Diagnostic Logging of Exchange Processes

[This is pre-release documentation and subject to change in future releases. This topic's current status is: Writing Not Started.]

Applies to: Exchange Server 2010 Beta

The process logging level for each Exchange process determines which events are written to the Application event log in the Microsoft Windows Server 2003 Event Viewer. The Event Viewer is a tool that you can use to help monitor hardware and software activities. You can change process logging levels to increase the volume and type of events that are reported, including those related to authentication, connections, and user actions. You can use these events to assist with server diagnostics and troubleshooting.

The first step in modifying the process logging level of an Exchange process is to determine if the process is configurable and what its current logging level value is by using the Exchange Management Shell Get-EventLogLevel cmdlet.

After selecting the processes you are interested in, the next step is to set the logging levels for those processes. There are five logging levels of detail, which are described in Table 1. When Exchange generates an event that is less than or equal to the configured logging level, the event is logged. Events range from significant events (such as application failures) to moderately important events (such as the receipt of messages across a gateway) to events that are relevant only to debugging activities.

Typically, you log only critical events. However, when problems occur, increasing the process logging level can help to increase the number and detail of events that are captured by the event log, which you can then use for detailed diagnostics. After changing a logging level, logging begins automatically whenever you start Exchange. You can view the log entries in the Event Viewer.

Note

Process logging levels are configured separately for each process and on a per-Exchange server basis. If you want to change the logging level for a process on all Exchange servers in your organization, you must change the logging level on each server individually.

Table 1   Logging levels for Exchange events

Logging level	Description
Lowest	Only critical events, error events, and events with a logging level of zero are logged. Note: This is the default level for all services on Exchange servers except MSExchange ADAccess\Topology and MSExchange ADAccess\Validation, which have a default level of Low.
Low	Events with a logging level of 1 or lower are logged.
Medium	Events with a logging level of 3 or lower are logged.
Maximum	Events with a logging level of 5 or lower are logged.
Expert	Events with a logging level of 7 or lower are logged.

For More Information

For more information about configuring diagnostics logging, see Change Logging Levels for Exchange Processes.

For a complete list of Exchange processes that have configurable logging levels, see Processes with Configurable Event Logging Levels.

For more information about the Exchange Management Shell Get-EventLogLevel cmdlet, see Get-EventLogLevel.