Ask Learn
Preview
Ask Learn is an AI assistant that can answer questions, clarify concepts, and define terms using trusted Microsoft documentation.
Please sign in to use Ask Learn.
Sign inThis browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
There are quite number of tools available to find the issues with Exchange Server environment. Here we’re going to view about “Event Viewer”. Interestingly Event viewer is it’s not directly meant nor designed for Exchange server, its designed for Windows OS environment.
So what can we get in the Event viewer?
Using the event logs in Event Viewer, we can gather information about hardware, software, and system problems, and you can monitor Windows operating system security events. In Event Viewer, both the application log and the system log contain errors, warnings, and informational events that are related to the operation of Exchange Server, the SMTP service, and other applications.
What else we can get?
You can use Event Viewer to obtain information about service failures, replication errors in the Active Directory directory service, and warnings about system resources such as virtual memory and disk space. Use Event Viewer to view and manage event logs; obtain information about hardware, software, and system problems that must be resolved; and identify trends that require future action.
Event Viewer maintains logs about application, security, and system events on your computer. Both Microsoft Exchange Server and Microsoft Windows report warnings and error conditions to the event logs. Therefore, make sure that you review event logs daily.
How to identify the issues in Event Viewer?
To identify the cause of message flow issues, carefully review the data that is contained in the application log and system log. Use the following procedure to view errors, warnings, and informational events in the application log.
Microsoft Windows Server 2003, Windows XP, Windows 2000 Server, and Windows NT record events in three kinds of logs:
Servers running Windows Server 2003 and Windows 2000 Server that are domain controllers might have the following additional logs in Event Viewer:
The icon on the left side of the Event Viewer screen describes the classification of the event by the Windows operating system. Event Viewer displays these types of events:
What are the main event components of the Event viewer?
The main event components are as follows:
Couple of samples available in the event viewer (exchange specific) :
How to view the application log in the event viewer?
Click Start, point to Programs, point to Administrative Tools, and then click Event Viewer.
In the console tree, click Application Log.
To sort the log alphabetically and quickly locate an entry for an Exchange service, in the details pane, click Source.
Double-click a log entry to open an event's properties page.
To filter the log to list entries for a specific type of Exchange-related event, from the View menu, click Filter.
In Application Log Properties, use the Event source list to select an Exchange-related event source. For example:
In the Category list, select a specific set of events or, to view all events for that event source, leave the default setting at All.
Click OK.
How to view the System log in event viewer?
Use the following procedure to view errors, warnings, and informational events in the system log for SMTP service.
Click Start, point to Programs, point to Administrative Tools, and then click Event Viewer.
In the console tree, click System Log.
To sort the log alphabetically and quickly locate an entry for an Exchange service, in the details pane, click Source.
Double-click a log entry to open an event's properties page.
To filter the log to list entries for a specific type of SMTP service events, from the View menu, click Filter.
In System Log Properties, in the Event source list, select SMTPSVC.
In the Category list, select a specific set of events or, to view all events for the SMTP service, leave the default setting at All.
Click OK.
Troubleshooting with Event viewer and Exchange Server:
Within each Event Viewer log, Exchange Server records informational, warning, and error events. Monitor these logs closely to track the types of transactions being conducted on your Exchange servers. You should periodically archive the logs or use automatic rollover to avoid running out of space. Because log files can occupy a finite amount of space, increase the log size (for example, to 50 MB) and set it to overwrite, so that Exchange Server can continue to write new events.
You can also automate event log administration by using tools and technologies such as the following:
Reference MSDN articles:
https://technet.microsoft.com/en-us/library/aa996117(EXCHG.65).aspx
https://technet.microsoft.com/en-us/library/aa996634(EXCHG.65).aspx
https://technet.microsoft.com/en-us/library/aa996105(EXCHG.65).aspx
https://technet.microsoft.com/en-us/library/bb232137(EXCHG.80).aspx
Ask Learn is an AI assistant that can answer questions, clarify concepts, and define terms using trusted Microsoft documentation.
Please sign in to use Ask Learn.
Sign in