Message Tracking Event ids

Message Tracking Event ids

EventID	Description
DEFER	Message delivery delayed
DELIVER	Message delivered to a mailbox
DSN	A delivery status notification was generated. Messages quarantined by the Content Filter are also delivered as DSNs. the recipients field has the SMTP address of the quarantine mailbox.
EXPAND	Distribution Group expanded. The RelatedRecipientAddress field has the SMTP address of the Distribution Group.
FAIL	Delivery failed. The RecipientStatus field has more information about the failure, including the SMTP response code. You should also look at the Source and Recipients fields when inspecting messages with this event.
POISONMESSAGE	Message added to or removed from the poison queue
RECEIVE	Message received. The Source field is STOREDRIVER for messages submitted by Store Driver (from a Mailbox server), or SMTP for messages a) received from another Hub/Edge b) received from an external (non-Exchange) host using SMTP c) submitted by SMTP clients such as POP/IMAP users.
REDIRECT	Message redirected to alternate recipient
RESOLVE	Generally seen when a message is received on a proxy address and resolved to the default email address. The RelatedRecipientAddress field has the proxy address the message was sent to. The recipients field has the default address it was resolved (and delivered) to.
SEND	Message sent by SMTP. The ServerIP and ServerHostName parameters have the IP address and hostname of the SMTP server.
SUBMIT	The Microsoft Exchange Mail Submission service on a Mailbox server successfully notified a Hub Transport server that a message is awaiting submission (to the Hub). These are the events you’ll see on a Mailbox server. The SourceContext property provides the MDB Guid, Mailbox Guid, Event sequence number, Message class, Creation timestamp, and Client type. Client type can be User (Outlook MAPI), RPCHTTP (Outlook Anwhere), OWA, EWS, EAS, Assistants, Transport.
TRANSFER	Message forked because of content conversion, recipient limits, or transport agents