Your Mac will generate a list of connections between your computer and its destination. If you see. signs, that means “Request Timed Out”. Then you may review the results. See also: Where Do Screenshots Go On Mac? To run traceroute on a Mac using the Network Utility app. You may also use the Network Utility app. 7 days for easily accessible message trace, 90 days for “Historical Search” – where results can only be viewed in a downloadable CSV file. Availability: All data about messages is available as soon as they are sent or received. Messages less than 4 hours old might not be available. Delay: All searches start immediately.
We connect today's community to a world of possibilities. Browse materials, services, and programs or find out how to visit the nearest Phoenix Public Library location. The method trace takes a single normal value (a value between 0 and 1) and returns a Point in 2-dimensional space. Float x = 0.5f; Point pt = path.trace(x); //pt is set to the 2-D coordinate halfway along the path If you want to create an animation, for efficiency you may want to avoid allocating a new Point every time you trace a path. In Messages the Saved Messages are saved to /Library/Messages/Archive in the same Date and Time format. To access them you have to use the Finder Go Menu Go to Folder and enter the Path above into the Dialogue box. Separate to this iMessages are stored in a chat.db data base that is also in the /Library/Messages folder.
Log a message.
General messages¶
Record the specified message text in the log. If more than one messagestring is given, they are concatenated into a single message with noseparator between the strings.
The optional <mode> keyword determines the type of message, whichinfluences the way the message is handled:
FATAL_ERRORCMake Error, stop processing and generation.
SEND_ERRORCMake Error, continue processing, but skip generation.
WARNINGCMake Warning, continue processing.
AUTHOR_WARNINGCMake Warning (dev), continue processing.
DEPRECATIONCMake Deprecation Error or Warning if variableCMAKE_ERROR_DEPRECATED or CMAKE_WARN_DEPRECATEDis enabled, respectively, else no message.
NOTICEImportant message printed to stderr to attract user's attention.
STATUSThe main interesting messages that project users might be interested in.Ideally these should be concise, no more than a single line, but stillinformative.
VERBOSEDetailed informational messages intended for project users. These messagesshould provide additional details that won't be of interest in most cases,but which may be useful to those building the project when they want deeperinsight into what's happening.
DEBUGDetailed informational messages intended for developers working on theproject itself as opposed to users who just want to build it. These messageswill not typically be of interest to other users building the project andwill often be closely related to internal implementation details.
TRACEFine-grained messages with very low-level implementation details. Messagesusing this log level would normally only be temporary and would expect to beremoved before releasing the project, packaging up the files, etc.
New in version 3.15: Added the NOTICE, VERBOSE, DEBUG, and TRACE levels.
The CMake command-line tool displays STATUS to TRACE messages on stdoutwith the message preceded by two hyphens and a space. All other message typesare sent to stderr and are not prefixed with hyphens. TheCMakeGUI displays all messages in its log area.The cursesinterface shows STATUS to TRACEmessages one at a time on a status line and other messages in aninteractive pop-up box. The --log-level command-line option to each ofthese tools can be used to control which messages will be shown.
New in version 3.17: To make a log level persist between CMake runs, theCMAKE_MESSAGE_LOG_LEVEL variable can be set instead.Note that the command line option takes precedence over the cache variable.
New in version 3.16: Messages of log levels NOTICE and below will have each line precededby the content of the CMAKE_MESSAGE_INDENT variable (converted toa single string by concatenating its list items). For STATUS to TRACEmessages, this indenting content will be inserted after the hyphens.
New in version 3.17: Messages of log levels NOTICE and below can also have each line precededwith context of the form [some.context.example]. The content between thesquare brackets is obtained by converting the CMAKE_MESSAGE_CONTEXTlist variable to a dot-separated string. The message context will alwaysappear before any indenting content but after any automatically added leadinghyphens. By default, message context is not shown, it has to be explicitlyenabled by giving the cmake--log-contextcommand-line option or by setting the CMAKE_MESSAGE_CONTEXT_SHOWvariable to true. See the CMAKE_MESSAGE_CONTEXT documentation forusage examples.
CMake Warning and Error message text displays using a simple markuplanguage. Non-indented text is formatted in line-wrapped paragraphsdelimited by newlines. Indented text is considered pre-formatted.
Reporting checks¶
A common pattern in CMake output is a message indicating the start of somesort of check, followed by another message reporting the result of that check.For example:
This can be more robustly and conveniently expressed using the CHECK_...keyword form of the message() command:
where <checkState> must be one of the following:
CHECK_STARTRecord a concise message about the check about to be performed.
CHECK_PASSRecord a successful result for a check.
CHECK_FAILRecord an unsuccessful result for a check.
When recording a check result, the command repeats the message from the mostrecently started check for which no result has yet been reported, then someseparator characters and then the message text provided after theCHECK_PASS or CHECK_FAIL keyword. Check messages are always reportedat STATUS log level.
Checks may be nested and every CHECK_START should have exactly onematching CHECK_PASS or CHECK_FAIL.The CMAKE_MESSAGE_INDENT variable can also be used to addindenting to nested checks if desired. For example:
Output from the above would appear something like the following:
-->Note
Message trace is available in the Microsoft 365 security center and in the modern Exchange admin center. For more information, see Message trace in the Security & Compliance Center and Message trace in the modern Exchange admin center.
As an administrator, you can find out what happened to an email message by running a message trace in the Exchange admin center (EAC). After running the message trace, you can view the results in a list, and then view the details about a specific message. Message trace data is available for the past 90 days. If a message is more than 7 days old, you can only view the results in a downloadable .CSV file.
For a video walkthrough of message trace and other mail flow troubleshooting tools, see Find and fix email delivery issues as a Microsoft 365 or Office 365 for business admin.
What do you need to know before you begin?
For information about when data is available and for how long, see Reporting and message trace data availability and latency.
To find and open the classic EAC, see Exchange admin center in Exchange Online.
You need to be assigned permissions before you can perform this procedure or procedures. To see what permissions you need, see the 'Message trace' entry in the Feature permissions in Exchange Online topic.
For information about keyboard shortcuts that may apply to the procedures in this topic, see Keyboard shortcuts for the Exchange admin center.
Tip
Having problems? Ask for help in the Exchange forums. Visit the forums at Exchange Online or Exchange Online Protection. If you're a Microsoft 365 or Office 365 for business admin, see Contact support for business products - Admin Help.
Run a message trace
In the EAC, go to Mail flow > message trace.
Depending on what you're searching for, you can enter values in the following fields. None of these fields are required for messages that are less than 7 days old. You can simply click Search to retrieve all message trace data over the default time period, which is the past 48 hours.
Date range: Using the drop-down list, select to search for messages sent or received within the past 24 hours, 48 hours, or 7 days. You can also select a custom time frame that includes any range within the past 90 days. For custom searches you can also change the time zone, in Coordinated Universal Time (UTC).
Delivery status: Using the drop-down list, select the status of the message you want to view information about. Leave the default value of All to cover all statuses. Other possible values are:
Delivered: The message was successfully delivered to the intended destination.
Failed: The message was not delivered. Either it was attempted and failed or it was not delivered as a result of actions taken by the filtering service. For example, if the message was determined to contain malware.
Pending*: Delivery of the message is being attempted or re-attempted.
Expanded: The message was sent to a distribution list and was expanded so the members of the list can be viewed individually.
Filtered as spam: The message was delivered to the Junk Email folder.
Unknown*: The message delivery status is unknown at this time. When the results of the query are listed, the delivery details fields will not contain any information.
*If you're searching for messages that are older than 7 days, you can't select Pending or Unknown.
Message ID: This is the Internet message ID (also known as the Client ID) found in the message header in the Message-ID: header field. Users can provide you with this information in order to investigate specific messages.
The form of this ID varies depending on the sending mail system. The following is an example:
<08f1e0f6806a47b4ac103961109ae6ef@server.domain>.This ID should be unique; however, not all sending mail systems behave the same way. As a result, there's a possibility that you may get results for multiple messages when querying upon a single Message ID.
Note: Be sure to include the full Message ID string. This may include angle brackets (<>).
Sender: You can narrow the search for specific senders by clicking the Add sender button next to the Sender field. In the subsequent dialog box, select one or more senders from your company from the user picker list and then click Add. To add senders who aren't on the list, type their email addresses and click Check names. In this box, wildcards are supported for email addresses in the format: *@contoso.com. When specifying a wildcard, other addresses can't be used. When you're done with your selections, click OK.
Recipient: You can narrow the search for specific recipients by clicking the Add recipient button next to the Recipient field. In the subsequent dialog box, select one or more recipients from your company from the user picker list and then click Add. To add recipients who aren't on the list, type their email addresses and click Check names. In this box, wildcards are supported for email addresses in the format: *@contoso.com. When specifying a wildcard, other addresses can't be used. When you're done with your selections, click OK.
If you're searching for messages that are older than 7 days, configure the following settings: (otherwise you can skip this step):
Include message events and routing details with report: We recommend selecting this check box only if you're looking for a small number of messages. Otherwise, the results will take longer to return.
Direction: Leave the default All or select Inbound for messages sent to your organization or Outbound for messages sent from your organization.
Original client IP address: Specify the IP address of the sender's client.
Report title: Specify the unique identifier for this report. This will also be used as the subject line text for the email notification. The default is 'Message trace report <day of the week>, <current date> <current time>'. For example, 'Message trace report Thursday, October 17, 2018 7:21:09 AM'.
Notification email address: Specify the email address that you want to receive the notification when the message trace completes. This address must reside within your list of accepted domains.
Click Search: to run the message trace. You'll be warned if you're nearing the threshold of the amount of traces you're allowed to run over a 24 hour period.
After running your message trace, proceed to one of the next sections to read about how to view your results.
Note: To search for a different message, you can click the Clear button and then specify new search criteria.
View message trace results for messages less than 7 days old
After you run a message trace in the EAC, the results will be listed, sorted by date, with the most recent message appearing first. You can sort on any of the listed fields by clicking their headers. Clicking a column header a second time will reverse the sort order. When viewing message trace results, the following information is provided about each message:
Date: The date and time at which the message was received by the service, using the configured UTC time zone.
Sender: The email address of the sender in the form
alias@domain.Recipient: The email address of the recipient or recipients. For messages sent to more than one recipient, there is one line per recipient. If the recipient is a distribution list, the distribution list will be the first recipient, and then each member of the distribution list will be included on a separate line so that you can check the status for all recipients.
Subject: The subject line text of the message. If necessary, this is truncated to the first 256 characters.
Status: This field specifies whether the message was Delivered to the recipient or the intended destination, Failed to be delivered to the recipient (either because it failed to reach its destination or because it was filtered), is Pending delivery (it is either in the process of being delivered or the delivery was deferred but is being re-attempted), was Expanded (there was no delivery because the message was sent to a distribution list (DL) that was expanded to the recipients of the DL), or has a status of None (there is no status of delivery for the message to the recipient because the message was either rejected or redirected to a different recipient).
Note
The message trace can display a maximum of 500 entries. By default, the user interface displays 50 entries per page, and you can navigate through the pages. You can also change the entry size of each page up to 500.
View details about a specific message less than 7 days old
After you review the list of items returned by running the message trace in the EAC, you can double-click an individual message to view the following additional details about the message:
Message size: The size of the message, including attachments, in kilobytes (KB), or, if the message size is greater than 999 KBs, in megabytes (MB).
Message ID: This is the Internet message ID (also known as the Client ID) found in the header of the message with the 'Message-ID:' token. The form of this varies depending on the sending mail system. The following is an example:
<08f1e0f6806a47b4ac103961109ae6ef@contoso.com>.This ID should be unique, however, it is dependent on the sending mail system for generation and not all sending mail systems behave the same way. As a result, there is a possibility that you may get results for multiple messages when querying upon a single Message ID.
This is given as output so that trace entries and the messages in question can be co-related.
To IP: The IP address or addresses to which the service attempted to deliver the message. If there are multiple recipients, these are displayed. For inbound messages sent to Exchange Online, this value is blank.
From IP: The IP address of the computer that sent the message. For outbound messages sent from Exchange Online, this value is blank.
In the events section, the following fields provide information about the events that occurred to the message as it passed through the messaging pipeline:
Date: The date and time that the event occurred.
Event: This field briefly informs you of what happened, for example if the message was received by the service, if it was delivered or failed to be delivered to the intended recipient, and so on. The following are examples of events that may be listed:
RECEIVE: The message was received by the service.
SEND: The message was sent by the service.
FAIL: The message failed to be delivered.
DELIVER: The message was delivered to a mailbox.
EXPAND: The message was sent to a distribution group that was expanded.
TRANSFER: Recipients were moved to a bifurcated message because of content conversion, message recipient limits, or agents.
DEFER: The message delivery was postponed and may be re-attempted later.
RESOLVED: The message was redirected to a new recipient address based on an Active Directory look up. When this happens, the original recipient address is listed in a separate row in the message trace along with the final delivery status for the message.
DLP rule: The message had a DLP rule or sensitivity label match in this message.
Tip
Additional events may appear. For more information about these events, see Event types in the message tracking log.
Action: This field shows the action that was performed if the message was filtered due to a malware or spam detection or a rule match. For example, it will let you know if the message was deleted or if it was sent to the quarantine.
Detail: This field provides detailed information that elaborates on what happened. For example, it may inform you which specific mail flow rule (also known as a transport rule) was matched, and what happened to the message as a result of that match. It can also inform you which specific malware was detected in which specific attachment, or why a message was detected as spam. If the message was successfully delivered, it can tell you the IP address to which it was delivered.
View message trace results for messages more than 7 days old
If you run a message trace for items that are older than 7 days, when you click Search a message should appear letting you know that the message was successfully submitted, and that an email notification will be sent to the supplied email address when the trace has completed. (If the message trace is processed and data that matches your search criteria is successfully retrieved, this notification message will include information about the trace and a link to the downloadable .CSV file. If no data was found that matched the search criteria you specified, you'll be asked to submit a new request with changed criteria in order to obtain valid results.)
In the EAC, you can click View pending or completed traces in order to view a list of traces that were run for items that older than 7 days. In the resulting UI, the list of traces is sorted based on the date and time that they were submitted, with the most recent submissions appearing first. In addition to the report title, the date and time the trace was submitted, and the number of messages in the report, the following status values are listed:
Not started: The trace was submitted but is not yet running. At this point, you have the option to cancel the trace.
Cancelled: The trace was submitted but was cancelled.
In progress: The trace is running and you can't cancel the trace or download the results.
Completed: The trace has completed and you can click Download this report to retrieve the results in a .CSV file. Note that if your message trace results exceed 50000 messages for a summary report, it will be truncated to the first 50000 messages. If your message trace results exceed 1000 messages for a detailed report, it will be truncated to the first 1000 messages. If you do not see all the results that you need, we recommend that break your search out into multiple queries.
When you select a specific message trace, additional information appears in the right pane. Depending on what search criteria you specified, this may include details such as the date range for which the trace was run, and the sender and intended recipients of the message.
Note
Message traces containing data that is more than 7 days old are automatically deleted in the EAC after 10 days. They can't be manually deleted.
The maximum size for a downloadable report is 500 MB. If a downloadable report exceeds 500 MB, you can't open the report in Excel or Notepad.
View report details about a specific message more than 7 days old
When you download and view a message trace report, either from View pending or completed traces in the EAC or from a notification email, its contents depend on whether you have selected the Include message events and routing details with report option.
Important
In order to view the downloaded message trace report, you must have the 'View-Only Recipients' RBAC role assigned to your role group. By default, the following role groups have this role assigned: Compliance Management, Help Desk, Hygiene Management, Organization Management, View-Only Organization Management.
Viewing a message trace report without routing details
If you didn't include routing details when running the message trace, the following information is included in the .CSV file, which you can open in an application such as Microsoft Excel:
origin_timestamp: The date and time at which the message was received by the service, using the configured UTC time zone.
sender_address: The email address of the sender in the form alias@domain.
Recipient_status: The status of the delivery of the message to the recipient. If the message was sent to multiple recipients, it will show all the recipients and the corresponding status against each, in the format: <email address>##<status>. For example, a status of:
##Receive, Send: means that the message was received by the service and sent to the intended destination.
##Receive, Fail: means that the message was received by the service but failed to be delivered to the intended destination.
##Receive, Deliver: means that the message was received by the service and delivered to the recipient's mailbox.
message_subject: The subject line text of the message. If necessary, this is truncated to the first 256 characters.
total_bytes: The size of the message, including attachments, in bytes.
message_id: This is the Internet message ID (also known as the Client ID) found in the header of the message with the 'Message-ID:' token. The form of this varies depending on the sending mail system. The following is an example:
<*08f1e0f6806a47b4ac103961109ae6ef*@*server*.*domain*>.This ID should be unique, however, it is dependent on the sending mail system for generation and not all sending mail systems behave the same way. As a result, there is a possibility that you may get results for multiple messages when querying upon a single Message ID.
This is given as output so that trace entries and the messages in question can be co-related.
network_message_id: This is a unique message ID value that persists across copies of the message that may be created due to bifurcation or distribution group expansion. An example value is 1341ac7b13fb42ab4d4408cf7f55890f.
original_client_ip: The IP address of the sender's client.
directionality: This field denotes whether the message was sent inbound (1) to your organization, or whether it was sent outbound (2) from your organization.
connector_id: The name of the source or destination Send connector or Receive connector. For example, ServerNameConnectorName or ConnectorName.
delivery_priority: Denotes whether the message was sent with High, Low, or Normal priority.
View a message trace report with routing details
Message Tracer Mac Library Application
If you included routing details when running the message trace, all information from the message tracking logs is included in the .CSV file, which you can open in an application such as Microsoft Excel. Some of the values included in this report are described in the prior section, while other values that may be useful for investigative purposes are described in Fields in the message tracking log files.
The custom_data field
Additionally, the custom_data field may contain values that are specific to the filtering service. The custom_data field in an AGENTINFO event is used by a variety of different agents to log details from the agent's processing of the message. Some of the message data protection related agents are described below.
Spam Filter Agent (S:SFA)
A string beginning with S:SFA is an entry from the spam filter agent and provides the following key details:
| Log Information | Description | |
|---|---|---|
| SFV=NSPM | The message was marked as non-spam and was sent to the intended recipients. | |
| SFV=SPM | The message was marked as spam by the content filter. | |
| SFV=BLK | Filtering was skipped and the message was blocked because it originated from a blocked sender. | |
| SFV=SKS | The message was marked as spam prior to being processed by the content filter. This includes messages where the message matched a mail flow rule to automatically mark it as spam and bypass all additional filtering. | |
| SCL=<number> | For more information about the different SCL values and what they mean, see Spam Confidence Levels. | |
| PCL=<number> | The Phishing Confidence Level (PCL) value of the message. These can be interpreted the same way as the SCL values documented in Spam Confidence Levels. | |
| DI=SB | The sender of the message was blocked. | |
| DI=SQ | The message was quarantined. | |
| DI=SD | The message was deleted. | |
| DI=SJ | The message was sent to the recipient's Junk Email folder. | |
| DI=SN | The message was routed through the higher risk delivery pool. For more information, see High-risk delivery pool for outbound messages. | |
| DI=SO | The message was routed through the normal outbound delivery pool. | |
| SFS=[a] | SFS=[b] | This denotes that spam rules were matched. |
| IPV=CAL | The message was allowed through the spam filters because the IP address was specified in an IP Allow list in the connection filter. | |
| H=[helostring] | The HELO or EHLO string of the connecting mail server. | |
| PTR=[ReverseDNS] | The PTR record of the sending IP address, also known as the reverse DNS address. |
When a message is filtered for spam, a sample custom_data entry would look similar to the following:
S:SFA=SUM|SFV=SPM|IPV=CAL|SRV=BULK|SFS=470454002|SFS=349001|SCL=9|SCORE=-1|LIST=0|DI=SN|RD=ftmail.inc.com|H=ftmail.inc.com|CIP=98.129.140.74|SFP=1501|ASF=1|CTRY=US|CLTCTRY=|LANG=en|LAT=287|LAT=260|LAT=18;
Malware Filter Agent (S:AMA)
A string beginning with S:AMA is an entry from the anti-malware agent and provides the following key details:
| Log Information | Description |
|---|---|
| AMA=SUM|v=1| or AMA=EV|v=1| | The message was determined to contain malware. SUM denotes that the malware could've been detected by any number of engines. EV denotes that the malware was detected by a specific engine. When malware is detected by an engine this triggers the subsequent actions. |
| Action=r | The message was replaced. |
| Action=p | The message was bypassed. |
| Action=d | The message was deferred. |
| Action=s | The message was deleted. |
| Action=st | The message was bypassed. |
| Action=sy | The message was bypassed. |
| Action=ni | The message was rejected. |
| Action=ne | The message was rejected. |
| Action=b | The message was blocked. |
| Name=<malware> | The name of the malware that was detected. |
| File=<filename> | The name of the file that contained the malware. |
When a message contains malware, a sample custom_data entry would look similar to the following:
S:AMA=SUM|v=1|action=b|error=|atch=1;S:AMA=EV|engine=M|v=1|sig=1.155.974.0|name=DOS/Test_File|file=filename;S:AMA=EV|engine=A|v=1|sig=201307282038|name=Test_File|file=filename
Transport Rule Agent (S:TRA)
A string beginning with S:TRA is an entry from the Transport Rule agent and provides the following key details:
| Log Information | Description |
|---|---|
| ETR|ruleId=[guid] | The rule ID that was matched. |
| St=[datetime] | The date and time (in UTC) when the rule match occurred. |
| Action=[ActionDefinition] | The action that was applied. For a list of available actions, see Mail flow rule actions in Exchange Online. |
| Mode=Enforce | The mode of the rule. Possible values are:
|
When a message matches a mail flow rule, a sample custom_data entry would look similar to the following:
Message Tracer Mac
S:TRA=ETR|ruleId=19a25eb2-3e43-4896-ad9e-47b6c359779d|st=7/17/2013 12:31:25 AM|action=ApplyHtmlDisclaimer|sev=1|mode=Enforce
Message Tracer Mac Library Software
For more information
Message Trace FAQ presents messaging questions that a user may have, along with possible answers. It also describes how to use the message trace tool in order to get those answers and troubleshoot specific mail delivery issues.
Can I run a message trace via Exchange Online PowerShell or Exchange Online Protection PowerShell? What are the cmdlets to use? gives information about the PowerShell cmdlets that you can use to run a message trace.