HOWTO increase the Logging Levels in Exchange 2003,2007 and 2010
Im often asked about logging levels in Exchange and to be fair to my customers, when I'm not asked I will always turn the tables and start the discussion. Logging is an important troubleshooting step, and when implimented correctly can also become a powerful pro-active mechanism to help identify issues before they become show stoppers.
In Exchange 2003:
There are two options to increase the Logging levels in Exchange 2003.
Option 1:
Over the Exchange System Manager, the highest level of logging can be set to “Maximum” which means Level 5.
Open Exchange System Manager – Administrative Group - Server Properties – Diagnostics Logging, select the desired component and select one of the Logging levels:
Option 2:
Over the Registry, the highest level of logging can be set to 7 (debug):
The settings have to be done under:
HKEY_LOCAL_MACHINE-> System-> CurrentControlSet-> Services->
And from here the desired component has to be selected and a value of 7 inserted.
Here is an example of enabling the Logging for the Transport component:
HKEY_LOCAL_MACHINE-> System-> CurrentControlSet-> Services-> <MSExchangeTransport -> Diagnostics
Right clicking any of the Keys and select “Modify”
Inserting the value 7 and clicking OK brings the Logging to the highest level that the logging can be set.
Note: After the Logging is increased, slow performance issues might appear on a server, therefore it is recommended to increase the Application Log size to 16 MB, otherwise the log might be rewritten.
Note: Increasing the Logging will bring the server to also log many additional errors which do no have anything to do with the initial issue, but these errors can most of the times be ignored.
==============================================================================
Increasing the Logging on an Exchange 2007 and/or an Exchange 2010 Server:
On an Exchange 2007/2010 Server there are 3 ways to increase the logging:
Option 1:
Increase the Logging using a Powershell command.
Open the Exchange Management Shell (Start, All Programs, Microsoft Exchange Server).
Running the Get-EventLogLevel command shows a list with all Logging components and their current level. By default the logging level is on : ”Lowest”
To increase the logging for a specific component the following command has to run:
Get-EventLogLevel COMPONENT |Set-EventLoglevel -Level High.
For example the command “Get-EventLogLevel MSExchangeIS |Set-EventLoglevel -Level High” increases the logging for “MSExchangeIS”
Here is an example of increasing the logging for the Replication:
Set-EventLogLevel –Level High| Where-Object {$_.identity -like "MSExchangeIS\9001 Public*Replication*"}
Identity EventLevel
-------- ----------
MSExchangeIS\9001 Public\Replication DS Updates High
MSExchangeIS\9001 Public\Replication Incoming Messages High
MSExchangeIS\9001 Public\Replication Outgoing Messages High
MSExchangeIS\9001 Public\Replication NDRs High
MSExchangeIS\9001 Public\Replication Site Folders High
MSExchangeIS\9001 Public\Replication Expiry High
MSExchangeIS\9001 Public\Replication Conflicts High
MSExchangeIS\9001 Public\Replication Backfill High
MSExchangeIS\9001 Public\Replication Errors High
MSExchangeIS\9001 Public\Replication General High
MSExchangeIS\9001 Public\Local Replication High
Option 2:
Increasing the Logging over the Registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
Select the desired component and set the value of 7.
For Example increasing the value for “Send As”:
Option 3:
Increasing the logging using the Exchange Management Console (In Exchange 2007 this is available only for SP2 or later)
Open theExchange Management Console – Server Configuration, right click the server and select Manage Diagnostic Logging Properties as shown below:
Select the desired component and place it on the necessary level.
Note: Increasing the Logging will bring the server to also log many additional errors which do no have anything to do with the initial issue, but these errors can most of the times be ignored.
Note: After the Logging is increased, slow performance issues might appear on a server, therefore it is recommended to increase the Application Log size to 16 MB, otherwise the log might be rewritten.
- Anonymous
November 29, 2013
The comment has been removed - Anonymous
January 15, 2014
I recently had a couple of cases where E-Mails were not being processed from the queues anymore causing - Anonymous
January 14, 2016
To increase the logging on Exchange 2010 please used the following cmd-let:
Get-eventloglevel "MSExchangeIS9001 Public*" | set-eventloglevel -Level Exper