The Exchange 2007 Wiki

Exchange Active Sync Protocol Logging

  Exchange Server 2007

Exchange ActiveSync Info > Exchange ActiveSync Protocol Logging


Exchange ActiveSync Protocol Logging

Administrators Pocket Guide
This document was created to help the IT Pro understand how Exchange 2007 ActiveSync stores information in the IIS Log.

IIS Log Format

The format if the Exchange ActiveSync protocol logs will follow this guideline:

-          One separator (underscore will be used as the separator for readability)
-          Each element starts with a unique pattern, so that if a parser finds an unknown element, it can skip to the next separator and keep going.
-          Since elements are prefixed, only the elements that apply need to be logged (Ping command will have a much shorter log).
-          Strings will be URL escaped (meaning a comma becomes "%2C"), and the underscore character will be escaped as well (since we're using it a separator).
The syntax rule for the element would be one of:
-          Identifier made of only letters + value made of only digits
-          Identifier made of only letters + ":" + value made of letters and digits (but not "_")
Identifier Legend
Letter Identifier
Available Statistics
Definition
Possible Values
V
Protocol Version
Indicates the protocol version that the device is using to sync with your Exchange Server.
Value
Meaning
120
Version 12
25
Version 2.5
21
Version 2.1
20
Version 2.0
10
Version 1.0

Ty
Type

Value
Meaning
Em
Email
Co
Contacts
Ca
Calendar
Ta
Tasks

Fid
Folder ID
The ID of the folder being synchronized.
Positive integer
Fc
Folder Count
The number of folders being synchronized. 

NOTE: Only used for the GetItemEstimate command

Positive integer
Filt
Filter Type
This is the amount of data that the user wanted returned back to them.
Value
Meaning
Email?
Calendar?
Tasks?
0
No filter
Yes
Yes
Yes
1
1 day back
Yes
No
No
2
3 days back
Yes
No
No
3
1 week back
Yes
No
No
4
2 weeks back
Yes
Yes
No
5
1 month back
Yes
Yes
No
6
3 months back
No
Yes
No
7
6 months back
No
Yes
No
8
Incomplete
No
No
Yes

St
Sync Type
This is the type of sync being performed. 

The “Meanings” are:
First Sync: This is called “Sync 0” which is the first sync that is established with the Exchange Server.
Subsequent Sync: Thereafter the sync type is categorized as “Subsequent Sync”.
Recovery Sync: The client is resending a sync request because it did not receive a corresponding response.
Invalid Sync: This is when the Sync Key used is invalid or does not match what is stored in the Exchange Server.

Value
Meaning
F
First Sync
S
Subsequent Sync
R
Recovery Sync
I
Invalid Sync

Sk
Sync Key
This is the actual sync key that is being used between the Client and the Exchange Server.
Positive integer
Cli:
Client Stats
(adds, changes, deletes, fetches, errors)
Stores the count of each type of activity from the Client.
Letter Identifiers:
a = Adds
c = Changes
d = Deletes
f = Fetches
e = Errors

Example: Cli:0a0c0d1f0e

n/a
Svr:
Server Stats
(adds, changes, deletes, soft-deletes, errors)
Stores the number of each type of activity from the Exchange Server.
Letter Identifiers:
a = Adds
c = Changes
d = Deletes
s = Soft-deletes
e = Errors

Example: Srv:1a0c0d0s0e0r Srv:1a0c0d0s0e0r Srv:1a0c0d0s0e0r Srv:1a0c0d0s0e0r Srv:1a0c0d0s0e0rSrv:1a0c0d0s0e0r

n/a
E
Number of Errors
Number of errors encountered in request.
positive integer
Io
Items opened
Future Feature.  This is the number of items opened by XSO.
n/a
Hb
Heartbeat Interval
This indicates the Heartbeat interval used for the Ping command. 

NOTE: This is only used for the PING Command (aka Direct Push).

n/a
Ssp
SharePoint Docs
Number of files accessed from SharePoint
positive integer
Sspb
SharePoint Bytes
Amount of Bytes accessed from SharePoint.
positive integer
Unc
UNC Files
Number of files accessed from UNC.
positive integer
Uncb
UNC Bytes
Amount of Bytes accessed from UNC.
positive integer
Att
Attachments
Number of attachments retrieved. This applies to GetAttachment & ItemOperations command only.
positive integer
Attb
Attachment Bytes
Amount of Bytes accessed for Attachment.
This applies to GetAttachment & ItemOperations command only.
positive integer
Pk
Policy Key Received
Used by the client and server to correlate acknowledgements to a particular policy setting.
n/a
Pa
Policy Acknowledge Status
Indicates success if all the policy settings were applied correctly.
Value
Meaning
1
Success applying policy
2
Partially applied policy
3
Failed applying policy

Oof
Oof Action
This is the action done on the “Out of Office” status stored in Exchange.
Value
Meaning
Get
Retrieves the Oof status and message
Set
Sets the Oof status and/or message.

UserInfo
User Information Action
Exchange ActiveSync currently only supports the ability for the device to retrieve the user information data and not set it up at exchange. 
Get
DevModel
Device Model
Dependent on the Device Manufacturer providing this information as part of the SETTINGS Command.  Possible values include:
-           Manufacturer Name
-           Model Name
-           Model Number
n/a
DevIMEI
IMEI
Also dependent on Device Manufacturer.  IMEI stands for International Mobile Equipment Identity.  It’s a 15 digit code assigned to all devices.
n/a
DevName
Device Friendly Name
Intended on holding the user’s description of their device.
n/a
DevOS
Device OS
This is the OS running on the device
n/a
DevLang
Device OS Language
Localized language of the device OS.
n/a
Error
Error
Indicates the error section of the request.
n/a
S
Status
This is the global command status returned.  (status codes vary by command)
See appendix for available status codes.
Example Sync command
                &Log=V120_Ty:Em_Fid:37_Fc1_Filt2_St:S_Sk:1805_Srv:1a0c0d0s0e0r_Pk2260121383_S1_
Translation:
Protocol Version
12
Type
Email
Folder ID
37
Folder Count
1
Filter Type
3 days back
Sync Type
Subsequent sync
Sync Key
1805
Client Stats

Adds
0
Changes
0
Deletes
0
Fetches
0
Errors
0
Server Stats

Adds
1
Changes
0
Deletes
0
Soft-Deletes
0
Errors
0
Read Flag Changes
0
Policy Key
2260121383
Status
1
Example FolderSync command:
&Log=V120_St:S_Pk3518147315
Translation:
Protocol Version
12
Sync Type
Subsequent sync
Policy Key
3518147315

Example GetItemEstimate command:
&Log=V120_Fc8_Pk2538642603_S1
Translation:

Protocol Version
12
Folder Count
8
Policy Key
2538642603
Status
1

 

Example Ping command:
&Log=V120_Hb780_S1
Translation:

Protocol Version
12
Heartbeat Interval
780 sec (13min)
Status
1

 

Appendix A - Status Codes

 Additional Resources

Exchange 2003 - Active Sync reporting - http://msexchangeteam.com/archive/2006/02/14/419562.aspx If you are new to Exchange ActiveSync reporting and want to get started with Log Parser which is a flexible SQL-like reporting solution, this blog posting will give you a step by step description for how to get started into understanding how your users are using their mobile devices with Exchange ActiveSync. 

More on Exchange ActiveSync Reporting with Log Parser - COM object available - http://msexchangeteam.com/archive/2006/03/03/421149.aspx This blog post is a continuation of the posting listed above.  This time we leverage the power of a Log Parser COM object specifically created for Exchange ActiveSync, so that you can easily query fields without having to do string parsing.  Read on and you'll see the benefits of this Log Parser COM object for EAS.

Site

Changes
Index
Search

 

User

 

Log In
Register

 
 

Last Modified 5/6/08 9:03 AM