A. You can get this information from several sources. The first source is the Outlook client. To view a message's header, open the message and select View, Options from Outlook's menu bar. Outlook displays the header—including information that can help you identify the server that delivered the message—at the bottom of the resulting dialog box.
A second source—assuming that you're an administrator and can access the server's file system—is the Exchange Server Internet Mail Service (IMS) logs, which record a variety of information about each received message. You can find the log files, which have filenames such as lxxxxxxx.log (where xxxxxxx is a number; the largest number represents the most recent log file), in the \exchsrvr\imcdata\log folder in Exchange Server's log-file volume. However, the amount of information that you find in the files depends entirely on the current diagnostics-logging level for the IMS. A level of Minimum provides information about connections that the IMS establishes and receives, including the remote server's name or IP address. If you want to see additional information about each connection, you need to set diagnostics logging to a higher level.
To set the Logging level, open Microsoft Exchange Administrator and access the Properties dialog box for either the Exchange Server machine or the server's IMS. (Expand the Exchange Server site's \configuration\servers container, highlight the server, and select File, Properties from the menu bar. Or, expand the site's \configuration\connections container, highlight the server's IMS listing, and select File, Properties.) Navigate to either Properties dialog box's Diagnostics Logging tab, which Figure 1 shows, and select SMTP Protocol Log under the Category list. Select a Logging level of Minimum or higher, and click OK. (As with all Exchange Server services, any changes to the IMS's diagnostics-logging settings won't take effect until you restart the service.) You can also configure the Message Archival category to make copies of each inbound message, which will include message header data such as information about the message's origin. However, the primary disadvantage to any Exchange Server service diagnostics logging is disk space usage: Extensive logging can quickly consume disk space on your server and cause other problems (e.g., prevent the Exchange Server services from starting). Thus, use diagnostics logging sparingly, and keep all service-logging levels at the lowest level necessary to get the information you need.
You can find information about Exchange Server's diagnostics logging in the online document Microsoft Exchange Server Maintenance and Troubleshooting on the Exchange Server CD-ROM. If you installed the Exchange Books Online (BOL) option during Exchange Server setup, you can use that program or Microsoft Internet Explorer (IE) to open \exchsrvr\docs\misc\xframsie.htm on the Exchange Server machine. You can also read Paul Niser, "Diagnostics Logging in Exchange Server 5.5," Spring 2001.
Figure 1: Configuring diagnostics logging
