Sorry Bart, but the IDs are not unique. They represent the ID of the thread that is processing the message. They are unique as one thread can only process one message, so starting from the "Connection" log event up to the "Disconnect" log event there will be only one ID in the logs during that timeframe. After the disconnect however the thread terminates, and Windows can (and will) re-use the same thread ID later on to process another message.

Thanks for the reaction, i know Sawmill and i'v tested it and it workt good but when mails are being filtered and customers are calling me asking where dit my mail go it is more easy to do a search to a database and get back all relative information regarding that mail adres to see why it was quarantined or deleted.