Exchange 2013 Diagnostic Logging

Exchange Server diagnostic logging is a very useful way to increase the information level in your event logs. These events are useful when you are having an issues with Exchange and you need some additional information to find a solution. In Exchange 2013 the only way to set these is with PowerShell. The commands available are ‘Get-EventLogLevel’ and ‘Set-EventLogLevel’. There is no way to set this in the EAC either with Exchange 2013 RTM or CU1.

So what events can you set Diagnostic Logging for in Exchange 2013?

MSExchange ActiveSync\Configuration
MSExchange Antispam\General
MSExchange Assistants\Assistants
MSExchange Autodiscover\Core
MSExchange Autodiscover\Web
MSExchange Autodiscover\Provider
MSExchange Availability\Availability Service
MSExchange Availability\Availability Service General
MSExchange Availability\Availability Service Authentication
MSExchange Availability\Availability Service Authorization
MSExchange Cluster\Move
MSExchange Cluster\Upgrade
MSExchange Cluster\Action
MSExchange Common\General
MSExchange Common\Configuration
MSExchange Common\Logging
MSExchange RBAC\General
MSExchange RBAC\RBAC
MSExchange CmdletLogs\General
MSExchange Configuration Cmdlet – Management Console\General
MSExchange Configuration Cmdlet – Management Console\RBAC
MSExchange Delegated Authentication Module\General
MSExchange LiveId Redirection Module\General
MSExchange Organization Redirection Module\General
MSExchange Certificate Authentication Module\General
MSExchange Control Panel\General
MSExchange Control Panel\Performance
MSExchange Control Panel\Redirect
MSExchange Control Panel\Proxy
MSExchange Extensibility\Transport Address Book
MSExchange Extensibility\MExRuntime
MSExchange EdgeSync\Synchronization
MSExchange EdgeSync\Topology
MSExchange EdgeSync\SyncNow
MSExchange TransportService\TransportService
MSExchange Web Services\Core
MSExchange IMAP4\General
MSExchange IMAP4 BE\General
MSExchange Messaging Policies\Journaling
MSExchange Messaging Policies\AttachFilter
MSExchange Messaging Policies\AddressRewrite
MSExchange Messaging Policies\Rules
MSExchange Messaging Policies\Prelicensing
MSExchange Messaging Policies\PolicyApplication
MSExchange Messaging Policies\JournalReportDecryption
MSExchange Messaging Policies\RightsManagement
MSExchange Messaging Policies\TransportDecryption
MSExchange Messaging Policies\RedirectionAgent
MSExchange Messaging Policies\Information Rights Management
MSExchange Anti-spam Update\HygieneUpdate
MSExchange Mailbox Replication\Service
MSExchange Mailbox Replication\Mailbox Move
MSExchange Mid-Tier Storage\Xtc
MSExchange Mid-Tier Storage\Audit
MSExchange Mid-Tier Storage\Discovery
MSExchange Mid-Tier Storage\Information Rights Management
MSExchange Mid-Tier Storage\CopyOnWrite
MSExchange Mid-Tier Storage\ResourceHealth
MSExchange Management Application\Shell
MSExchange Management Application\Console
MSExchange Management Application\ProvisioningAgent
MSExchange Management Application\ComponentInfoBasedTask
MSExchange Management Application\AdminAuditLog
MSExchange OWA\FormsRegistry
MSExchange OWA\Core
MSExchange OWA\Configuration
MSExchange OWA\Themes
MSExchange OWA\SmallIcons
MSExchange OWA\Proxy
MSExchange OWA\Transcoding
MSExchange OWA\ADNotifications
MSExchange OWA\InstantMessage
MSExchange POP3\General
MSExchange POP3 BE\General
MSExchange Process Manager\ProcessManager
MSExchange Repl\Service
MSExchange Repl\Exchange VSS Writer
MSExchange ReportingWebService\General
MSExchange Topology\Topology Discovery
MSExchange Unified Messaging\UMWorkerProcess
MSExchange Unified Messaging\UMCore
MSExchange Unified Messaging\UMManagement
MSExchange Unified Messaging\UMService
MSExchange Unified Messaging\UMClientAccess
MSExchange Unified Messaging\UMCallData
MSExchange Unified Messaging\MWI General
MSExchange Unified Messaging\UMCallRouter
MSExchange ADAccess\General
MSExchange ADAccess\Cache
MSExchange ADAccess\Topology
MSExchange ADAccess\Configuration
MSExchange ADAccess\LDAP
MSExchange ADAccess\Validation
MSExchange ADAccess\Recipient Update Service
MSExchange ADAccess\Site Update
MSExchange ADAccess\Exchange Topology
MSExchange ADAccess\MSERV
MSExchange ADAccess\GLS
MSExchangeADTopology\General
MSExchangeADTopology\Configuration
MSExchangeADTopology\Topology
MSExchangeApplicationLogic\TextMessaging
MSExchangeApplicationLogic\ServerPicker
MSExchangeIS\General
MSExchangeIS\Physical Access
MSExchangeIS\Logical Data Model
MSExchangeIS\Directory Services
MSExchangeIS\MAPI
MSExchangeIS\High Availability
MSExchangeMailboxAssistants\Service
MSExchangeMailboxAssistants\OOF Assistant
MSExchangeMailboxAssistants\OOF Library
MSExchangeMailboxAssistants\Resource Booking Attendant
MSExchangeMailboxAssistants\Email_Lifecycle_Assistant
MSExchangeMailboxAssistants\Junk Email Options Assistant
MSExchangeMailboxAssistants\Conversations Assistant
MSExchangeMailboxAssistants\Approval Assistant
MSExchangeMailboxAssistants\ELC Library
MSExchangeTransport\SmtpReceive
MSExchangeTransport\SmtpSend
MSExchangeTransport\DSN
MSExchangeTransport\Routing
MSExchangeTransport\Logging
MSExchangeTransport\Components
MSExchangeTransport\RemoteDelivery
MSExchangeTransport\Pickup
MSExchangeTransport\Categorizer
MSExchangeTransport\PoisonMessage
MSExchangeTransport\MessageSecurity
MSExchangeTransport\TransportService
MSExchangeTransport\Exch50
MSExchangeTransport\Process
MSExchangeTransport\ResourceManager
MSExchangeTransport\Configuration
MSExchangeTransport\Storage
MSExchangeTransport\Agents
MSExchangeTransport\Transport Address Book
MSExchangeTransport\Orar
MSExchangeTransport\Unused
MSExchangeTransport\ShadowRedundancy
MSExchangeTransport\Approval
MSExchangeTransport\TransportSafetyNet
MSExchangeTransport\TransportTenantAttribution
MSExchangeTransportSyncCommon\General
MSExchangeTransportSyncManager\General
MSExchangeTransportSyncWorker\General
MSExchangeTransportSyncWorkerFramework\General
MSExchange OutlookProtectionRules\Outlook Protection Rules
MSExchange Provisioning MailboxAssistant\Provisioning Assistant General
MSExchangeThrottling\General
MSExchangeThrottlingClient\General
MSExchange FailFast Module\General
MSExchange Store Driver Delivery\MSExchangeStoreDriverDelivery
MSExchange Store Driver Delivery\MeetingMessageProcessing
MSExchange Store Driver Delivery\OofHistory
MSExchange Store Driver Delivery\Approval
MSExchange Store Driver Delivery\UnifiedMessaging
MSExchange Store Driver Submission\MSExchangeStoreDriverSubmission
MSExchangeSubmission\MSExchangeSubmission
MSExchange Antimalware\General
MSExchange Antimalware\Init
MSExchange Antimalware\ScanResults
MSExchange Antimalware\ScanError
MSExchange OAuth\Requests
MSExchange OAuth\Configuration
MSExchange OAuth\Server
MSExchange BackEndRehydration\Requests
MSExchange BackEndRehydration\Configuration
MSExchange BackEndRehydration\Server
MSExchange Front End HTTP Proxy\Core
MSExchange RemotePowershell BackendCmdletProxy Module\General
MSExchange Error Logging Module\General
MSExchange Client Diagnostics Module\General
MSExchangeFrontEndTransport\SmtpReceive
MSExchangeFrontEndTransport\SmtpSend
MSExchangeFrontEndTransport\DSN
MSExchangeFrontEndTransport\Routing
MSExchangeFrontEndTransport\Logging
MSExchangeFrontEndTransport\Components
MSExchangeFrontEndTransport\RemoteDelivery
MSExchangeFrontEndTransport\Pickup
MSExchangeFrontEndTransport\Categorizer
MSExchangeFrontEndTransport\PoisonMessage
MSExchangeFrontEndTransport\MessageSecurity
MSExchangeFrontEndTransport\TransportService
MSExchangeFrontEndTransport\Exch50
MSExchangeFrontEndTransport\Process
MSExchangeFrontEndTransport\ResourceManager
MSExchangeFrontEndTransport\Configuration
MSExchangeFrontEndTransport\Storage
MSExchangeFrontEndTransport\Agents
MSExchangeFrontEndTransport\Transport Address Book
MSExchangeFrontEndTransport\Orar
MSExchangeFrontEndTransport\Unused
MSExchangeFrontEndTransport\ShadowRedundancy
MSExchangeFrontEndTransport\Approval
MSExchangeFrontEndTransport\TransportSafetyNet
MSExchangeFrontEndTransport\TransportTenantAttribution



In case you were moving from 2010 to 2013, here is a list of changes of Diagnostic Logging?

Events Added to 2013
MSExchange Control Panel\General
MSExchange Control Panel\Performance
MSExchange Control Panel\Redirect
MSExchange Control Panel\Proxy
MSExchange IMAP4 BE\General
MSExchange POP3 BE\General
MSExchange ReportingWebService\General
MSExchange Unified Messaging\UMCallRouter
MSExchange ADAccess\MSERV
MSExchange ADAccess\GLS
MSExchangeADTopology\General
MSExchangeADTopology\Configuration
MSExchangeADTopology\Topology
MSExchangeIS\General
MSExchangeIS\Physical Access
MSExchangeIS\Logical Data Model
MSExchangeIS\Directory Services
MSExchangeIS\MAPI
MSExchangeIS\High Availability
MSExchangeTransport\TransportSafetyNet
MSExchangeTransport\TransportTenantAttribution
MSExchangeTransportSyncManager\General
MSExchangeTransportSyncWorkerFramework\General
MSExchange FailFast Module\General
MSExchange Store Driver Delivery\MSExchangeStoreDriverDelivery
MSExchange Store Driver Delivery\MeetingMessageProcessing
MSExchange Store Driver Delivery\OofHistory
MSExchange Store Driver Delivery\Approval
MSExchange Store Driver Delivery\UnifiedMessaging
MSExchange Store Driver Submission\MSExchangeStoreDriverSubmission
MSExchangeSubmission\MSExchangeSubmission
MSExchange Antimalware\General
MSExchange Antimalware\Init
MSExchange Antimalware\ScanResults
MSExchange Antimalware\ScanError
MSExchange OAuth\Requests
MSExchange OAuth\Configuration
MSExchange OAuth\Server
MSExchange BackEndRehydration\Requests
MSExchange BackEndRehydration\Configuration
MSExchange BackEndRehydration\Server
MSExchange Front End HTTP Proxy\Core
MSExchange RemotePowershell BackendCmdletProxy Module\General
MSExchange Error Logging Module\General
MSExchange Client Diagnostics Module\General
MSExchangeFrontEndTransport\SmtpReceive
MSExchangeFrontEndTransport\SmtpSend
MSExchangeFrontEndTransport\DSN
MSExchangeFrontEndTransport\Routing
MSExchangeFrontEndTransport\Logging
MSExchangeFrontEndTransport\Components
MSExchangeFrontEndTransport\RemoteDelivery
MSExchangeFrontEndTransport\Pickup
MSExchangeFrontEndTransport\Categorizer
MSExchangeFrontEndTransport\PoisonMessage
MSExchangeFrontEndTransport\MessageSecurity
MSExchangeFrontEndTransport\TransportService
MSExchangeFrontEndTransport\Exch50
MSExchangeFrontEndTransport\Process
MSExchangeFrontEndTransport\ResourceManager
MSExchangeFrontEndTransport\Configuration
MSExchangeFrontEndTransport\Storage
MSExchangeFrontEndTransport\Agents
MSExchangeFrontEndTransport\Transport Address Book
MSExchangeFrontEndTransport\Orar
MSExchangeFrontEndTransport\Unused
MSExchangeFrontEndTransport\ShadowRedundancy
MSExchangeFrontEndTransport\Approval
MSExchangeFrontEndTransport\TransportSafetyNet
MSExchangeFrontEndTransport\TransportTenantAttribution


Events Removed from 2013
MSExchange Search Indexer\General
MSExchange Search Indexer\Configuration
MSExchange Store Driver\General
MSExchange Store Driver\MeetingMessageProcessing
MSExchange Store Driver\OofHistory
MSExchange Store Driver\Approval
MSExchange Store Driver\ContentAggregation
MSExchangeAL\Ldap Operations
MSExchangeAL\Service Control
MSExchangeAL\Attribute Mapping
MSExchangeAL\Account Management
MSExchangeAL\Address List Synchronization
MSExchangeIS\9000 Private\Transport General
MSExchangeIS\9000 Private\General
MSExchangeIS\9000 Private\Transport Sending
MSExchangeIS\9000 Private\Transport Delivering
MSExchangeIS\9000 Private\Transfer Into Gateway
MSExchangeIS\9000 Private\Transfer Out Of Gateway
MSExchangeIS\9000 Private\MTA Connections
MSExchangeIS\9000 Private\Logons
MSExchangeIS\9000 Private\Access Control
MSExchangeIS\9000 Private\Send On Behalf Of
MSExchangeIS\9000 Private\Send As
MSExchangeIS\9000 Private\Rules
MSExchangeIS\9000 Private\Storage Limits
MSExchangeIS\9000 Private\Background Cleanup
MSExchangeIS\9000 Private\DS Synchronization
MSExchangeIS\9000 Private\Views
MSExchangeIS\9000 Private\Download
MSExchangeIS\9000 Private\Local Replication
MSExchangeIS\9001 Public\Transport General
MSExchangeIS\9001 Public\General
MSExchangeIS\9001 Public\Replication DS Updates
MSExchangeIS\9001 Public\Replication Incoming Messages
MSExchangeIS\9001 Public\Replication Outgoing Messages
MSExchangeIS\9001 Public\Replication NDRs
MSExchangeIS\9001 Public\Transport Sending
MSExchangeIS\9001 Public\Transport Delivering
MSExchangeIS\9001 Public\MTA Connections
MSExchangeIS\9001 Public\Logons
MSExchangeIS\9001 Public\Access Control
MSExchangeIS\9001 Public\Send On Behalf Of
MSExchangeIS\9001 Public\Send As
MSExchangeIS\9001 Public\Rules
MSExchangeIS\9001 Public\Storage Limits
MSExchangeIS\9001 Public\Replication Site Folders
MSExchangeIS\9001 Public\Replication Expiry
MSExchangeIS\9001 Public\Replication Conflicts
MSExchangeIS\9001 Public\Replication Backfill
MSExchangeIS\9001 Public\Background Cleanup
MSExchangeIS\9001 Public\Replication Errors
MSExchangeIS\9001 Public\DS Synchronization
MSExchangeIS\9001 Public\Views
MSExchangeIS\9001 Public\Replication General
MSExchangeIS\9001 Public\Download
MSExchangeIS\9001 Public\Local Replication
MSExchangeIS\9002 System\Recovery
MSExchangeIS\9002 System\General
MSExchangeIS\9002 System\Connections
MSExchangeIS\9002 System\Table Cache
MSExchangeIS\9002 System\Content Engine
MSExchangeIS\9002 System\Performance Monitor
MSExchangeIS\9002 System\Move Mailbox
MSExchangeIS\9002 System\Download
MSExchangeIS\9002 System\Virus Scanning
MSExchangeIS\9002 System\Exchange Writer
MSExchangeIS\9002 System\Backup Restore
MSExchangeIS\9002 System\Client Monitoring
MSExchangeIS\9002 System\Event History
MSExchangeIS\9002 System\Database Storage Engine
MSExchangeMailboxAssistants\FreeBusy Assistant
MSExchangeMailSubmission\General
MSExchangeMU\General
MSExchangeSA\Clean Mailbox
MSExchangeSA\OAL Generator
MSExchangeSA\Proxy Generation
MSExchangeSA\RPC Calls
MSExchangeSA\RPC-HTTP Management
MSExchangeTransport\TransportDumpster
MSExchangeFDS\General
MSExchangeFDS\FileReplication



As can be seen be the above chart, there were quite a few changes between Exchange 2010 and 2013 for Diagnostic logging. Removal of events for Public Folders and the addition of Front End Transport server events seem to be the biggest change. The ExchangeSA\OALGenerator one, commonly used to troubleshoot Offline Address Book issues, has been removed as well.

Related Resources

get-eventloglevel
set-eventloglevel

Advertisements

7 thoughts on “Exchange 2013 Diagnostic Logging

  1. Hello,

    With Exchange Server 2010 Diagnostic Logs:

    “MSExchangeIS \ 9000 Private \ Send As”

    send-as in the original Sender could see from logs.

    Exchange 2013 diagnostic event logs-“MSExchangeIS \ 9000 Private \ Send As” has been removed. Where there is a resource that could be seen now.

    Where the logs are stored in the Send-as Exchange 2013? logs records being kept?

  2. In Exchange 2013, MSExchangeIS\9002 System\Backup Restore has been deleted. Do you know what the new comparable items are? Or in general, what items should the logging be turned-up on to monitor backups?

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s