Home
%3CLINGO-SUB%20id%3D%22lingo-sub-590014%22%20slang%3D%22en-US%22%3EAdvanced%20Exchange%202007%20Transport%20Logs%20Troubleshooting%20using%20Log%20Parser%20-%20Part%202%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-590014%22%20slang%3D%22en-US%22%3E%3CP%3EThis%20is%20a%20second%20in%20my%20series%20of%20posts%20that%20deal%20with%20using%20Log%20Parser%20tool%20to%20analyze%20your%20Exchange%202007%20transport%20logs.%20For%20the%20first%20post%2C%20please%20go%20%3CA%20href%3D%22http%3A%2F%2Fblogs.technet.com%2Farchive%2F2007%2F11%2F12%2F447515.aspx%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%20target%3D%22_blank%22%3Ehere%3C%2FA%3E.%20I%20have%20written%20this%20blog%20post%20in%20a%20way%20that%20I%20walk%20you%20through%20building%20more%20and%20more%20complex%20Log%20Parser%20queries%2C%20which%20I%20hope%20will%20help%20you%20with%20learning%20how%20to%20build%20your%20own%20queries.%20Log%20Parser%20(also%20referred%20to%20as%20LP%20in%20this%20blog%20post)%20can%20take%20advantage%20of%20Office%20Web%20Components%20to%20draw%20charts%20of%20your%20mail%20flow%20information.%20To%20download%20the%20Office%20Web%20Components%2C%20please%20go%20here%3A%20%3CA%20href%3D%22http%3A%2F%2Fwww.microsoft.com%2Fdownloads%2Fdetails.aspx%3FFamilyID%3D7287252C-402E-4F72-97A5-E0FD290D4B76%26amp%3Bdisplaylang%3Den%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%20target%3D%22_blank%22%3Ehttp%3A%2F%2Fwww.microsoft.com%2Fdownloads%2Fdetails.aspx%3FFamilyID%3D7287252C-402E-4F72-97A5-E0FD290D4B76%26amp%3Bdisplaylang%3Den%3C%2FA%3E%20When%20installed%2C%20you%20can%20use%20the%20integration%20of%20LP%20and%20Office%20Web%20Components.%20For%20example%2C%20typing%3A%20%3CB%3E%3CI%3Elogparser%20-h%20-o%3ACHART%3C%2FI%3E%3C%2FB%3E%20will%20give%20you%20a%20chart%20output.%20Here%20are%20different%20options%20for%20chart%20types%20you%20can%20use%3A%20%3CI%3ELineMarkers%2C%20LineStacked%2C%20LineStackedMarkers%2C%20LineStacked100%2C%26nbsp%3B%26nbsp%3B%20LineStacked100Markers%2C%20Line3D%2C%20LineOverlapped3D%2C%20LineStacked3D%2C%20LineStacked1003D%2C%20SmoothLine%2C%20SmoothLineStacked100%2C%20BarClustered%2C%20BarStacked%2C%20BarStacked100%2C%20Bar3D%2C%20BarClustered3D%2C%20BarStacked3D%2C%20BarStacked1003D%2C%20ColumnClustered%2C%20ColumnStacked%2C%20ColumnStacked100%2C%20Column3D%2C%20ColumnClustered3D%2C%20ColumnStacked3D%2C%20ColumnStacked1003D%2C%20Pie%2C%20PieExploded%2C%20PieStacked%2C%20Pie3D%2C%20PieExploded3D%2C%20ScatterMarkers%2C%20ScatterSmoothLine%2C%20ScatterSmoothLine%2C%20AreaStacked3D%2C%20StockHLC%2C%26nbsp%3B%20PolarMarkers%2C%26nbsp%3B%20PolarSmoothLineMarkers%20%5Bdefault%20value%3DLine%5D%3C%2FI%3E%20%3CB%3E%3CSPAN%20style%3D%22color%3A%20%230000ff%22%3EIdentifying%20top%20senders%20to%20your%20system%3C%2FSPAN%3E%3C%2FB%3E%20Using%20the%20integration%20with%20Office%20Web%20Components%20in%20LP%20you%20can%20extract%20the%20top%2010%20senders%20to%20your%20system%3A%20%3CB%3E%3CI%3Elogparser%20%22select%20top%2010%20REVERSEDNS(EXTRACT_PREFIX(remote-endpoint%2C0%2C'%3A'))%20as%20RemoteSendingHost%2C%20count(*)%20as%20Hits%20into%20topsender.gif%20from%20RECV20070608-1.LOG%20group%20by%20RemoteSendingHost%20order%20by%20Hits%20DESC%22%20-i%3ACSV%20-nSkipLines%3A4%26nbsp%3B%20-o%3ACHART%26nbsp%3B%20-chartType%3APieExploded3D%20-chartTitle%3A%22Top%2010%20senders%22%3C%2FI%3E%3C%2FB%3E%20%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Flegacyfs%2Fonline%2Fmedia%2Fthemes%2Fexchange%2Fimages%2F447582_LogParser2_01.jpg%22%20%2F%3E%20So%20far%20so%20good%2C%20but%20I%20can%20hear%20you%20say%3A%20%22This%20is%20great%20but%20this%20is%20going%20to%20take%20forever%20on%20my%20productions%20logs%20so%20how%20do%20I%20optimize%20this%3F%22%20One%20option%20is%20to%20filter%20by%20using%20the%20event%20field%20when%20it%20is%20equal%20to%20'%2B'.%20The%20'%2B'%20in%20the%20event%20field%20identifies%20a%20new%20connection%20so%20it%20will%20just%20happen%20once%20per%20SMTP%20connection.%20That%20being%20said%20this%20can%20still%20take%20some%20time%20especially%20if%20a%20lot%20of%20spammers%20are%20trying%20to%20hit%20the%20servers.%20The%20sample%20bellow%20extracts%20top%20inbound%20connection%20filtered%20where%20event%20equals%20to%20'%2B'%20(as%20the%20plus%20sign%20means%20a%20new%20inbound%20connection)%3A%20%3CB%3E%3CI%3Elogparser%20%22select%20top%2010%20REVERSEDNS(EXTRACT_PREFIX(remote-endpoint%2C0%2C'%3A'))%20as%20RemoteSendingHost%2C%20count(*)%20as%20Hits%20into%20topsender.gif%20from%20RECV*.LOG%20where%20event%3D'%2B'%20group%20by%20RemoteSendingHost%20order%20by%20Hits%20DESC%22%20-i%3ACSV%20-nSkipLines%3A4%26nbsp%3B%20-o%3ACHART%26nbsp%3B%20-chartType%3APieExploded3D%20-chartTitle%3A%22TOP%2010%20senders%22%3C%2FI%3E%3C%2FB%3E%20Next%20step%20is%20to%20be%20able%20to%20narrow%20on%20a%20specific%20time%20frame%20in%20your%20Exchange%202007%20logs.%20The%20table%20bellow%20provides%20the%20LP%20conversion%20expressions%20to%20use%20in%20order%20to%20manipulate%20the%20different%20date%20and%20time%20formats%3A%3CTABLE%20class%3D%22MsoNormalTable%22%20style%3D%22border-collapse%3A%20collapse%22%20cellspacing%3D%220%22%20cellpadding%3D%220%22%20border%3D%220%22%3E%0A%3CTBODY%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22width%3A%2072.9pt%3Bbackground-color%3A%20transparent%3Bborder%3A%20black%201pt%20solid%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%2297%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CB%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3EExtracting%20%3C%2FSPAN%3E%20%3C%2FB%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-top%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20193.5pt%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22258%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CB%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3ELog%20Parser%20expression%20%3C%2FSPAN%3E%20%3C%2FB%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-top%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%201.5in%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22144%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CB%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3EFormat%20%3C%2FSPAN%3E%20%3C%2FB%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left%3A%20black%201pt%20solid%3Bwidth%3A%2072.9pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%2297%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3EDate%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20193.5pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22258%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3EEXTRACT_PREFIX(%5B%23Fields%3A%20date-time%5D%2C0%2C'T')%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%201.5in%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22144%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3EYYYY-MM-DD%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left%3A%20black%201pt%20solid%3Bwidth%3A%2072.9pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%2297%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3ETime%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20193.5pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22258%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3EEXTRACT_PREFIX(TO_STRING(EXTRACT_SUFFIX(%5B%23Fields%3A%20date-time%5D%2C0%2C'T'))%2C0%2C'.')%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%201.5in%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22144%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3EHH%3AMM%3ASS%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left%3A%20black%201pt%20solid%3Bwidth%3A%2072.9pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%2297%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3EDate%20%26amp%3B%20time%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20193.5pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22258%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3ETO_TIMESTAMP%20(%20EXTRACT_PREFIX(TO_STRING(%5B%23Fields%3A%20date-time%5D)%2C0%2C'.')%20%2C%20'yyyy-mm-ddThh%3Amm%3Ass')%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%201.5in%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22144%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3ETO_TIMESTAMP%20(Log%20Parser%20time%20stamp%20type)%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3C%2FTBODY%3E%0A%3C%2FTABLE%3ESo%20returning%20all%20rows%20after%20'2007-10-10%2021%3A46%3A23'%20from%20a%20log%20file%20would%20look%20like%20this%3A%20%3CB%3E%3CI%3Elogparser%20%22select%20*%20from%20RECV.LOG%20where%20TO_TIMESTAMP%20(%20EXTRACT_PREFIX(TO_STRING(%5B%23Fields%3A%20date-time%5D)%2C0%2C'.')%20%2C%20'yyyy-mm-ddThh%3Amm%3Ass')%20%26gt%3B%20TO_TIMESTAMP%20('2007-10-10%2021%3A46%3A23'%2C'yyyy-mm-dd%20hh%3Amm%3Ass')%22%20-i%3ACSV%20-nSkipLines%3A4%20-o%3ADATAGRID%3C%2FI%3E%3C%2FB%3E%20Returning%20all%20rows%20between%202007-05-13%2021%3A00%3A00%20and%20'2007-05-13%2021%3A15%3A00'%20from%20an%20Exchange%202007%20SMTP%20log%20file%20would%20look%20like%20this%3A%20%3CB%3E%3CI%3Elogparser%20%22select%20TO_TIMESTAMP%20(%20EXTRACT_PREFIX(TO_STRING(%5B%23Fields%3A%20date-time%5D)%2C0%2C'.')%2C%20'yyyy-mm-ddThh%3Amm%3Ass')%20as%20DateTime%2C%20EXTRACT_PREFIX(remote-endpoint%2C0%2C'%3A')%20as%20RemoteSending%2C%20data%2C%20context%2C%20case%20TO_INT(%20SUBSTR(DATA%2C0%2C3))%20when%20NULL%20then%200%20else%20TO_INT(SUBSTR(DATA%2C0%2C3))%20end%20as%20RemoteHostReturnCode%20from%20SEND*.log%20where%20RemoteHostReturnCode%20%26gt%3B%20500%20and%20context%20%26lt%3B%26gt%3B%20'Certificate%20thumbprint'%20and%20context%20%26lt%3B%26gt%3B%20'sending%20message'%22%20-i%3ACSV%20-nSkipLines%3A4%20-o%3ADATAGRID%3C%2FI%3E%3C%2FB%3E%20%3CB%3E%3CI%3E%3C%2FI%3E%3C%2FB%3E%20%3CB%3E%3CSPAN%20style%3D%22color%3A%20%230000ff%22%3EIdentifying%20times%20of%20highest%20traffic%3C%2FSPAN%3E%3C%2FB%3E%20Now%20you%20might%20want%20to%20know%20in%20what%20time%20of%20the%20day%20your%20system%20has%20most%20connections%20and%20traffic.%20This%20is%20also%20interesting%20in%20order%20to%20identify%20when%20potential%20spam%20attacks%20have%20occurred.%20In%20order%20to%20draw%20a%20radar%20graph%20of%20global%20total%20SMTP%20inbound%20simultaneous%20connections%20per%20hours%3A%20%3CB%3E%3CI%3Elogparser%20%22SELECT%20QUANTIZE(TO_TIMESTAMP%20(EXTRACT_PREFIX(TO_STRING(EXTRACT_SUFFIX(%5B%23Fields%3A%20date-time%5D%2C0%2C'T'))%2C0%2C'.')%2C%20'hh%3Amm%3Ass')%2C3600)%20AS%20Hour%2C%20COUNT(*)%20AS%20Hits%20INTO%20radar_traffic.gif%20from%20RECV*.log%20where%20event%3D'%2B'%20GROUP%20BY%20Hour%20ORDER%20BY%20Hour%20ASC%22%20-i%3ACSV%20-nSkipLines%3A4%20-o%3ACHART%20-charttype%3ARadarLineFilled%20-charttitle%3A%22%20Global%20total%20SMTP%20inbound%20simultaneous%20connections%20per%20hours%22%3C%2FI%3E%3C%2FB%3E%20%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Flegacyfs%2Fonline%2Fmedia%2Fthemes%2Fexchange%2Fimages%2F447583_LogParser2_02.jpg%22%20%2F%3E%20%3CB%3E%3CSPAN%20style%3D%22color%3A%20%230000ff%22%3EIdentifying%20top%20senders%3C%2FSPAN%3E%3C%2FB%3E%20Now%20let's%20say%20we%20want%20to%20identify%20our%20top%20senders.%20Top%20senders%20are%20usually%20referred%20to%20as%20senders%20that%20are%20sending%20the%20most%20messages.%20So%20let's%20first%20build%20a%20query%20to%20output%20senders%20by%20where%20we%20at%20least%20started%20to%20%22receive%20a%20message%22%3A%20%3CB%3E%3CI%3Elogparser%20%22select%20top%2010%20remote-endpoint%2C%20count(*)%20as%20Hits%20into%20topsender-messages.gif%20from%20RECV*.LOG%20where%20context%3D'receiving%20message'%20group%20by%20remote-endpoint%20order%20by%20Hits%20DESC%22%20-i%3ACSV%20-nSkipLines%3A4%26nbsp%3B%20-o%3ACHART%26nbsp%3B%20-chartType%3APieExploded3D%20-chartTitle%3A%22TOP%2010%20senders%20of%20messages%22%3C%2FI%3E%3C%2FB%3E%20%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Flegacyfs%2Fonline%2Fmedia%2Fthemes%2Fexchange%2Fimages%2F447584_LogParser2_03.jpg%22%20%2F%3E%20But%20this%20doesn't%20mean%20that%20all%20messages%20where%20'accepted'%20because%20in%20one%20SMTP%20connection%20multiple%20SMTP%20messages%20can%20be%20sent%20but%20some%20can%20be%20accepted%20and%20other%20rejected.%20If%20you%20dig%20into%20the%20Exchange%20logs%20you%20will%20find%20that%20the%20%22signature%22%20of%20an%20accepted%20message%20is%20as%20follows%3A%20Data%20field%20starts%20with%20the%20following%20string%3A%20%22250%202.6.0%20%26lt%3B%22%20and%20ends%20with%20the%20following%20string%20%22Queued%20mail%20for%20delivery%22.%20Sample%20query%20to%20dump%20all%20inbound%20queued%20mail%20for%20delivery%3A%20%3CB%3E%3CI%3Elogparser%20%22select%20*%20from%20RECV*.log%20where%20(data%20like%20'%25250%202.6.0%20%26lt%3B%25')%20and%20(data%20like%20'%25Queued%20mail%20for%20delivery%25')%22%20-i%3ACSV%20-nSkipLines%3A4%26nbsp%3B%20-o%3ADATAGRID%3C%2FI%3E%3C%2FB%3E%20Now%20we%20can%20group%20by%20top%20senders%20of%20messages%2C%20note%20we%20are%20removing%20the%20port%20number%20because%20indeed%20a%20same%20host%20can%20connect%20multiple%20times%20in%20a%20day%20but%20using%20different%20remote%20source%20ports.%20Of%20course%20you%20can%20REVERSEDNS%20to%20identify%20(or%20at%20least%20getting%20started%20to%20identify)%20that%20is%20hiding%20behind%20the%20IPs%3A%20%3CB%3E%3CI%3Elogparser%20%22select%20EXTRACT_PREFIX(remote-endpoint%2C0%2C'%3A')%20as%20remote-host%2C%20count(*)%20as%20hits%20from%20RECV*.log%20where%20(data%20like%20'%25250%202.6.0%20%26lt%3B%25')%20and%20(data%20like%20'%25Queued%20mail%20for%20delivery%25')%20group%20by%20remote-host%20order%20by%20hits%20DESC%22%20-i%3ACSV%20-nSkipLines%3A4%26nbsp%3B%20-o%3ADATAGRID%3C%2FI%3E%3C%2FB%3E%20%3CA%3E%3C%2FA%3E%3CB%3E%3CSPAN%20style%3D%22color%3A%20%230000ff%22%3EIdentifying%20top%20email%20rejecting%20IP%20sources%3C%2FSPAN%3E%3C%2FB%3E%20Identifying%20top%20servers%20that%20you%20most%20reject%20mail%20from%20is%20helpful%20to%20help%20saving%20bandwidth.%20If%20a%20server%20is%20sending%20mail%20that%20is%20very%20often%20rejected%2C%20that%20is%20very%20likely%20to%20help%20you%20identify%20potential%20spammers.%20Once%20these%20IP%20sources%20have%20been%20identified%2C%20they%20can%20be%20blocked%20at%20firewall%20level%20and%20will%20help%20against%20consuming%20bandwidth%20by%20unsolicited%20email.%20A%20manual%20check%20should%20be%20performed%20to%20make%20sure%20that%20the%20sending%20server%20is%20indeed%20a%20real%20offender.%20Sample%20exchange%20log%20of%20unsolicited%20mail%20blocked%20by%20exchange%20that%20can%20be%20found%20in%20the%20data%20field%3A%3C%2FP%3E%3CBLOCKQUOTE%3E550%205.7.1%20Message%20rejected%20due%20to%20content%20restrictions%3C%2FBLOCKQUOTE%3EIdentifying%20top%20rejected%20senders%20would%20look%20like%20this%3A%20%3CB%3E%3CI%3Elogparser%20%22select%20EXTRACT_PREFIX(remote-endpoint%2C0%2C'%3A')%20as%20Remote-host%2C%20count%20(*)%20as%20hits%20from%20RECV*.log%20where%20data%20like%20'%25rejected%25'%20group%20by%20Remote-host%20order%20by%20hits%20desc%22%20-i%3ACSV%20-nSkipLines%3A4%26nbsp%3B%20-o%3ADATAGRID%3C%2FI%3E%3C%2FB%3E%20%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Flegacyfs%2Fonline%2Fmedia%2Fthemes%2Fexchange%2Fimages%2F447585_LogParser2_04.jpg%22%20%2F%3E%20As%20you%20can%20see%20in%20the%20example%20above%20the%20same%20sender%2010.0.0.x%20as%20multiple%20outbound%20hosts%20that%20seem%20to%20be%20on%20the%20same%20C%20class...%20A%20wider%20interesting%20search%20would%20be%20to%20look%20at%20550%20return%20codes%3A%20%3CB%3E%3CI%3Elogparser%20%22select%20*%20from%20RECV*.log%26nbsp%3B%20where%20data%20like%20'%25550%20%25'%22%20-i%3ACSV%20-nSkipLines%3A4%26nbsp%3B%20-o%3ADATAGRID%3C%2FI%3E%3C%2FB%3E%20%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Flegacyfs%2Fonline%2Fmedia%2Fthemes%2Fexchange%2Fimages%2F447586_LogParser2_05.jpg%22%20%2F%3E%20As%20you%20can%20see%20from%20results%20of%20that%2C%20550's%20are%20also%20valid%20for%20relay%20attempts.%20So%20the%20following%20query%20will%20help%20you%20identify%20both%20mail%20rejection%20and%20senders%20trying%20to%20relay%20through%20your%20mail%20system%3A%20%3CB%3E%3CI%3Elogparser%20%22select%20EXTRACT_PREFIX(remote-endpoint%2C0%2C'%3A')%20as%20Remote-host%2C%20count%20(*)%20as%20hits%20from%20RECV*.log%20where%20data%20like%20'%25550%20%25'%20group%20by%20Remote-host%20order%20by%20hits%20desc%22%20-i%3ACSV%20-nSkipLines%3A4%26nbsp%3B%20-o%3ADATAGRID%3C%2FI%3E%3C%2FB%3E%20%3CB%3E%3CI%3E%3C%2FI%3E%3C%2FB%3E%20%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Flegacyfs%2Fonline%2Fmedia%2Fthemes%2Fexchange%2Fimages%2F447587_LogParser2_06.jpg%22%20%2F%3E%20Note%20if%20you%20don't%20see%20any%20%22Unable%20to%20relay%22%20attempts%20in%20your%20logs%20it%20is%20very%20likely%20that%3A%3CBLOCKQUOTE%3E-%20You%20have%20a%20smarthost%20upfront%20blocking%20beforehand%20and%20may%20relay%20attempts.%3C%2FBLOCKQUOTE%3EOr%3CBLOCKQUOTE%3E-%20That%20your%20server%20is%20indeed%20relaying%20mail.%3C%2FBLOCKQUOTE%3EThere%20are%20other%20500's%20types%20of%20status%20codes%20such%20as%20504%2C%20535%20and%20so%20on.%20The%20most%20effective%20query%20I%20have%20found%20is%20to%20catch%20all%20numeric%20numbers%20above%20500.%20The%20LP%20query%20would%20look%20like%20this%3A%20%3CB%3E%3CI%3Elogparser%20%22select%20*%26nbsp%3B%20from%20RECV*.log%20where%20TO_INT(%20SUBSTR(DATA%2C0%2C3))%20%26gt%3B%20500%20and%20event%20%3D%20'%26gt%3B'%22%20-i%3ACSV%20-nSkipLines%3A4%26nbsp%3B%20-o%3ADATAGRID%3C%2FI%3E%3C%2FB%3E%20Then%2C%20the%20ultimate%20group%20by%20query%20would%20be%3A%20%3CB%3E%3CI%3Elogparser%20%22select%20EXTRACT_PREFIX(remote-endpoint%2C0%2C'%3A')%20as%20Remote-host%2C%20count%20(*)%20as%20hits%20from%20RECV*.log%20where%20TO_INT(%20SUBSTR(DATA%2C0%2C3))%20%26gt%3B%20500%20and%20event%20%3D%20'%26gt%3B'%20group%20by%20Remote-host%20order%20by%20hits%20desc%22%20-i%3ACSV%20-nSkipLines%3A4%26nbsp%3B%20-o%3ADATAGRID%3C%2FI%3E%3C%2FB%3E%20You%20can%20use%20the%20REVERSEDNS%20function%20on%20top%20of%20that.%20If%20you%20see%20IP%20address%20returned%20instead%20of%20a%20FQDN%2C%20it%20is%20even%20more%20likely%20that%20these%20hosts%20are%20really%20offenders%20because%20they%20didn't%20provide%20a%20reverse%20PTR%20record.%20But%20again%20-%20doing%20a%20reversedns%20function%20on%20huge%20logs%20would%20be%20slow.%20The%20best%20approach%20I%20have%20come%20up%20with%20to%20work%20around%20that%20is%20in%20two%20phases%3A%201.%20As%20shown%20above%2C%20identify%20the%20list%20of%20suspicious%20senders%20with%20the%20query%20and%20dump%20the%20output%20to%20a%20temporary%20log%20file%20such%20as%20the%20following%3A%20%3CB%3E%3CI%3Elogparser%20%22select%20EXTRACT_PREFIX(remote-endpoint%2C0%2C'%3A')%20as%20Remote-host%2C%20count%20(*)%20as%20hits%20into%20SuspiciousSenders.xml%26nbsp%3B%20from%20RECV*.log%20where%20TO_INT(%20SUBSTR(DATA%2C0%2C3))%20%26gt%3B%20500%20and%20event%20%3D%20'%26gt%3B'%20group%20by%20Remote-host%20order%20by%20hits%20desc%22%20-i%3ACSV%20-nSkipLines%3A4%26nbsp%3B%20-o%3AXML%3C%2FI%3E%3C%2FB%3E%202.%20You%20can%20then%20load%20the%20XML%20generated%20file%20as%20below%20and%20apply%20the%20REVERSEDNS%20only%20on%20the%20%22hotspot%22%20(top%20senders)%3A%20%3CB%3E%3CI%3Elogparser%20%22select%20REVERSEDNS(Remote-host)%2C%20hits%20from%26nbsp%3B%20SuspiciousSenders.xml%22%20-i%3AXML%20-o%3ADATAGRID%3C%2FI%3E%3C%2FB%3E%20You%20can%20then%20select%20the%20top%2010%20and%20first%20investigate%20those%3A%20%3CB%3E%3CI%3Elogparser%20%22select%20top%2010%20REVERSEDNS(Remote-host)%2C%20hits%20from%26nbsp%3B%20SuspiciousSenders.xml%22%20-i%3AXML%20-o%3ADATAGRID%3C%2FI%3E%3C%2FB%3E%20%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Flegacyfs%2Fonline%2Fmedia%2Fthemes%2Fexchange%2Fimages%2F447588_LogParser2_07.jpg%22%20%2F%3E%20%3CB%3E%3CSPAN%20style%3D%22color%3A%20%230000ff%22%3EIdentifying%20outbound%20email%20issues%3C%2FSPAN%3E%3C%2FB%3E%20As%20we%20have%20%3CA%20href%3D%22http%3A%2F%2Fblogs.technet.com%2Farchive%2F2007%2F11%2F12%2F447515.aspx%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%20target%3D%22_blank%22%3Ementioned%20previously%3C%2FA%3E%2C%20outbound%20SMTP%20log%20is%20located%20in%3A%20ProtocolLog%5CSmtpSend.%20If%20we%20want%20to%20identify%20outbound%20status%20codes%20we%20first%20need%20to%20parse%20the%20data%20field%20to%20identify%20if%20the%20remote%20host%20has%20accepted%20our%20messages%20and%20as%20the%20Data%20field%20is%20a%20string%20we%20also%20need%20to%20convert%20it%20to%20an%20%22int%22%20(intger)%20type%3A%20%3CB%3E%3CI%3Elogparser%20%22select%20case%20TO_INT(%20SUBSTR(DATA%2C0%2C3))%20when%20NULL%20then%200%20else%20TO_INT(%20SUBSTR(DATA%2C0%2C3))%20end%20as%20RemoteHostReturnCode%20from%20SEND*.log%20%22%20-i%3ACSV%20-nSkipLines%3A4%20-o%3ADATAGRID%3C%2FI%3E%3C%2FB%3E%20We%20are%20filtering%20status%20codes%20above%20400%20as%20we%20want%20to%20have%20both%20deferred%20and%20rejected%20emails.%20For%20rejected%20emails%20only%20you%20can%20filter%20at%20500.%20So%20getting%20detailed%20information%20of%20outbound%20issues%20would%20look%20like%20this%3A%20%3CB%3E%3CI%3Elogparser%20%22select%20EXTRACT_PREFIX(remote-endpoint%2C0%2C'%3A')%20as%20Remote-host%2C%20data%2C%20context%2C%20case%20TO_INT(%20SUBSTR(DATA%2C0%2C3))%20when%20NULL%20then%200%20else%20TO_INT(%20SUBSTR(DATA%2C0%2C3))%20end%20as%20RemoteHostReturnCode%20from%20SEND*.log%20where%20RemoteHostReturnCode%20%26gt%3B%20400%22%20-i%3ACSV%20-nSkipLines%3A4%20-o%3ADATAGRID%3C%2FI%3E%3C%2FB%3E%20That%20being%20said%2C%20the%20above%20might%20get%20some%20false%20positives%20so%20a%20better%20query%20looks%20like%20this%3A%20%3CB%3E%3CI%3Elogparser%20%22select%20TO_TIMESTAMP%20(%20EXTRACT_PREFIX(TO_STRING(%5B%23Fields%3A%20date-time%5D)%2C0%2C'.')%2C%20'yyyy-mm-ddThh%3Amm%3Ass')%20as%20DateTime%2C%20EXTRACT_PREFIX(remote-endpoint%2C0%2C'%3A')%20as%20Remote-host%2C%20data%2C%20context%2C%20case%20TO_INT(%20SUBSTR(DATA%2C0%2C3))%20when%20NULL%20then%200%20else%20TO_INT(SUBSTR(DATA%2C0%2C3))%20end%20as%20RemoteHostReturnCode%20from%20SEND*.log%20where%20RemoteHostReturnCode%20%26gt%3B%20400%20and%20context%20%26lt%3B%26gt%3B%20'Certificate%20thumbprint'%20and%20context%20%26lt%3B%26gt%3B%20'sending%20message'%22%20-i%3ACSV%20-nSkipLines%3A4%20-o%3ADATAGRID%3C%2FI%3E%3C%2FB%3E%20Now%20again%20you%20can%20use%20the%20two%20step%20approach%20as%20mentioned%20above%20to%20dump%20the%20results%20into%20an%20.XML%20log%20file%3A%20%3CB%3E%3CI%3E%3C%2FI%3E%3C%2FB%3E%20%3CB%3E%3CI%3Elogparser%20%22select%20EXTRACT_PREFIX(remote-endpoint%2C0%2C'%3A')%20as%20Remote-host%2C%20count(*)%20as%20hits%20into%20SendingIssues.xml%20from%20SEND*.log%20where%20TO_INT(%20SUBSTR(DATA%2C0%2C3))%20%26gt%3B%20400%20and%20context%20%26lt%3B%26gt%3B%20'Certificate%20thumbprint'%20and%20context%20%26lt%3B%26gt%3B%20'sending%20message'%20group%20by%20Remote-host%20order%20by%20hits%20desc%22%20-i%3ACSV%20-nSkipLines%3A4%20-o%3AXML%3C%2FI%3E%3C%2FB%3E%20%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Flegacyfs%2Fonline%2Fmedia%2Fthemes%2Fexchange%2Fimages%2F447589_LogParser2_08.jpg%22%20%2F%3E%20And%20then%20group%20by%20and%20%22reversedns%22%20on%20it%3A%20%3CB%3E%3CI%3Elogparser%20%22select%20REVERSEDNS(Remote-host)%2C%20hits%20from%26nbsp%3B%20SendingIssues.xml%22%20-i%3AXML%20-o%3ADATAGRID%3C%2FI%3E%3C%2FB%3E%20Based%20on%20the%20above%20queries%2C%20the%20following%20one%20will%20build%20a%20table%20of%20top%20rejection%20errors%20by%20type%20and%20number%20of%20hits%3A%20%3CB%3E%3CI%3Elogparser%20%22select%20case%20TO_INT(%20SUBSTR(DATA%2C0%2C3))%20when%20NULL%20then%200%20else%20TO_INT(%20SUBSTR(DATA%2C0%2C3))%20end%20as%20RemoteHostReturnCode%2C%20data%2C%20count%20(*)%20as%20hits%20from%20SEND*.log%20where%20%3CA%3ERemoteHostReturnCode%3C%2FA%3E%20%26gt%3B%20400%20and%20context%20%26lt%3B%26gt%3B%20'Certificate%20thumbprint'%20and%20context%20%26lt%3B%26gt%3B%20'sending%20message'%20group%20by%20RemoteHostReturnCode%2C%20data%20order%20by%20hits%20desc%22%20-i%3ACSV%20-nSkipLines%3A4%20-o%3ADATAGRID%3C%2FI%3E%3C%2FB%3E%3CTABLE%20class%3D%22MsoNormalTable%22%20style%3D%22margin%3A%20auto%20auto%20auto%202.75pt%3Bwidth%3A%2073.1%25%3Bborder-collapse%3A%20collapse%22%20cellspacing%3D%220%22%20cellpadding%3D%220%22%20width%3D%2273%25%22%20border%3D%220%22%3E%0A%3CTBODY%3E%0A%3CTR%20style%3D%22height%3A%2015pt%22%3E%0A%3CTD%20style%3D%22background%3A%20yellow%3Bwidth%3A%20105.75pt%3Bheight%3A%2015pt%3Bborder%3A%20windowtext%201pt%20solid%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%22141%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%22%3E%3CB%3E%3CI%3E%3CSPAN%20lang%3D%22FR%22%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3ERemoteHostReturnCode%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FI%3E%3C%2FB%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-top%3A%20windowtext%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bbackground%3A%20yellow%3Bwidth%3A%20194.55pt%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%22259%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%22%3E%3CB%3E%3CI%3E%3CSPAN%20lang%3D%22FR%22%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3EData%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FI%3E%3C%2FB%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-top%3A%20windowtext%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bbackground%3A%20yellow%3Bwidth%3A%2046.95pt%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%2263%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%22%3E%3CB%3E%3CI%3E%3CSPAN%20lang%3D%22FR%22%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3EHits%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FI%3E%3C%2FB%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%20style%3D%22height%3A%2015pt%22%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-left%3A%20windowtext%201pt%20solid%3Bwidth%3A%20105.75pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%22141%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%3Btext-align%3A%20center%22%20align%3D%22center%22%3E%3CSPAN%20lang%3D%22FR%22%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3E554%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20194.55pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%22259%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%22%3E%3CSPAN%20lang%3D%22FR%22%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3E554-%20(RTR%3ADU)%3CSPAN%3E%26nbsp%3B%20%3C%2FSPAN%3E%3CA%20href%3D%22http%3A%2F%2Fpostmaster.contoso.com%2Ferrors%2Fyyy.html%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttp%3A%2F%2Fpostmaster.contoso.com%2Ferrors%2Fyyy.html%3C%2FA%3E%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%2046.95pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%2263%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%3Btext-align%3A%20center%22%20align%3D%22center%22%3E%3CSPAN%20lang%3D%22FR%22%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3E1595%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%20style%3D%22height%3A%2015pt%22%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-left%3A%20windowtext%201pt%20solid%3Bwidth%3A%20105.75pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%22141%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%3Btext-align%3A%20center%22%20align%3D%22center%22%3E%3CSPAN%20lang%3D%22FR%22%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3E550%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20194.55pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%22259%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%22%3E%3CSPAN%20lang%3D%22FR%22%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3E550%20Desole%20votre%20serveur%20de%20messagerie%20etant%20identifie%20comme%20generateur%20de%20messages%20non%20sollicites.%20Votre%20message%20ne%20peut%20etre%20delivre.%20Veuillez%20contacter%20votre%20administrateur%20systeme.%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%2046.95pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%2263%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%3Btext-align%3A%20center%22%20align%3D%22center%22%3E%3CSPAN%20lang%3D%22FR%22%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3E653%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%20style%3D%22height%3A%2015pt%22%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-left%3A%20windowtext%201pt%20solid%3Bwidth%3A%20105.75pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%22141%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%3Btext-align%3A%20center%22%20align%3D%22center%22%3E%3CSPAN%20lang%3D%22FR%22%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3E451%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20194.55pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%22259%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%22%3E%3CSPAN%20lang%3D%22FR%22%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3E451%20Message%20temporarily%20deferred%20-%20%5B160%5D%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%2046.95pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%2263%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%3Btext-align%3A%20center%22%20align%3D%22center%22%3E%3CSPAN%20lang%3D%22FR%22%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3E563%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%20style%3D%22height%3A%2015pt%22%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-left%3A%20windowtext%201pt%20solid%3Bwidth%3A%20105.75pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%22141%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%3Btext-align%3A%20center%22%20align%3D%22center%22%3E%3CSPAN%20lang%3D%22FR%22%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3E421%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20194.55pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%22259%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%22%3E%3CSPAN%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3E421%20Message%20from%20(mail.contoso.com)%20temporarily%20deferred%20-%204.16.50.%20Please%20refer%20to%20%3CA%20href%3D%22http%3A%2F%2Fmail.contoso.com%2Fdefer.html%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttp%3A%2F%2Fmail.contoso.com%2Fdefer.html%3C%2FA%3E%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%2046.95pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%2263%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%3Btext-align%3A%20center%22%20align%3D%22center%22%3E%3CSPAN%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3E498%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%20style%3D%22height%3A%2015pt%22%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-left%3A%20windowtext%201pt%20solid%3Bwidth%3A%20105.75pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%22141%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%3Btext-align%3A%20center%22%20align%3D%22center%22%3E%3CSPAN%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3E550%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20194.55pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%22259%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%22%3E%3CSPAN%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3E550%20DY-001%20Mail%20rejected%20by%20this%20domain%20for%20policy%20reasons.%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%2046.95pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%2263%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%3Btext-align%3A%20center%22%20align%3D%22center%22%3E%3CSPAN%20lang%3D%22FR%22%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3E223%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%20style%3D%22height%3A%2015pt%22%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-left%3A%20windowtext%201pt%20solid%3Bwidth%3A%20105.75pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%22141%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%3Btext-align%3A%20center%22%20align%3D%22center%22%3E%3CSPAN%20lang%3D%22FR%22%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3E550%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20194.55pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%22259%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%22%3E%3CSPAN%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3E550-5.7.1%20%5Bmail.contoso.com%5D%20The%20IP%20you're%20using%20to%20send%20email%20is%20not%20authorized%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%2046.95pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%2263%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%3Btext-align%3A%20center%22%20align%3D%22center%22%3E%3CSPAN%20lang%3D%22FR%22%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3E206%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%20style%3D%22height%3A%2015pt%22%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-left%3A%20windowtext%201pt%20solid%3Bwidth%3A%20105.75pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%22141%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%3Btext-align%3A%20center%22%20align%3D%22center%22%3E%3CSPAN%20lang%3D%22FR%22%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3E550%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20194.55pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%22259%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%22%3E%3CSPAN%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3E550-5.7.1%20To%20send%20email%20directly%20to%20our%20servers%20please%20use..%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%2046.95pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%2263%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%3Btext-align%3A%20center%22%20align%3D%22center%22%3E%3CSPAN%20lang%3D%22FR%22%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3E198%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%20style%3D%22height%3A%2015pt%22%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-left%3A%20windowtext%201pt%20solid%3Bwidth%3A%20105.75pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%22141%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%3Btext-align%3A%20center%22%20align%3D%22center%22%3E%3CSPAN%20lang%3D%22FR%22%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3E550%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20194.55pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%22259%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%22%3E%3CSPAN%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3E550%205.7.1%20Service%20unavailable%3B%20Client%20host%20%5Bmail.contoso.com%5D%20blocked%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%2046.95pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%2263%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%3Btext-align%3A%20center%22%20align%3D%22center%22%3E%3CSPAN%20lang%3D%22FR%22%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3E187%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%20style%3D%22height%3A%2015pt%22%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-left%3A%20windowtext%201pt%20solid%3Bwidth%3A%20105.75pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%22141%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%3Btext-align%3A%20center%22%20align%3D%22center%22%3E%3CSPAN%20lang%3D%22FR%22%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3E554%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20194.55pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%22259%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%22%3E%3CSPAN%20lang%3D%22FR%22%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3E554%20TRANSACTION%20FAILED%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%2046.95pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%2263%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%3Btext-align%3A%20center%22%20align%3D%22center%22%3E%3CSPAN%20lang%3D%22FR%22%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3E108%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%20style%3D%22height%3A%2015pt%22%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-left%3A%20windowtext%201pt%20solid%3Bwidth%3A%20105.75pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%22141%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%3Btext-align%3A%20center%22%20align%3D%22center%22%3E%3CSPAN%20lang%3D%22FR%22%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3E554%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20194.55pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%22259%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%22%3E%3CSPAN%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3E554-%3A%20(RTR%3AGE)%20http%3A%2F%2F%20postmaster.contoso.com%2Ferrors%2Fyyy.html%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%2046.95pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%2263%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%3Btext-align%3A%20center%22%20align%3D%22center%22%3E%3CSPAN%20lang%3D%22FR%22%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3E78%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%20style%3D%22height%3A%2015pt%22%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-left%3A%20windowtext%201pt%20solid%3Bwidth%3A%20105.75pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%22141%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%3Btext-align%3A%20center%22%20align%3D%22center%22%3E%3CSPAN%20lang%3D%22FR%22%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3E550%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20194.55pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%22259%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%22%3E%3CSPAN%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3E550%20Mail%20rejected.%20Contact%20your%20ISP%20to%20determine%20which%20authorized%20SMTP%20relay%20servers%20to%20send%20your%20mail%20through%20(or)%20request%20a%20static%20and%20dedicated%20IP%20before%20attempting%20to%20send%20mail.%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%2046.95pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%2263%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%3Btext-align%3A%20center%22%20align%3D%22center%22%3E%3CSPAN%20lang%3D%22FR%22%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3E76%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%20style%3D%22height%3A%2015pt%22%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-left%3A%20windowtext%201pt%20solid%3Bwidth%3A%20105.75pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%22141%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%3Btext-align%3A%20center%22%20align%3D%22center%22%3E%3CSPAN%20lang%3D%22FR%22%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3E502%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20194.55pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%22259%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%22%3E%3CSPAN%20lang%3D%22FR%22%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3E502%20Error%3A%20command%20not%20implemented%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%2046.95pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%2263%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%3Btext-align%3A%20center%22%20align%3D%22center%22%3E%3CSPAN%20lang%3D%22FR%22%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3E1%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%20style%3D%22height%3A%2015pt%22%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-left%3A%20windowtext%201pt%20solid%3Bwidth%3A%20105.75pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%22141%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%3Btext-align%3A%20center%22%20align%3D%22center%22%3E%3CSPAN%20lang%3D%22FR%22%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3E550%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20194.55pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%22259%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%22%3E%3CSPAN%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3E550%205.7.1%20Rejected%3A%20mail.contoso.com%20listed%20as%20spam%20source%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20windowtext%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%2046.95pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20windowtext%201pt%20solid%3Bheight%3A%2015pt%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%203.5pt%200in%203.5pt%22%20valign%3D%22bottom%22%20nowrap%3D%22nowrap%22%20width%3D%2263%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%200pt%3Btext-align%3A%20center%22%20align%3D%22center%22%3E%3CSPAN%20lang%3D%22FR%22%20style%3D%22color%3A%20black%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%22%3E1%20%3C%2FSPAN%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3C%2FTBODY%3E%0A%3C%2FTABLE%3E%3CB%3E%3CSPAN%20style%3D%22color%3A%20%230000ff%22%3EContent%20agent%20filtering%20log%3C%2FSPAN%3E%3C%2FB%3E%20Content%20Agent%20Filtering%20files%20are%20very%20similar%20in%20format%20and%20structure%20to%20SMTP%20inbound%20protocol%20log%20files%20so%20same%20tricks%20apply.%20They%20can%20be%20parsed%20by%20LP%20using%20the%20same%20base%20line%20as%20above.%20They%20really%20help%20understanding%20mail%20rejection%20reasons.%20Table%20of%20fields%3A%3CTABLE%20class%3D%22MsoNormalTable%22%20style%3D%22border-collapse%3A%20collapse%22%20cellspacing%3D%220%22%20cellpadding%3D%220%22%20border%3D%220%22%3E%0A%3CTBODY%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22width%3A%20114.7pt%3Bbackground-color%3A%20transparent%3Bborder%3A%20black%201pt%20solid%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22153%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CB%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3EField%20%3C%2FSPAN%3E%20%3C%2FB%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-top%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20111.75pt%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22149%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CB%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3EMost%20useful%20(in%20our%20examples)%20%3C%2FSPAN%3E%20%3C%2FB%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left%3A%20black%201pt%20solid%3Bwidth%3A%20114.7pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22153%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3ETimestamp%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20111.75pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22149%22%3E%3CP%20class%3D%22MsoListParagraph%22%20style%3D%22margin%3A%200in%200in%200pt%200.5in%3Btext-indent%3A%20-0.25in%3Bline-height%3A%20normal%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3Ex%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left%3A%20black%201pt%20solid%3Bwidth%3A%20114.7pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22153%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3ESessionId%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20111.75pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22149%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3E%26nbsp%3B%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left%3A%20black%201pt%20solid%3Bwidth%3A%20114.7pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22153%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3ELocalEndpoint%26nbsp%3B%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20111.75pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22149%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3E%26nbsp%3B%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left%3A%20black%201pt%20solid%3Bwidth%3A%20114.7pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22153%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3ERemoteEndpoint%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20111.75pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22149%22%3E%3CP%20class%3D%22MsoListParagraph%22%20style%3D%22margin%3A%200in%200in%200pt%200.5in%3Btext-indent%3A%20-0.25in%3Bline-height%3A%20normal%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3Ex%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left%3A%20black%201pt%20solid%3Bwidth%3A%20114.7pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22153%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3EEnteredOrgFromIP%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20111.75pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22149%22%3E%3CP%20class%3D%22MsoListParagraph%22%20style%3D%22margin%3A%200in%200in%200pt%200.5in%3Btext-indent%3A%20-0.25in%3Bline-height%3A%20normal%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3Ex%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left%3A%20black%201pt%20solid%3Bwidth%3A%20114.7pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22153%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3EMessageId%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20111.75pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22149%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3E%26nbsp%3B%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left%3A%20black%201pt%20solid%3Bwidth%3A%20114.7pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22153%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3EP1FromAddress%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20111.75pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22149%22%3E%3CP%20class%3D%22MsoListParagraph%22%20style%3D%22margin%3A%200in%200in%200pt%200.5in%3Btext-indent%3A%20-0.25in%3Bline-height%3A%20normal%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3Ex%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left%3A%20black%201pt%20solid%3Bwidth%3A%20114.7pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22153%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3EP2FromAddresses%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20111.75pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22149%22%3E%3CP%20class%3D%22MsoListParagraph%22%20style%3D%22margin%3A%200in%200in%200pt%200.5in%3Btext-indent%3A%20-0.25in%3Bline-height%3A%20normal%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3Ex%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left%3A%20black%201pt%20solid%3Bwidth%3A%20114.7pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22153%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3ERecipient%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20111.75pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22149%22%3E%3CP%20class%3D%22MsoListParagraph%22%20style%3D%22margin%3A%200in%200in%200pt%200.5in%3Btext-indent%3A%20-0.25in%3Bline-height%3A%20normal%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3Ex%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left%3A%20black%201pt%20solid%3Bwidth%3A%20114.7pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22153%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3ENumRecipients%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20111.75pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22149%22%3E%3CP%20class%3D%22MsoListParagraph%22%20style%3D%22margin%3A%200in%200in%200pt%200.5in%3Btext-indent%3A%20-0.25in%3Bline-height%3A%20normal%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3Ex%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left%3A%20black%201pt%20solid%3Bwidth%3A%20114.7pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22153%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3EAgent%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20111.75pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22149%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3E%26nbsp%3B%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left%3A%20black%201pt%20solid%3Bwidth%3A%20114.7pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22153%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3EEvent%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20111.75pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22149%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3E%26nbsp%3B%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left%3A%20black%201pt%20solid%3Bwidth%3A%20114.7pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22153%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3EAction%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20111.75pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22149%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3E%26nbsp%3B%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left%3A%20black%201pt%20solid%3Bwidth%3A%20114.7pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22153%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3ESmtpResponse%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20111.75pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22149%22%3E%3CP%20class%3D%22MsoListParagraph%22%20style%3D%22margin%3A%200in%200in%200pt%200.5in%3Btext-indent%3A%20-0.25in%3Bline-height%3A%20normal%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3Ex%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left%3A%20black%201pt%20solid%3Bwidth%3A%20114.7pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22153%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3EReason%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20111.75pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22149%22%3E%3CP%20class%3D%22MsoListParagraph%22%20style%3D%22margin%3A%200in%200in%200pt%200.5in%3Btext-indent%3A%20-0.25in%3Bline-height%3A%20normal%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3Ex%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left%3A%20black%201pt%20solid%3Bwidth%3A%20114.7pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22153%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3EReasonData%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20111.75pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22149%22%3E%3CP%20class%3D%22MsoListParagraph%22%20style%3D%22margin%3A%200in%200in%200pt%200.5in%3Btext-indent%3A%20-0.25in%3Bline-height%3A%20normal%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3Ex%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3C%2FTBODY%3E%0A%3C%2FTABLE%3ESimilar%20to%20examples%20mentioned%20earlier%2C%20the%20baseline%20Log%20Parser%20query%20for%20AGENT%20logs%20will%20look%20like%20this%3A%20%3CB%3E%3CI%3Elogparser%20%22select%20*%20from%20AGENT*.log%20%22%20-i%3ACSV%20-nSkipLines%3A4%26nbsp%3B%20-o%3ADATAGRID%3C%2FI%3E%3C%2FB%3E%20In%20order%20to%20get%20all%20types%20of%20rejection%20reasons%20I%20have%20came%20up%20with%20the%20bellow%20query%3A%20%3CB%3E%3CI%3Elogparser%20%22select%20case%20TO_INT(ReasonData)%20when%20NULL%20then%2010%20else%20ReasonData%20end%20as%20ReasonData2%2C%20count(*)%20as%20hits%20into%20agentreasonspread.gif%20from%20AGENT*.log%20group%20by%20ReasonData2%20order%20by%20hits%20desc%22%20-i%3ACSV%20-nSkipLines%3A4%26nbsp%3B%20-o%3ACHART%26nbsp%3B%20-chartType%3APieExploded3D%20-chartTitle%3A%22Agent%20reason%20spread%22%20-e%20200%3C%2FI%3E%3C%2FB%3E%20%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Flegacyfs%2Fonline%2Fmedia%2Fthemes%2Fexchange%2Fimages%2F447590_LogParser2_09.jpg%22%20%2F%3E%3CBLOCKQUOTE%3E-%200%20is%20accepted%20content%3C%2FBLOCKQUOTE%3E%0A%3CBLOCKQUOTE%3E-%20Everything%20else%20is%20rejected%20content%3C%2FBLOCKQUOTE%3EThis%20gives%20a%20great%20idea%20of%20the%20amount%20of%20rejected%20mail%20by%20a%20server.%20%3CB%3E%3CSPAN%20style%3D%22color%3A%20%230000ff%22%3EMessage%20tracking%20log%3C%2FSPAN%3E%3C%2FB%3E%20This%20log%20is%20self%20explanatory%20and%20is%20the%20best%20place%20to%20look%20at%20when%20one%20is%20trying%20to%20understand%20what%20goes%20in%20and%20out%20of%20the%20system%2C%20especially%20when%20multiple%20routing%20connectors%20are%20available.%20It%20also%20keeps%20tracks%20of%20all%20message%20subjects%20that%20go%20through%20the%20server.%26nbsp%3B%20So%20when%20message%20routing%20or%20history%20is%20in%20question%2C%20this%20is%20the%20place%20to%20go%20to.%20Again%20same%20LP%20base%20line%20query%20applies%3A%20%3CB%3E%3CI%3Elogparser%20%22select%20*%20from%20AGENT*.log%20%22%20-i%3ACSV%20-nSkipLines%3A4%26nbsp%3B%20-o%3ADATAGRID%3C%2FI%3E%3C%2FB%3E%20%3CB%3E%3CI%3E%3C%2FI%3E%3C%2FB%3E%3CTABLE%20class%3D%22MsoNormalTable%22%20style%3D%22border-collapse%3A%20collapse%22%20cellspacing%3D%220%22%20cellpadding%3D%220%22%20border%3D%220%22%3E%0A%3CTBODY%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22width%3A%20144.9pt%3Bbackground-color%3A%20transparent%3Bborder%3A%20black%201pt%20solid%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22193%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CB%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3EField%20%3C%2FSPAN%3E%20%3C%2FB%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-top%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20117pt%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22156%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CB%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3EMost%20useful%20(in%20our%20examples)%20%3C%2FSPAN%3E%20%3C%2FB%3E%3C%2FP%3E%0A%26nbsp%3B%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left%3A%20black%201pt%20solid%3Bwidth%3A%20144.9pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22193%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3Edate-time%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20117pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22156%22%3E%3CP%20class%3D%22MsoListParagraph%22%20style%3D%22margin%3A%200in%200in%200pt%200.5in%3Btext-indent%3A%20-0.25in%3Bline-height%3A%20normal%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3Ex%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left%3A%20black%201pt%20solid%3Bwidth%3A%20144.9pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22193%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3Eclient-ip%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20117pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22156%22%3E%3CP%20class%3D%22MsoListParagraph%22%20style%3D%22margin%3A%200in%200in%200pt%200.5in%3Btext-indent%3A%20-0.25in%3Bline-height%3A%20normal%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3Ex%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left%3A%20black%201pt%20solid%3Bwidth%3A%20144.9pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22193%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3Eclient-hostname%26nbsp%3B%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20117pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22156%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3E%26nbsp%3B%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left%3A%20black%201pt%20solid%3Bwidth%3A%20144.9pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22193%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3Eserver-ip%26nbsp%3B%26nbsp%3B%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20117pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22156%22%3E%3CP%20class%3D%22MsoListParagraph%22%20style%3D%22margin%3A%200in%200in%200pt%200.5in%3Btext-indent%3A%20-0.25in%3Bline-height%3A%20normal%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3Ex%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left%3A%20black%201pt%20solid%3Bwidth%3A%20144.9pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22193%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3Eserver-hostname%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20117pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22156%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3E%26nbsp%3B%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left%3A%20black%201pt%20solid%3Bwidth%3A%20144.9pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22193%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3Esource-context%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20117pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22156%22%3E%3CP%20class%3D%22MsoListParagraph%22%20style%3D%22margin%3A%200in%200in%200pt%200.5in%3Btext-indent%3A%20-0.25in%3Bline-height%3A%20normal%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3Ex%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left%3A%20black%201pt%20solid%3Bwidth%3A%20144.9pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22193%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3Econnector-id%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20117pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22156%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3E%26nbsp%3B%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left%3A%20black%201pt%20solid%3Bwidth%3A%20144.9pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22193%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3Esource%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20117pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22156%22%3E%3CP%20class%3D%22MsoListParagraph%22%20style%3D%22margin%3A%200in%200in%200pt%200.5in%3Btext-indent%3A%20-0.25in%3Bline-height%3A%20normal%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3Ex%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left%3A%20black%201pt%20solid%3Bwidth%3A%20144.9pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22193%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3Eevent-id%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20117pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22156%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3E%26nbsp%3B%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left%3A%20black%201pt%20solid%3Bwidth%3A%20144.9pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22193%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3Einternal-message-id%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20117pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22156%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3E%26nbsp%3B%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left%3A%20black%201pt%20solid%3Bwidth%3A%20144.9pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22193%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3Emessage-id%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20117pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22156%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3E%26nbsp%3B%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left%3A%20black%201pt%20solid%3Bwidth%3A%20144.9pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22193%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3Erecipient-address%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20117pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22156%22%3E%3CP%20class%3D%22MsoListParagraph%22%20style%3D%22margin%3A%200in%200in%200pt%200.5in%3Btext-indent%3A%20-0.25in%3Bline-height%3A%20normal%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3Ex%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left%3A%20black%201pt%20solid%3Bwidth%3A%20144.9pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22193%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3Erecipient-status%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20117pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22156%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3E%26nbsp%3B%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left%3A%20black%201pt%20solid%3Bwidth%3A%20144.9pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22193%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3Etotal-bytes%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20117pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22156%22%3E%3CP%20class%3D%22MsoListParagraph%22%20style%3D%22margin%3A%200in%200in%200pt%200.5in%3Btext-indent%3A%20-0.25in%3Bline-height%3A%20normal%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3Ex%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left%3A%20black%201pt%20solid%3Bwidth%3A%20144.9pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22193%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3Erecipient-count%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20117pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22156%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3E%26nbsp%3B%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left%3A%20black%201pt%20solid%3Bwidth%3A%20144.9pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22193%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3Erelated-recipient-address%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20117pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22156%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3E%26nbsp%3B%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left%3A%20black%201pt%20solid%3Bwidth%3A%20144.9pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22193%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3Ereference%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20117pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22156%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3E%26nbsp%3B%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left%3A%20black%201pt%20solid%3Bwidth%3A%20144.9pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22193%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3Emessage-subject%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20117pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22156%22%3E%3CP%20class%3D%22MsoListParagraph%22%20style%3D%22margin%3A%200in%200in%200pt%200.5in%3Btext-indent%3A%20-0.25in%3Bline-height%3A%20normal%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3Ex%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left%3A%20black%201pt%20solid%3Bwidth%3A%20144.9pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22193%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3Esender-address%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20117pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22156%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3E%26nbsp%3B%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left%3A%20black%201pt%20solid%3Bwidth%3A%20144.9pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22193%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3Ereturn-path%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20117pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22156%22%3E%3CP%20class%3D%22MsoListParagraph%22%20style%3D%22margin%3A%200in%200in%200pt%200.5in%3Btext-indent%3A%20-0.25in%3Bline-height%3A%20normal%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3Ex%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left%3A%20black%201pt%20solid%3Bwidth%3A%20144.9pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22193%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3Emessage-info%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22border-right%3A%20black%201pt%20solid%3Bborder-left-color%3A%20%23f0f0f0%3Bwidth%3A%20117pt%3Bborder-top-color%3A%20%23f0f0f0%3Bborder-bottom%3A%20black%201pt%20solid%3Bbackground-color%3A%20transparent%3Bpadding%3A%200in%205.4pt%200in%205.4pt%22%20valign%3D%22top%22%20width%3D%22156%22%3E%3CP%20class%3D%22MsoNormal%22%20style%3D%22margin%3A%200in%200in%2010pt%3Bline-height%3A%20115%25%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3Bline-height%3A%20115%25%3Bfont-family%3A%20'Verdana'%2C'sans-serif'%22%3E%26nbsp%3B%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3C%2FTBODY%3E%0A%3C%2FTABLE%3EAs%20you%20can%20see%2C%20this%20log%20provides%20valuable%20information%20around%20message%20bytes.%20For%20example%20-%20a%20same%20message-id%20can%20generate%20several%20raws%20(at%20different%20steps)%20and%20generate%20different%20total-bytes%20size%20at%20each%20step.%20As%20we%20explained%20above%20it%20is%20also%20useful%20to%20understand%20mail%20flow%20between%20hosts.%20The%20following%20query%20will%20help%20you%20identify%20the%20top%20used%20connectors%2C%20this%20is%20data%20is%20extremely%20interesting%20when%20dealing%20with%20complex%20topologies%3A%20%3CB%3E%3CI%3Elogparser%20%22select%20connector-id%2C%20count%20(*)%20as%20Hits%20from%20MSGT*.log%20group%20by%20connector-id%20order%20by%20hits%20desc%22%20-i%3ACSV%20-nSkipLines%3A4%3C%2FI%3E%3C%2FB%3E%20I%20hope%20this%20document%20has%20provided%20you%20some%20hints%20on%20how%20LP%20can%20help%20you%20in%20parsing%20new%20Exchange%202007%20transport%20logs!%20%3CA%3E%3C%2FA%3E%20%3CSTRONG%3E%3CSPAN%20style%3D%22color%3A%20%230000ff%22%3EAdditional%20reading%3C%2FSPAN%3E%3C%2FSTRONG%3E%20How%20to%20Configure%20Protocol%20Logging%20on%20Exchange%202007%3A%20%3CA%20href%3D%22http%3A%2F%2Ftechnet.microsoft.com%2Fen-us%2Flibrary%2Fc81cac9c-b990-492a-b899-5be8d08a6068.aspx%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%20target%3D%22_blank%22%3Ehttp%3A%2F%2Ftechnet.microsoft.com%2Fen-us%2Flibrary%2Fc81cac9c-b990-492a-b899-5be8d08a6068.aspx%3C%2FA%3E%20The%20Office%20Web%20Components%20(for%20Log%20Parser)%20can%20be%20downloaded%20at%3A%20%3CA%20href%3D%22http%3A%2F%2Fwww.microsoft.com%2Fdownloads%2Fdetails.aspx%3FFamilyId%3D7287252C-402E-4F72-97A5-E0FD290D4B76%26amp%3Bdisplaylang%3Den%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%20target%3D%22_blank%22%3Ehttp%3A%2F%2Fwww.microsoft.com%2Fdownloads%2Fdetails.aspx%3FFamilyId%3D7287252C-402E-4F72-97A5-E0FD290D4B76%26amp%3Bdisplaylang%3Den%3C%2FA%3E%20Log%20Parser%3A%20%3CA%20href%3D%22http%3A%2F%2Fwww.microsoft.com%2Fdownloads%2Fdetails.aspx%3FFamilyID%3D890cd06b-abf8-4c25-91b2-f8d975cf8c07%26amp%3Bdisplaylang%3Den%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%20target%3D%22_blank%22%3Ehttp%3A%2F%2Fwww.microsoft.com%2Fdownloads%2Fdetails.aspx%3FFamilyID%3D890cd06b-abf8-4c25-91b2-f8d975cf8c07%26amp%3Bdisplaylang%3Den%3C%2FA%3E%20I%20would%20like%20to%20thank%20Jeffrey%20A.%20Johnson%20and%20Nino%20Bilic%20for%20their%20help%20in%20writing%2C%20testing%20and%20reviewing%20this!%20-%20Julien%20Clauzel%3C%2FLINGO-BODY%3E

This is a second in my series of posts that deal with using Log Parser tool to analyze your Exchange 2007 transport logs. For the first post, please go here. I have written this blog post in a way that I walk you through building more and more complex Log Parser queries, which I hope will help you with learning how to build your own queries. Log Parser (also referred to as LP in this blog post) can take advantage of Office Web Components to draw charts of your mail flow information. To download the Office Web Components, please go here: http://www.microsoft.com/downloads/details.aspx?FamilyID=7287252C-402E-4F72-97A5-E0FD290D4B76&displa... When installed, you can use the integration of LP and Office Web Components. For example, typing: logparser -h -o:CHART will give you a chart output. Here are different options for chart types you can use: LineMarkers, LineStacked, LineStackedMarkers, LineStacked100,   LineStacked100Markers, Line3D, LineOverlapped3D, LineStacked3D, LineStacked1003D, SmoothLine, SmoothLineStacked100, BarClustered, BarStacked, BarStacked100, Bar3D, BarClustered3D, BarStacked3D, BarStacked1003D, ColumnClustered, ColumnStacked, ColumnStacked100, Column3D, ColumnClustered3D, ColumnStacked3D, ColumnStacked1003D, Pie, PieExploded, PieStacked, Pie3D, PieExploded3D, ScatterMarkers, ScatterSmoothLine, ScatterSmoothLine, AreaStacked3D, StockHLC,  PolarMarkers,  PolarSmoothLineMarkers [default value=Line] Identifying top senders to your system Using the integration with Office Web Components in LP you can extract the top 10 senders to your system: logparser "select top 10 REVERSEDNS(EXTRACT_PREFIX(remote-endpoint,0,':')) as RemoteSendingHost, count(*) as Hits into topsender.gif from RECV20070608-1.LOG group by RemoteSendingHost order by Hits DESC" -i:CSV -nSkipLines:4  -o:CHART  -chartType:PieExploded3D -chartTitle:"Top 10 senders" So far so good, but I can hear you say: "This is great but this is going to take forever on my productions logs so how do I optimize this?" One option is to filter by using the event field when it is equal to '+'. The '+' in the event field identifies a new connection so it will just happen once per SMTP connection. That being said this can still take some time especially if a lot of spammers are trying to hit the servers. The sample bellow extracts top inbound connection filtered where event equals to '+' (as the plus sign means a new inbound connection): logparser "select top 10 REVERSEDNS(EXTRACT_PREFIX(remote-endpoint,0,':')) as RemoteSendingHost, count(*) as Hits into topsender.gif from RECV*.LOG where event='+' group by RemoteSendingHost order by Hits DESC" -i:CSV -nSkipLines:4  -o:CHART  -chartType:PieExploded3D -chartTitle:"TOP 10 senders" Next step is to be able to narrow on a specific time frame in your Exchange 2007 logs. The table bellow provides the LP conversion expressions to use in order to manipulate the different date and time formats:

Extracting

 

Log Parser expression

 

Format

 

Date

EXTRACT_PREFIX([#Fields: date-time],0,'T')

YYYY-MM-DD

Time

EXTRACT_PREFIX(TO_STRING(EXTRACT_SUFFIX([#Fields: date-time],0,'T')),0,'.')

HH:MM:SS

Date & time

TO_TIMESTAMP ( EXTRACT_PREFIX(TO_STRING([#Fields: date-time]),0,'.') , 'yyyy-mm-ddThh:mm:ss')

TO_TIMESTAMP (Log Parser time stamp type)

So returning all rows after '2007-10-10 21:46:23' from a log file would look like this: logparser "select * from RECV.LOG where TO_TIMESTAMP ( EXTRACT_PREFIX(TO_STRING([#Fields: date-time]),0,'.') , 'yyyy-mm-ddThh:mm:ss') > TO_TIMESTAMP ('2007-10-10 21:46:23','yyyy-mm-dd hh:mm:ss')" -i:CSV -nSkipLines:4 -o:DATAGRID Returning all rows between 2007-05-13 21:00:00 and '2007-05-13 21:15:00' from an Exchange 2007 SMTP log file would look like this: logparser "select TO_TIMESTAMP ( EXTRACT_PREFIX(TO_STRING([#Fields: date-time]),0,'.'), 'yyyy-mm-ddThh:mm:ss') as DateTime, EXTRACT_PREFIX(remote-endpoint,0,':') as RemoteSending, data, context, case TO_INT( SUBSTR(DATA,0,3)) when NULL then 0 else TO_INT(SUBSTR(DATA,0,3)) end as RemoteHostReturnCode from SEND*.log where RemoteHostReturnCode > 500 and context <> 'Certificate thumbprint' and context <> 'sending message'" -i:CSV -nSkipLines:4 -o:DATAGRID Identifying times of highest traffic Now you might want to know in what time of the day your system has most connections and traffic. This is also interesting in order to identify when potential spam attacks have occurred. In order to draw a radar graph of global total SMTP inbound simultaneous connections per hours: logparser "SELECT QUANTIZE(TO_TIMESTAMP (EXTRACT_PREFIX(TO_STRING(EXTRACT_SUFFIX([#Fields: date-time],0,'T')),0,'.'), 'hh:mm:ss'),3600) AS Hour, COUNT(*) AS Hits INTO radar_traffic.gif from RECV*.log where event='+' GROUP BY Hour ORDER BY Hour ASC" -i:CSV -nSkipLines:4 -o:CHART -charttype:RadarLineFilled -charttitle:" Global total SMTP inbound simultaneous connections per hours" Identifying top senders Now let's say we want to identify our top senders. Top senders are usually referred to as senders that are sending the most messages. So let's first build a query to output senders by where we at least started to "receive a message": logparser "select top 10 remote-endpoint, count(*) as Hits into topsender-messages.gif from RECV*.LOG where context='receiving message' group by remote-endpoint order by Hits DESC" -i:CSV -nSkipLines:4  -o:CHART  -chartType:PieExploded3D -chartTitle:"TOP 10 senders of messages" But this doesn't mean that all messages where 'accepted' because in one SMTP connection multiple SMTP messages can be sent but some can be accepted and other rejected. If you dig into the Exchange logs you will find that the "signature" of an accepted message is as follows: Data field starts with the following string: "250 2.6.0 <" and ends with the following string "Queued mail for delivery". Sample query to dump all inbound queued mail for delivery: logparser "select * from RECV*.log where (data like '%250 2.6.0 <%') and (data like '%Queued mail for delivery%')" -i:CSV -nSkipLines:4  -o:DATAGRID Now we can group by top senders of messages, note we are removing the port number because indeed a same host can connect multiple times in a day but using different remote source ports. Of course you can REVERSEDNS to identify (or at least getting started to identify) that is hiding behind the IPs: logparser "select EXTRACT_PREFIX(remote-endpoint,0,':') as remote-host, count(*) as hits from RECV*.log where (data like '%250 2.6.0 <%') and (data like '%Queued mail for delivery%') group by remote-host order by hits DESC" -i:CSV -nSkipLines:4  -o:DATAGRID Identifying top email rejecting IP sources Identifying top servers that you most reject mail from is helpful to help saving bandwidth. If a server is sending mail that is very often rejected, that is very likely to help you identify potential spammers. Once these IP sources have been identified, they can be blocked at firewall level and will help against consuming bandwidth by unsolicited email. A manual check should be performed to make sure that the sending server is indeed a real offender. Sample exchange log of unsolicited mail blocked by exchange that can be found in the data field:

550 5.7.1 Message rejected due to content restrictions
Identifying top rejected senders would look like this: logparser "select EXTRACT_PREFIX(remote-endpoint,0,':') as Remote-host, count (*) as hits from RECV*.log where data like '%rejected%' group by Remote-host order by hits desc" -i:CSV -nSkipLines:4  -o:DATAGRID As you can see in the example above the same sender 10.0.0.x as multiple outbound hosts that seem to be on the same C class... A wider interesting search would be to look at 550 return codes: logparser "select * from RECV*.log  where data like '%550 %'" -i:CSV -nSkipLines:4  -o:DATAGRID As you can see from results of that, 550's are also valid for relay attempts. So the following query will help you identify both mail rejection and senders trying to relay through your mail system: logparser "select EXTRACT_PREFIX(remote-endpoint,0,':') as Remote-host, count (*) as hits from RECV*.log where data like '%550 %' group by Remote-host order by hits desc" -i:CSV -nSkipLines:4  -o:DATAGRID Note if you don't see any "Unable to relay" attempts in your logs it is very likely that:
- You have a smarthost upfront blocking beforehand and may relay attempts.
Or
- That your server is indeed relaying mail.
There are other 500's types of status codes such as 504, 535 and so on. The most effective query I have found is to catch all numeric numbers above 500. The LP query would look like this: logparser "select *  from RECV*.log where TO_INT( SUBSTR(DATA,0,3)) > 500 and event = '>'" -i:CSV -nSkipLines:4  -o:DATAGRID Then, the ultimate group by query would be: logparser "select EXTRACT_PREFIX(remote-endpoint,0,':') as Remote-host, count (*) as hits from RECV*.log where TO_INT( SUBSTR(DATA,0,3)) > 500 and event = '>' group by Remote-host order by hits desc" -i:CSV -nSkipLines:4  -o:DATAGRID You can use the REVERSEDNS function on top of that. If you see IP address returned instead of a FQDN, it is even more likely that these hosts are really offenders because they didn't provide a reverse PTR record. But again - doing a reversedns function on huge logs would be slow. The best approach I have come up with to work around that is in two phases: 1. As shown above, identify the list of suspicious senders with the query and dump the output to a temporary log file such as the following: logparser "select EXTRACT_PREFIX(remote-endpoint,0,':') as Remote-host, count (*) as hits into SuspiciousSenders.xml  from RECV*.log where TO_INT( SUBSTR(DATA,0,3)) > 500 and event = '>' group by Remote-host order by hits desc" -i:CSV -nSkipLines:4  -o:XML 2. You can then load the XML generated file as below and apply the REVERSEDNS only on the "hotspot" (top senders): logparser "select REVERSEDNS(Remote-host), hits from  SuspiciousSenders.xml" -i:XML -o:DATAGRID You can then select the top 10 and first investigate those: logparser "select top 10 REVERSEDNS(Remote-host), hits from  SuspiciousSenders.xml" -i:XML -o:DATAGRID Identifying outbound email issues As we have mentioned previously, outbound SMTP log is located in: ProtocolLog\SmtpSend. If we want to identify outbound status codes we first need to parse the data field to identify if the remote host has accepted our messages and as the Data field is a string we also need to convert it to an "int" (intger) type: logparser "select case TO_INT( SUBSTR(DATA,0,3)) when NULL then 0 else TO_INT( SUBSTR(DATA,0,3)) end as RemoteHostReturnCode from SEND*.log " -i:CSV -nSkipLines:4 -o:DATAGRID We are filtering status codes above 400 as we want to have both deferred and rejected emails. For rejected emails only you can filter at 500. So getting detailed information of outbound issues would look like this: logparser "select EXTRACT_PREFIX(remote-endpoint,0,':') as Remote-host, data, context, case TO_INT( SUBSTR(DATA,0,3)) when NULL then 0 else TO_INT( SUBSTR(DATA,0,3)) end as RemoteHostReturnCode from SEND*.log where RemoteHostReturnCode > 400" -i:CSV -nSkipLines:4 -o:DATAGRID That being said, the above might get some false positives so a better query looks like this: logparser "select TO_TIMESTAMP ( EXTRACT_PREFIX(TO_STRING([#Fields: date-time]),0,'.'), 'yyyy-mm-ddThh:mm:ss') as DateTime, EXTRACT_PREFIX(remote-endpoint,0,':') as Remote-host, data, context, case TO_INT( SUBSTR(DATA,0,3)) when NULL then 0 else TO_INT(SUBSTR(DATA,0,3)) end as RemoteHostReturnCode from SEND*.log where RemoteHostReturnCode > 400 and context <> 'Certificate thumbprint' and context <> 'sending message'" -i:CSV -nSkipLines:4 -o:DATAGRID Now again you can use the two step approach as mentioned above to dump the results into an .XML log file: logparser "select EXTRACT_PREFIX(remote-endpoint,0,':') as Remote-host, count(*) as hits into SendingIssues.xml from SEND*.log where TO_INT( SUBSTR(DATA,0,3)) > 400 and context <> 'Certificate thumbprint' and context <> 'sending message' group by Remote-host order by hits desc" -i:CSV -nSkipLines:4 -o:XML And then group by and "reversedns" on it: logparser "select REVERSEDNS(Remote-host), hits from  SendingIssues.xml" -i:XML -o:DATAGRID Based on the above queries, the following one will build a table of top rejection errors by type and number of hits: logparser "select case TO_INT( SUBSTR(DATA,0,3)) when NULL then 0 else TO_INT( SUBSTR(DATA,0,3)) end as RemoteHostReturnCode, data, count (*) as hits from SEND*.log where RemoteHostReturnCode > 400 and context <> 'Certificate thumbprint' and context <> 'sending message' group by RemoteHostReturnCode, data order by hits desc" -i:CSV -nSkipLines:4 -o:DATAGRID

RemoteHostReturnCode

 

Data

 

Hits

 

554

 

554- (RTR:DU)  http://postmaster.contoso.com/errors/yyy.html

 

1595

 

550

 

550 Desole votre serveur de messagerie etant identifie comme generateur de messages non sollicites. Votre message ne peut etre delivre. Veuillez contacter votre administrateur systeme.

 

653

 

451

 

451 Message temporarily deferred - [160]

 

563

 

421

 

421 Message from (mail.contoso.com) temporarily deferred - 4.16.50. Please refer to http://mail.contoso.com/defer.html

 

498

 

550

 

550 DY-001 Mail rejected by this domain for policy reasons.

 

223

 

550

 

550-5.7.1 [mail.contoso.com] The IP you're using to send email is not authorized

 

206

 

550

 

550-5.7.1 To send email directly to our servers please use..

 

198

 

550

 

550 5.7.1 Service unavailable; Client host [mail.contoso.com] blocked

 

187

 

554

 

554 TRANSACTION FAILED

 

108

 

554

 

554-: (RTR:GE) http:// postmaster.contoso.com/errors/yyy.html

 

78

 

550

 

550 Mail rejected. Contact your ISP to determine which authorized SMTP relay servers to send your mail through (or) request a static and dedicated IP before attempting to send mail.

 

76

 

502

 

502 Error: command not implemented

 

1

 

550

 

550 5.7.1 Rejected: mail.contoso.com listed as spam source

 

1

 
Content agent filtering log Content Agent Filtering files are very similar in format and structure to SMTP inbound protocol log files so same tricks apply. They can be parsed by LP using the same base line as above. They really help understanding mail rejection reasons. Table of fields:

Field

 

Most useful (in our examples)

 

Timestamp         

x

SessionId

 

LocalEndpoint 

 

RemoteEndpoint      

x

EnteredOrgFromIP

x

MessageId

 

P1FromAddress

x

P2FromAddresses

x

Recipient           

x

NumRecipients

x

Agent

 

Event

 

Action

 

SmtpResponse

x

Reason

x

ReasonData

x

Similar to examples mentioned earlier, the baseline Log Parser query for AGENT logs will look like this: logparser "select * from AGENT*.log " -i:CSV -nSkipLines:4  -o:DATAGRID In order to get all types of rejection reasons I have came up with the bellow query: logparser "select case TO_INT(ReasonData) when NULL then 10 else ReasonData end as ReasonData2, count(*) as hits into agentreasonspread.gif from AGENT*.log group by ReasonData2 order by hits desc" -i:CSV -nSkipLines:4  -o:CHART  -chartType:PieExploded3D -chartTitle:"Agent reason spread" -e 200
- 0 is accepted content
- Everything else is rejected content
This gives a great idea of the amount of rejected mail by a server. Message tracking log This log is self explanatory and is the best place to look at when one is trying to understand what goes in and out of the system, especially when multiple routing connectors are available. It also keeps tracks of all message subjects that go through the server.  So when message routing or history is in question, this is the place to go to. Again same LP base line query applies: logparser "select * from AGENT*.log " -i:CSV -nSkipLines:4  -o:DATAGRID

Field

 

Most useful (in our examples)

 

date-time

x

client-ip

x

client-hostname 

 

server-ip  

x

server-hostname

 

source-context

x

connector-id                           

 

source     

x

event-id

 

internal-message-id

 

message-id

 

recipient-address                

x

recipient-status          

 

total-bytes

x

recipient-count

 

related-recipient-address

 

reference

 

message-subject

x

sender-address                          

 

return-path

x

message-info

 

As you can see, this log provides valuable information around message bytes. For example - a same message-id can generate several raws (at different steps) and generate different total-bytes size at each step. As we explained above it is also useful to understand mail flow between hosts. The following query will help you identify the top used connectors, this is data is extremely interesting when dealing with complex topologies: logparser "select connector-id, count (*) as Hits from MSGT*.log group by connector-id order by hits desc" -i:CSV -nSkipLines:4 I hope this document has provided you some hints on how LP can help you in parsing new Exchange 2007 transport logs! Additional reading How to Configure Protocol Logging on Exchange 2007: http://technet.microsoft.com/en-us/library/c81cac9c-b990-492a-b899-5be8d08a6068.aspx The Office Web Components (for Log Parser) can be downloaded at: http://www.microsoft.com/downloads/details.aspx?FamilyId=7287252C-402E-4F72-97A5-E0FD290D4B76&displa... Log Parser: http://www.microsoft.com/downloads/details.aspx?FamilyID=890cd06b-abf8-4c25-91b2-f8d975cf8c07&displa... I would like to thank Jeffrey A. Johnson and Nino Bilic for their help in writing, testing and reviewing this! - Julien Clauzel
6 Comments
Not applicable
A hell of a log parser post, nice work! :) Hey the Technet Flash Newsletter today claimed SP1 (non-beta, the real deal) is being released 11/30 for download. Any truth to this?
Not applicable
Tomorrow SP1, party on.. Wheeeeuww.
Not applicable
Agreed - I would have expected some sort of annoucement re: SP1 here on the blog. I've made this my start page on IE just to get the good news ASAP, only to see it first mentioned on a TechNet mailing last night. Ah, the mysterious ways of the corporate machine.
Not applicable
Well guys - since nobody else has put it here yet, I'll announce that SP1 has been RTM'ed!!



I'm downloading it right now at:


http://www.microsoft.com/downloads/details.aspx?FamilyId=44C66AD6-F185-4A1D-A9AB-473C1188954C&displa...



Good luck!

Not applicable
Not applicable
Been working with E2003 for few years and got used to it. Now I feel like we are getting back to DOS days, or UNIX, if you like. I understand that Log Parser and Powershell are nice tools, but is there a GUI-based alternative by any chance? I just feel sick when I see those multiple line queries...