Exchange 2007 Protocol Logging – IMAP & POP

I had a question come across my desk the other day about how to enable protocol logging in Exchange 2007 for IMAP and POP. Protocol logging for these protocols generates comma delimited logs similar to HTTP logs (except for IMAP). In Exchange 2003 you enabled these with a couple of registry tweaks. These don't however work in Exchange 2007. Exchange 2007 instead uses a couple of config files on the file system.

To enable the logging for IMAP, you would do this:

1. Browse to C:\Program Files\Microsoft\Exchange Server\ClientAccess\PopImap
2. Open Microsoft.Exchange.Imap4.exe.config with text editor (e.g. Notepad) and scroll to the bottom
3. Modify ProtocolLog from false to true.
4. Modify LogPath as necessary
5. Restart the MsExchangeImap4 service

For POP, simply edit Microsoft.Exchange.Pop3.exe.config instead and restart the MsExcahngePop3 service.

You can use a number of tools to parse the logs, although one tool I would recommend is LogParser from Microsoft.