Hi all, I would like to know if it is possible to change the logging interval for the Exchange SMTP logfile to something other than 5 minutes (which is the default)? The reason is that I sometimes need to look at this file frequently for debugging purposes, and it isn't nice having to wait five minutes everytime, to see *if* the changes you just made did help anything.. So: does anyone know how to change the SMTP logging interval? Thanks, Dennis

Hi What version of Exchange are you using? Sukh

Hi, We are using mostly 2007 and 2010 (and some of our customers still have 2003). Can I change the logging interval with *any* version of Exchange at all?

Hi Just to confirm, are you referring to IIS SMTP logging? Sukh

Hi SMTP logging is pretty much real time, as and when transactions occur they are logged. Sukh

I don't know - I mean those logfiles that can be found in the folder "%SYSTEMROOT%\system32\LogFiles\SMTPSVC1" on Exchange 2003, with Exchange 2010 these log files are stored at the following location: "C:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs\ProtocolLog" I think these are Exchange logs, not IIS logs?

Hi Yes they are. And like I said, these are logged as and when transactions take place. The level of details depends on what you have set. So if the level of details in the logs is fine, then you will be OK. Sukh

This logfile is written/refreshed only every five minutes. I want to know if I can manually change this to, let's say, "every 2 minutes"?

Hi What makes you think it is refreshed every five minutes? Even, so the log file is still be written to, so you can copy it and then open it. Sukh

Hi Does that make sense? Sukh

Sry for being unclear.. the log file is written to every five minutes. I can open it all the time, but the events are written to the log file in five minute intervals. When I test out something and want to know if a specific mail has been received (for example), I need to wait up to five minutes until I can see this in the log file. This is quite annoying sometimes, specifically when I use the log file for debugging some email notification script - every change of my script means I need to wait five minutes to see if it worked (or why it didn't). BTW I think the file is refreshed every five minutes because I can see the time stamp of the file, and it says "last modified", and this time stamp changes every five minutes. :) so- anyone know how to change smtp log interval?

Hi When you send you email via a script, is that sent instantly or does that get set at intervals, i.e every 5 minutes? As e.g, is your script relaying off a Exchange 2003 mailbox server, if yes, as soon as your script has sent the email, can you check the SMTP logs? This should be instant. Maybe your script is sending it out every 5 mins? Sukh

That's not correct the buffer to flush to log file is by default 1 minute and has always been the default in IIS. I've also verified in Exchange as well from testing. In IIS you can manipulate the buffer behavior; size, time, disable etc. However for Exchange I'm not sure this is possible or it's just not documented. Is this occuring on all versions of your Exchange? Are you sure it's occuring exactly 5 minutes on the dot? You need to try to isolate which systems are doing this, maybe it's not Exchange or SMTP controlling this, maybe you have some other caching mechanism that is going on. James Chong MCITP | EA | EMA; MCSE | M+, S+ Security+, Project+, ITIL msexchangetips.blogspot.com

@James - Thank you for the correction. See http://support.microsoft.com/kb/930907 for reg settings. You may be able to flush the buffer straight away by using the command below. netsh http flush logbuffer http://msdn.microsoft.com/en-us/library/cc307232(v=vs.85).aspx Sukh

flushing log buffer? does this write content of the buffer to the log file, or is the buffer just cleared without writing to file? And for Exchange 2003 this will help, but not for Exchange 2007/2010 since they do nut use IIS logging - Exchange from 2007 on has its own smtp stack, logging is done for all send/receive connectors separately. @Jamestechman: the system in question is Exchange 2010/Win2008R2. And yes, the log files are written exactly every fives minutes, +- 2 seconds. I suspect it might be hard-coded to 5 minutes, but wanted to ask here before I give up. :)

@DennisSchulze - For 2003, yes. I just tested this. Sukh

Hi DenneisSchulze, Based on my experience, the SMTP logs may not have this settings. Understanding Protocol Logging http://technet.microsoft.com/en-us/library/aa997624.asp I also try to involve someone familiar with this topic to further look at this issue, there might be some time delay. Thanks, Evan Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Have you made any progress with this testing? I've done some reading/reviewing and this does not appear to be a configurable option in Exchange 2007 or Exchange 2010. From what i have read, any activity on port 25 is supposed to get logged directly to the file at the time the activity occurs.Kevin Ca - MSFT

@Kevin/Evan Although I mentioned this too, it doesn't seem to be the case as mentioned by Dennis and James. @james/dennis - unless you guys were referring to something else? Can you verify, I will look into this too,Sukh

I was/am referring to the files that can be found (exchange 2010) at C:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs\ProtocolLog\SmtpReceive or C:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs\ProtocolLog\SmtpSend These files are updated every 5 minutes only, and clearly NOT instantly when activity on Port 25 is detected. I can open one of the above folders, and see the latest file was changed at 9:29AM. I then keep pressing F5 to refresh every few seconds, and the latest file becomes changed again only after 9:34AM has passed, when I then open the file I can see all latest activities logged between 9:29 AM and 9:34 AM, but these clearly are not logged instantly, they are logged up to 5 Minutes delayed - which is after 9:34 AM has passed. @Kevin, could you please verify if this can be configured in any way, for sure? thx

@Dennis When you enable logging, SMTP is actually being logged as traffic passes. Your view is just being refreshed after 5 mins (Hit F5). If you actually open the log file, for e.g enable logging at 9:30, then open the log file at 9:31, you will see the date/time modified date/time to reflect this, if you open again at 09:32, you will again see the date/time modified again. In between theses time, data is being logged instantly. If you open the log say within the minute, tiem modified wont change, but you can see the additional logging in that log.Sukh

No Sukh, this is not the case. This is becoming futile, I can only repeat what I already said several times: the log file is modified only every five minutes. Between those 5 minute intervals, no changes can be seen when opening the log file, and the time stamp of the logfile itself changes every five minutes. Between those five minut intervals NO event is logged. Everything that happens between the refresh intervals is only logged AFTER the logfile is refreshed. This logging interval is always 5 minutes +- a few seconds. If any1 has an idea how to change this interval, I'd be happy to know about it. If someone knows for sure that it is impossible to change this interval, I'd like to know that too of course. What I DON'T need are comments telling me *repeatedly* that logfiles are written instantly, since this is clearly not the case with Exchange 2007 and 2010 and doesn't help me in any way.. THX