You can enable protocol logging for POP3 and IMAP4 by modifying the following files:
- POP3 Microsoft.Exchange.Pop3.exe.config
- IMAP4 Microsoft.Exchange.Imap4.exe.config
Both files are located in C:\Program Files\Microsoft\Exchange Server\ClientAccess\PopImap.
The Microsoft.Exchange.Pop3.exe.config and Microsoft.Exchange.Imap4.exe.config files contain parameters that define how protocol logging for POP3 and IMAP4 works. The following table explains these parameters.
Fields used to classify each protocol event
|
Parameter name
|
Description
|
| AgeQuotaInHours | This value is set to 24. The protocol log file will be re-created automatically every 24 hours. |
| SizeQuota | This value is set to 10000000. The protocol log file will be automatically re-created when the file size exceeds 10000000 bytes. If the file size does not exceed this value, the file will be re-created automatically after the 24-hour time period is exceeded. |
| PerFileSizeQuota | This value is set to 1000000. The protocol log file will create one additional new file every time that the 1000000 byte file size is exceeded. |
The information that is on each line of the POP3 and IMAP4 protocol logs is organized by fields that are separated by commas. The following table explains the fields that are used to classify each protocol event.
Fields used to classify each protocol event
|
Field name
|
Description
|
| date-time | The date and time of the protocol event. The value is formatted as yyyy-mm-ddhh:mm:ss.fffZ, where yyyy = year, mm = month, dd = day, hh = hour, mm = minute, ss = second, fff = fractions of a second, and Z signifies Zulu. Zulu is another way to indicate Coordinated Universal Time (UTC). |
| connector-id | This field is not used for POP3 and IMAP4 protocol logging. |
| session-id | A GUID that is unique for each SMTP session but is the same for each event that is associated with that SMTP session. |
| sequence-number | A counter that starts at 0 and is incremented for each event in the same session. |
| local-endpoint | The local endpoint of a POP3 or IMAP4 session. This consists of an IP address and TCP port number that is formatted as <IP address>:<port>. |
| remote-endpoint | The remote endpoint of a POP3 or IMAP4 session. This consists of an IP address and TCP port number that is formatted as <IP address>:<port>. |
| event | A single character that represents the protocol event. The possible values for the event are as follows: -
+ Connect
-
- Disconnect
-
> Send
-
< Receive
-
* Information
|
| data | Text information that is associated with the POP3 or IMAP4 event. |
| context | This field is not used for POP3 and IMAP4 protocol logging. |
To perform the following procedures on a computer that has the POP3 and IMAP4 services enabled, the account you use must be delegated the Exchange Server Administrator role and membership in the local Administrators group for the target server.
For more information about permissions, delegating roles, and the rights that are required to administer Exchange Server 2007, see Permission Considerations.