How do I get Exchange to write to the Event Log when email is received from a specific email address?

Posted on 2007-10-07
Last Modified: 2010-03-06
We use a WIndows 2003 Server, with Exchange 2003 SP2 installed. This server often interfaces with an AIX based UNIX server.
Both of these servers utilise a high-speed link for real-time replication, our industry sector requirements forcing us to do so.
Sometimes, if there is an issue with the link or otherwise, the UNIX servers involved in the replication set can get out of sync or "stale". When this happens, the UNIX box initiates an email via Exchange to a group to inform us that the members of the set are stale.
We use monitoring software (Servers Alive, by Woodstone) to alert, via SMS and Email, ICQ etc... when various problems occur, but so far we have not been able to achieve this monitoring for when the set goes stale.
The monitoring software can watch the Event Log in Windows and alert when a certain event is logged.

I was wondering if anybody knew of a way to force Exchange to write an event in the Windows Server Event Log when an email is received from a certain specified email address?

Regards and Thanks In Advance

Question by:MMBS
    LVL 58

    Accepted Solution

    Exchange doesn't have the ability to write events to the Event Log natively. Instead, it utilises its own event log which can be managed through System Manager known as "Message Tracking".

    That writes to event logs within the Exchange installation directory, so you would need to examine that file at regular intervals to see if the email address is present in there. It is a simple text file so searching should be very easy.

    LVL 104

    Assisted Solution

    The only problem with message tracking is that the file is locked by Exchange during the day that it is being used. Message tracking cannot be used for any real time monitoring unless the services are stopped to release the lock.

    An event sink might do it, but you would probably have to get one written. Another option would be something watching the SMTP traffic flow. AV or Antispam software may be adapted to do that.


    If your question has been answered, pleased remember to accept the answer and close the question.

    Author Comment

    Many thanks to both Tigermatt and Sembee.

    I have given points for both answers as we ended up building a solution using flagging files to detect when something had happened.
    Both of the answers given sparked the idea in my head and we built a solution from them.

    Many thanks to you both for your information and insight.

    Much appreciated - and we now sleep a little better knowing that if something goes wrong with a particular area of our system, we will shortly know.


    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Maximize Your Threat Intelligence Reporting

    Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

    Granting full access permission allows users to access mailboxes present in their database. By giving full access permission one can open and read the content of any mailbox but cannot send emails from that mailbox.
    Get an idea of what you should include in an email disclaimer with these Top 5 email disclaimer tips.
    In this video we show how to create a mailbox database in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Servers >> Data…
    The video tutorial explains the basics of the Exchange server Database Availability groups. The components of this video include: 1. Automatic Failover 2. Failover Clustering 3. Active Manager

    759 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    9 Experts available now in Live!

    Get 1:1 Help Now