Microsoft Exchange 2000 Server Log Format

Field number	Field name	Description
1	Date	Date of the event.
2	Time	Greenwich mean time of the event.
3	Client-IP	IP of connecting client.
4	Client-hostname	Hostname of connecting client.
5	Partner-name	Name of the messaging service that the message is handed off to. In Exchange 2000, the service can be: SMTP, X400, MAPI, IMAP4, POP3, STORE. This is essentially the same as Exchange Server 5.5, but in Exchange 2000, there are more possibilities for this field.
6	Server-hostname	Hostname of the server that is making the log entry.
7	Server-IP	IP of the server that is making the log entry.
8	Recipient-address	Message recipient (SMTP or X.400 address).
9	Event-ID	Integer corresponding to the Event ID of the action logged, for example: sent, received, delete, retrieve.
10	MSGID	Message ID.
11	Priority	The priority is represented by -1 if low, 0 if normal, 1 if high
12	Recipient-Report-Status	A number representing the result of an attempt to deliver a report to the recipient: 0 if delivered, 1 if not delivered. This is used only for reports (non-delivery reports [NDRs], delivery receipts [DRs]). On other events, it is blank.
13	Total-bytes	Message size (in bytes).
14	Number-recipients	Total number of recipients.
15	Origination-time	Delivery time (in seconds) representing the time it takes to deliver the message. Determined from the difference between the timestamp and time encoded in Message ID. Only valid for messages within the Exchange organization (all versions); there is no requirement to decode other product message IDs such as Sendmail, and so on.
16	Encryption	For the primary body part: 0 if no encryption, 1 if signed only, 2 if encrypted. This is per message, not per recipient.
17	Service-version	Version of the service making the log entry.
18	Linked-MSGID	If there is a MSG ID from another service, it is given here to link the message across services.
19	Message-subject	The subject of the message, truncated to 256 bytes.
20	Sender-address	Primary address of the originating mailbox, if known. This could be SMTP, X.400, or Distinguished Name (DN), depending on transport.