged directly to the file at the time the activity occurs.


    Kevin Ca - MSFT
    Thursday, May 19, 2011 12:14 AM
  • @Kevin/Evan Although I mentioned this too, it doesn't seem to be the case as mentioned by Dennis and James. @james/dennis - unless you guys were referring to something else? Can you verify, I will look into this too,
    Sukh
    Thursday, May 26, 2011 6:45 AM
  • I was/am referring to the files that can be found (exchange 2010) at

    C:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs\ProtocolLog\SmtpReceive

    or

    C:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs\ProtocolLog\SmtpSend

     

    These files are updated every 5 minutes only, and clearly NOT instantly when activity on Port 25 is detected.

    I can open one of the above folders, and see the latest file was changed at 9:29AM. I then keep pressing F5 to refresh every few seconds, and the latest file becomes changed again only after 9:34AM has passed, when I then open the file I can see all latest activities logged between 9:29 AM and 9:34 AM, but these clearly are not logged instantly, they are logged up to 5 Minutes delayed - which is after 9:34 AM has passed.

     

    @Kevin, could you please verify if this can be configured in any way, for sure? thx

     

     

    Thursday, May 26, 2011 7:42 AM
  • @Dennis

    When you enable logging, SMTP is actually being logged as traffic passes.  Your view is just being refreshed after 5 mins (Hit F5).  If you actually open the log file, for e.g enable logging at 9:30, then open the log file at 9:31, you will see the date/time modified date/time to reflect this, if you open again at 09:32, you will again see the date/time modified again.  In between theses time, data is being logged instantly.

    If you open the log say within the minute, tiem modified wont change, but you can see the additional logging in that log.


    Sukh
    Thursday, May 26, 2011 10:43 AM
  • Hi Dennis,

    You need to set the SmtpSendLogFlushInterval and SmtpRecvLogFlushInterval values in EdgeTransport.exe.config and restart the Microsoft Exchage Transport service on every one of your Hub Transport servers in your lab/dev environment. You are correct, the default in 5 minutes, though Im sure 2010 RTM did not do this - but 2010 SP1 is doing it again. Not sure if the previous keys (which are both to have timespans as values) work in 2007.

    For example:

        <add key="SmtpSendLogFlushInterval" value="0:00:30" />

    Yours,

    Brian Reid, Microsoft Certified Master | Exchange 2010, MCM Transport Instructor


    Brian Reid C7 Solutions Ltd (www.c7solutions.com)
    Tuesday, October 4, 2011 6:10 AM
  • With more details described at http://blog.c7solutions.com/2012/08/how-speed-up-transport-logging.html for this issue

    Brian Reid C7 Solutions Ltd (www.c7solutions.com)

    Wednesday, August 29, 2012 8:55 AM