03I: 04I: 00A: In the message-info field of message tracking logs. what do they mean?
HI,
In the MS exchange 2007 msg tracking logs, under the message-info field iam getting the following values:
03I:
04I:
00A:
etc.
what do these values represent?
July 30th, 2008 9:28am
keeping it up the thread..
Free Windows Admin Tool Kit Click here and download it now
July 30th, 2008 3:38pm
Hi,
Here is a brief introduction about message-info field of message tracking log:
This field contains the message origination date-time for DELIVER and SEND events. The origination date-time is the time that the message first enters the Exchange organization. The value is formatted as yyyy-mm-ddThh:mms.fffZ, where yyyy = year, mm = month, dd = day, hh = hour, mm = minute, ss = second, fff = fractions of a second, and Z signifies Zulu, which is another way to denote UTC.
When the event type is receive, the message-info field will display the values you mentioned.
For more information:
Managing Message Tracking
http://technet.microsoft.com/en-us/library/bb124375(EXCHG.80).aspx
Hope this helps. Thanks,
Elvis
July 31st, 2008 12:59pm
Hi,
Thanks a lot for that input but wat exactly do these values represent? Also, can you provide me with some sample message tracking logs if you have them? It'l be very helpful to me, specialy the one's with FAIL and SSEND events in them.
Yuvika
Free Windows Admin Tool Kit Click here and download it now
July 31st, 2008 1:54pm
I'm having the same issue, I have one user that cannot send to one other use in my exchange 2007 environment. The only thing I can find is a 03I: in the message info field on these emails.
August 14th, 2008 3:51pm
Has there been a find to this issue yet? I have created a Dynamic Distribution Group for all employees and set it where just a couple of people can send to it. Upon them sending the message, there is no NDR, the message doesnt get delivered and when I do a message tracking on it the message info is "04l:". Now if anyone has an idea as to what this means, I am sure that there are a few people that would really like to know what these Codes mean!
Free Windows Admin Tool Kit Click here and download it now
August 21st, 2008 5:27pm
keeping this query up in the thread....can anybody help us out regarding this?
January 5th, 2009 8:57am
Elvis Wei -MSFT said:
When the event type is receive, the message-info field will display the values you mentioned.
And our question is - what do the values mean? Are they just placed in the log to fill up space or act as a placeholder for some reason? Or do they actually relate to some aspect of the RECEIVE event?
For more information:
Managing Message Tracking
http://technet.microsoft.com/en-us/library/bb124375(EXCHG.80).aspx
Hope this helps. Thanks,
Elvis
Thanks for the link, but it does not really answer the question.
Free Windows Admin Tool Kit Click here and download it now
February 18th, 2009 7:12pm
WTF is up with the above. It's a simple questions.exchange 2007 message-info 00a:The correct information in this field should be a date not an error code, what does the error code stand for.I'm worried it's the IMF blocked the email.Someone from MS get it together. There's alot of questions about this in the real world.Vote for Freedom - Vote to Protect our Country
August 4th, 2009 9:25pm
I do beleive that 00a: error code instead of a time stamped date is a IMF blocked/refused email.In my case it was the IMF word filter had blocked a listed word.Vote for Freedom - Vote to Protect our Country
Free Windows Admin Tool Kit Click here and download it now
September 10th, 2009 9:20pm
Just to add to this thread, have just seen the 00A: message-info on some messages I was troubleshooting. In my case the issue turned out to be that the connection between CAS and Mailstore was down, and therefore the messages couldn't be delivered
and were sat in the mail queue.
September 14th, 2011 2:55pm
On Wed, 14 Sep 2011 11:55:31 +0000, Keith Langmead wrote:
>Just to add to this thread, have just seen the 00A: error on some messages I was troubleshooting.
That's not an error, it's just the authentication type. In this case,
it's "None" and it was an anonymous connection.
>In my case the issue turned out to be that the connection between CAS and Mailstore was down, and therefore the messages couldn't be delivered and were sat in the mail queue.
---
Rich Matheisen
MCSE+I, Exchange MVP
--- Rich Matheisen MCSE+I, Exchange MVP
Free Windows Admin Tool Kit Click here and download it now
September 14th, 2011 9:04pm
On Wed, 14 Sep 2011 11:55:31 +0000, Keith Langmead wrote:
That's not an error, it's just the authentication type. In this case,
it's "None" and it was an anonymous connection.
Fair enough about "error", updated accordingly. However, can you clarify what you mean about it being an anonymous connection, since most messages coming into that server are anonymous anyway? http://technet.microsoft.com/en-us/library/bb124375%28EXCHG.80%29.aspx
states that the meaning of message-info is :
"This field contains the message origination date-time for DELIVER and SEND events. The origination date-time is the time that the message first enters the Exchange organization. The value is formatted as yyyy-mm-ddThh:mm:ss.fffZ, where yyyy = year, mm =
month, dd = day, hh = hour, mm = minute, ss = second, fff = fractions of a second, and Z signifies Zulu, which is another way to denote UTC."
Other entries in the log come up with a date time entry, so I'm unsure how the 00A: status connects with that and your assertion that it relates to an anonymous connection.
There does seem to be a lot of confusion on this topic not only here but elsewhere on the net, so if you know the details of what this is and how it all fits together it would be great to get to the bottom of it.
September 14th, 2011 9:31pm
On Wed, 14 Sep 2011 18:31:34 +0000, Keith Langmead wrote:
>On Wed, 14 Sep 2011 11:55:31 +0000, Keith Langmead wrote: That's not an error, it's just the authentication type. In this case, it's "None" and it was an anonymous connection.
>
>Fair enough about "error", updated accordingly. However, can you clarify what you mean about it being an anonymous connection, since most messages coming into that server are anonymous anyway? http://technet.microsoft.com/en-us/library/bb124375%28EXCHG.80%29.aspx
states that the meaning of message-info is :
>
>"This field contains the message origination date-time for DELIVER and SEND events. The origination date-time is the time that the message first enters the Exchange organization. The value is formatted as yyyy-mm-ddThh:mm:ss.fffZ, where yyyy = year, mm
= month, dd = day, hh = hour, mm = minute, ss = second, fff = fractions of a second, and Z signifies Zulu, which is another way to denote UTC."
>
>Other entries in the log come up with a date time entry, so I'm unsure how the 00A: status connects with that and your assertion that it relates to an anonymous connection.
Well, it's not _my_ assertation, it's Microsoft's. Unfortunately, the
source of that information (at least what I have) is under NDA so I
can't tell you what all the values are. What I can tell you is that
they aren't error codes, just the type of authentication. If the
message came from a SMTP client it's most likely an anonymous
connection ("00A:")
>There does seem to be a lot of confusion on this topic not only here but elsewhere on the net, so if you know the details of what this is and how it all fits together it would be great to get to the bottom of it.
To bottom of what? What those codes mean? I'm sorry, but you'll have
to ask Microsoft. They're serious about NDAs.
---
Rich Matheisen
MCSE+I, Exchange MVP
--- Rich Matheisen MCSE+I, Exchange MVP
Free Windows Admin Tool Kit Click here and download it now
September 15th, 2011 12:32am
Just wanted to keep this thread alive. There are many of us out here that look at the logs and need information on what happened to the e-mail.
My manager asked me what hapened with an incomming e-mail I told him OOA: NTS:. He wasn't satisified.
Someone has to have a legend for these obscure responses...
Thanks,
Robert
December 14th, 2011 12:20pm
From
http://www.mail-archive.com/exchangelist@lyris.sunbelt-software.com/msg45705.html
03I:Mapi submit w/o rpc encryption
04I:Mapi submit with rpc encryption (outlook 2k7)
00A: No auth
Essentially on recieve events the message-info field maps to the auth type that
was used to submit the message.
For Deliver and Send events it shows the origination date.
Seems to be that you get these on the RECEIVE EventID and then a time stamp on the DELIVER EventID...
Free Windows Admin Tool Kit Click here and download it now
February 10th, 2012 8:40am