I'm having some trouble writing a web-based log viewer for Microsoft
SMTP. I have set up SMTP to log to an ODBC database, which is working
fine. It's the content of the data that's throwing me for a loop.

Basically, when I query that table, I start with a from address. I can
pull out the surrounding log entries for that client host (external IP
or name), but I have no way of making sure that all the rows that come
back are from the session I am looking for.

MS MSTP interleaves the log entries. Fine, I have no problem with that.
Why don't they provide some kind of session ID? Most MTAs provide some
kind of hash value that is specific to a particular session. I don't
think any tool could get that information out of MS SMTP.

I see this as cripiling their logging. There are definitely
interleaving instances for high-traffic servers that that result in
ambiguities that are literally unresolvable, leaving the admin unable
to prove a message was handled correctly. Surely MS wasn't that dumb?
Is there some kind of session logging I'm missing? Again,
clienthost/datetime doesn't always cut it, because sessions to the same
host can be interleaved in the logs.

[ Post a follow-up to this message ]

FYI - I solved this myself with a little more research. I discovered
that you can configure multiple DNS A records with the same host name.
I used MS DNS, but I know it works on other platforms as well.

When you do an nslookup on that host name, you get multiple IP
addresses back. It's up to the software making the query to handle
them. In the case of MS SMTP, it will failover to the second IP if the
first one is down. I tested this in a Windows 2003 environment, and it
works.

I heard that it would round-robin, not just failover. But I was unable
to verify that. It looks like it just fails over to me.

[ Post a follow-up to this message ]