How To Check If Your Mailbox Is Running Properly

Transcription

1 CA Nimsoft Monitor Probe Guide for Exchange Server Monitor exchange_monitor v5.0 series

2 Legal Notices Copyright 2013, CA. All rights reserved. Warranty The material contained in this document is provided "as is," and is subject to being changed, without notice, in future editions. Further, to the maximum extent permitted by applicable law, Nimsoft LLC disclaims all warranties, either express or implied, with regard to this manual and any information contained herein, including but not limited to the implied warranties of merchantability and fitness for a particular purpose. Nimsoft LLC shall not be liable for errors or for incidental or consequential damages in connection with the furnishing, use, or performance of this document or of any information contained herein. Should Nimsoft LLC and the user have a separate written agreement with warranty terms covering the material in this document that conflict with these terms, the warranty terms in the separate agreement shall control. Technology Licenses The hardware and/or software described in this document are furnished under a license and may be used or copied only in accordance with the terms of such license. No part of this manual may be reproduced in any form or by any means (including electronic storage and retrieval or translation into a foreign language) without prior agreement and written consent from Nimsoft LLC as governed by United States and international copyright laws. Restricted Rights Legend If software is for use in the performance of a U.S. Government prime contract or subcontract, Software is delivered and licensed as "Commercial computer software" as defined in DFAR (June 1995), or as a "commercial item" as defined in FAR 2.101(a) or as "Restricted computer software" as defined in FAR (June 1987) or any equivalent agency regulation or contract clause. Use, duplication or disclosure of Software is subject to Nimsoft LLC s standard commercial license terms, and non-dod Departments and Agencies of the U.S. Government will receive no greater than Restricted Rights as defined in FAR (c)(1-2) (June 1987). U.S. Government users will receive no greater than Limited Rights as defined in FAR (June 1987) or DFAR (b)(2) (November 1995), as applicable in any technical data. Trademarks Nimsoft is a trademark of CA. Adobe, Acrobat, Acrobat Reader, and Acrobat Exchange are registered trademarks of Adobe Systems Incorporated. Intel and Pentium are U.S. registered trademarks of Intel Corporation. Java(TM) is a U.S. trademark of Sun Microsystems, Inc. Microsoft and Windows are U.S. registered trademarks of Microsoft Corporation. Netscape(TM) is a U.S. trademark of Netscape Communications Corporation. Oracle is a U.S. registered trademark of Oracle Corporation, Redwood City, California. UNIX is a registered trademark of the Open Group. ITIL is a Registered Trade Mark of the Office of Government Commerce in the United Kingdom and other countries. All other trademarks, trade names, service marks and logos referenced herein belong to their respective companies. For information on licensed and public domain software, see the Nimsoft Monitor Third-Party Licenses and Terms of Use document at:

3 Contact CA Nimsoft Contact CA Support For your convenience, CA Technologies provides one site where you can access the information that you need for your Home Office, Small Business, and Enterprise CA Technologies products. At you can access the following resources: Online and telephone contact information for technical assistance and customer services Information about user communities and forums Product and documentation downloads CA Support policies and guidelines Other helpful resources appropriate for your product Providing Feedback About Product Documentation Send comments or questions about CA Technologies Nimsoft product documentation to To provide feedback about general CA Technologies product documentation, complete our short customer survey which is available on the CA Support website at

4

5 Contents Chapter 1: Overview 7 About This Guide... 7 Related Documentation... 8 Preconfiguration Requirements... 8 Supported Platforms... 8 Chapter 2: Configuration Details 9 exchange_monitor Node... 9 File Monitoring Node... 9 Message Node Configure a Node Manage Profile Chapter 3: QoS Threshold Metrics 15 exchange_monitor Alert Metrics Default Settings exchange_monitor QoS Metrics Contents 5

6 Documentation Changes This table describes the version history for this document. Version Date What's New? 5.0 September 2013 Initial Web-based GUI version of this probe. (Previous versions of this probe are configured using Infrastructure Manager). 6 Probe Guide for Exchange Server Monitor

7 Chapter 1: Overview This probe looks at a set of parameters on your Exchange Server to check its health. Alarm messages can be generated based on the values of the parameters being checked. Quality of service (QoS) messages are generated on a set of performance related statistics. This section contains the following topics: About This Guide (see page 7) Related Documentation (see page 8) Preconfiguration Requirements (see page 8) About This Guide This guide is for the CA Nimsoft Monitor Administrator to help understand the configuration of the Exchange Server Monitor probe. This guide contains the following information: An overview of the Exchange Server Monitorprobe. The related documentation for previous probe versions, release notes, and so on. The configuration details of the probe including information for the fields that are required to configure the probe. The common procedures that can be used in the probe configuration. Field information for the fields, required to configure the probe in the first-time deployment of the probe. Important! The field description for intuitive terms in the GUI has not been included in the document. Chapter 1: Overview 7

8 Related Documentation Related Documentation For related information that may be of interest, see the following material: Related Documentation Documentation for other versions of the exchange_monitor probe The Release Notes for the exchange_monitor probe User documentation for the Admin Console Monitor Metrics Reference Information for CA Nimsoft Probes ( Preconfiguration Requirements This section contains the preconfiguration requirements for the Exchange Server Monitor probe. Supported Platforms Refer to the Nimsoft Compatibility Support Matrix for the latest information on supported platforms. See also the Support Matrix for Nimsoft Probes for specific information on the Exchange Server Monitor probe. 8 Probe Guide for Exchange Server Monitor

9 Chapter 2: Configuration Details The Exchange Server Monitor probe looks at a set of parameters on your Exchange Server to check its health. Alarm messages can be generated based on the values of the parameters being checked. Quality of service (QoS) messages are generated on a set of performance-related statistics. The probe is configured by defining one or more users. You can add profiles for each user. These monitoring profiles define how the test mail message is sent and returned. These profiles also specify the alarm and QoS properties. This section contains the following topics: exchange_monitor Node (see page 9) Configure a Node (see page 12) exchange_monitor Node The exchange_monitor node allows you to view the probe information. Navigation: exchange_monitor Node Set or modify the following values that are based on your requirement: exchange_monitor > Probe Information This section provides information about the probe name, probe version, start time of the probe, and the vendor who created the probe. File Monitoring Node This node allows you to add a monitoring profile that works with the Exchange Server Monitor probe. Navigation: exchange_monitor Node > File Monitoring Node Set or modify the following values that are based on your requirement: File Monitoring > Options > Add This section allows you to create a monitoring profile, such as Perf and ntevl. Chapter 2: Configuration Details 9

10 exchange_monitor Node Message Node This node allows you to view the list of alarm message that are available on the Exchange Server Monitor probe. Navigation: exchange_monitor Node > File Monitoring Node > Message Node Set or modify the following values that are based on your requirement: Message > Message definitions This section allows you to view the details of alarm messages of the Exchange Server Monitor probe. Message Text: Identifies the alarm message text that is issued on the message alarm. Severity: Specifies the level of severity of the alarm. Message Token: Selects the alarm message that is issued if the specified threshold value is breached. Subsystem: Identifies the subsystem ID of the alarm that defines the source of the alarm. 10 Probe Guide for Exchange Server Monitor

11 exchange_monitor Node <Profile Name> Node This node allows you to view the list of all checkpoints that are defined on the profile. You can also configure the alarm messages that are generated. Note: The profile appearing as a child node, under the Message node is user-configurable. Hence, the profile is referred as the profile name node throughout this document. Navigation: exchange_monitor Node > File Monitoring Node > Message Node > profile name Node Set or modify the following values that are based on your requirement: profile name > Profile This section allows you to view and configure the checkpoints of the profile. Group: Defines the logical group to which the checkpoint belongs. Servers: Defines the version of the exchange server. Calculate Average based on: Indicates the calculation of average value of the threshold values of the checkpoint. Samples: Specifies a measured value which is compared to the threshold value that is defined on the checkpoint. Compare Type: Defines the type of comparison of the threshold value. Message on Alarm: Defines the message that is displayed when the alarm is issued. Message clear: Defines the message that is displayed when the alarm is cleared. Chapter 2: Configuration Details 11

12 Configure a Node <Monitor Name> Node This node allows you to view and configure the QoS properties of the monitoring profiles of the exchange server. Note: The monitoring profile appearing as a child node, under the profile name node is user-configurable. Hence, the profile is referred as the monitor name node throughout this document. Navigation: exchange_monitor Node > File Monitoring Node > Message Node > profile name Node > monitor name Node Set or modify the following values that are based on your requirement: monitor name > : 1 This section allows you to view and configure the QoS properties of the profile. QoS Name: Indicates the QoS name. Description: Indicates the name of the profile. Metric ID: Indicates a unique metric ID for Exchange Server Monitor profile. Profile Name: Defines the name of the profile. Note: You can configure the QoS properties of each profile same as the : 1 profile. Configure a Node This procedure provides the information to configure a particular section within a node. Each section within the node allows you to configure the properties of the Exchange Server Monitor probe. Follow these steps: 1. Select the appropriate navigation path. 2. Update the field information and click Save. The specified section of the Exchange Server Monitor probe is configured. 12 Probe Guide for Exchange Server Monitor

13 Configure a Node Manage Profile You can configure the probe to create a connection. Follow these steps: 1. Click the Options icon next to the File Monitoring node in the navigation pane. 2. Click the Add option. 3. Update the field information and click Submit. The new connection is saved under the Messages node in the navigation pane. Chapter 2: Configuration Details 13

14

15 Chapter 3: QoS Threshold Metrics A lot of Nimsoft Monitor probes ship with default alarm threshold values set. The default threshold values provide an idea of the type of values to be entered in the fields and are not necessarily recommended best practice values. To aid in tuning thresholds and reducing false-positive alarms, this section describes the QoS metrics and provides the default alarm thresholds. This section contains the following topics: exchange_monitor Alert Metrics Default Settings (see page 15) exchange_monitor QoS Metrics (see page 46) exchange_monitor Alert Metrics Default Settings This section contains the QoS metric default settings for the Exchange Server Monitor probe. Alarm Metric Monitoring profiles (Type=Performance) Error Threshold Error Severity Description Available Mbytes 100 Major Available Mbytes shows the amount of physical memory, in megabytes (MB), immediately available for allocation to a process or for system use. It's equal to the sum of memory assigned to the standby (cached), free, and zero page lists. For a full explanation of the memory manager, refer to Microsoft Developer Network (MSDN) or "System Performance and Troubleshooting Guide" in the Windows Server 2003 Resource Kit. Available Megabytes 10 Major Available Megabytes is the amount of physical memory immediately available for allocation to a process or for system use. Chapter 3: QoS Threshold Metrics 15

16 exchange_monitor Alert Metrics Default Settings Alarm Metric Average agent processing time in seconds per event Error Threshold Error Severity Description ---- Major Average agent processing time in seconds per event. Average Delivery Time ---- Major Average Delivery Time is the average time in milliseconds between the submission of a message to the mailbox store and the delivery to all local recipients (recipients on the same server) for the last 10 messages. Average Disk Bytes per Transfer Major Average Disk Bytes per Transfer is the average number of bytes transferred to or from the disk during write or read operations. Average Disk Queue Length 2 Major Average Dis Queue Length is the average number of both read and write requests that were queued for the selected disk during the sample interval. Average Disk Read Queue Length 2 Major Average Disk Read Queue Length is the average number of read requests that were queued for the selected disk during the sample interval. One instance of this profile will monitor each Physical Disk. Average Disk Seconds per Read 0.05 Major Average Disk Seconds per Read is the average time of a read of data from the disk. Average Disk Seconds per Write 0.05 Major Average Disk Seconds per Write is the average time of a write of data to the disk. Average Disk Write Queue Length 2 Major Average Disk Write Queue Length is the average number of write requests that were queued for the selected disk during the sample interval. One instance of this profile will monitor each Physical Disk. Average Queue Time ---- Major This is the average queue time calculated from the Work Queue Length and Messages per Second. 16 Probe Guide for Exchange Server Monitor

17 exchange_monitor Alert Metrics Default Settings Alarm Metric Error Threshold Error Severity Description Average Request Time (ActiveSync) ---- Major Average Request Time is the average time elapsed waiting for a request to complete. Average Response Time (OWA) ---- Major Average Response Time is the average time (in milliseconds) that elapsed between the beginning and end of an OEH or ASPX request. Average Response Time (WS) ---- Major Average Response Time is the average time (in milliseconds) that has elapsed between the beginning and end of requests. Cache Bytes ---- Major Cache bytes is the current size, in bytes, of the file system cache. By default, the cache uses up to 50% of available physical memory. The counter value is the sum of Memory\System Cache Resident Bytes, Memory\System Driver Resident Bytes, Memory\System Code Resident Bytes, and Memory\Pool Paged Resident Bytes. Categorization Count ---- Major Categorization Count is the number of categorizations that exist in the mailbox store. Categorizations are created when a user creates a filtered view or performs a search. When the information store must maintain an excessive number of categorizations, performance can be affected. Committed Bytes ---- Major Committed Bytes is the amount of committed virtual memory, in bytes. Committed memory is the physical memory that has space reserved on the disk paging files. There can be one or more paging files on each physical drive. This counter displays the last observed value only; it isn't an average. Chapter 3: QoS Threshold Metrics 17

18 exchange_monitor Alert Metrics Default Settings Alarm Metric Error Threshold Error Severity Description Committed Bytes in Use ---- Major Committed Bytes in Use is the ratio of Memory\Committed Bytes to the Memory\Commit Limit. Committed memory is the physical memory in use for which space has been reserved in the paging file should it need to be written to disk. The commit limit is determined by the size of the paging file. If the paging file is enlarged, the commit limit increases, and the ratio is reduced. This counter displays the current percentage value only; it isn't an average. Connection Queue Length ---- Major This counter takes the MTA Work Queue Length counter to a lower level and breaks it out into all the different work queues within the MTA. If a large queue is building in the MTA this will pinpoint the exact connection that is responsible.informational for drill down. One instance of this profile will monitor each Message Transfer Agent Connection. Connections Current (inbound) ---- Major Connections Current is the number of inbound connections to the SMTP server. Connections Current (outbound) ---- Major Connections Current is the number of outbound connections from the SMTPSend connector. Connections on IP Allow List Providers per second Connections on IP Block List per second ---- Major Connections on IP Allow List Providers per second is the number of connections on the IP Allow List providers per second Major Connections on IP Block List per second is the number of connections on the IP Block List per second. 18 Probe Guide for Exchange Server Monitor

19 exchange_monitor Alert Metrics Default Settings Alarm Metric Connections on IP Block List Providers per second Connections on the IP Allow List per second Error Threshold Error Severity Description ---- Major Connections on IP Block List Providers per second is the number of connections on the IP Block List providers per second Major Connections on the IP Allow List per second is the number of connections on the IP Allow List per second. Current Bandwidth ---- Major Shows an estimate of the current bandwidth of the network interface in bits per second (bps). For interfaces that do not vary in bandwidth, or for those where no accurate estimation can be made, this value is the nominal bandwidth. One instance of this profile will monitor each Network Interface. Current Connections (IMAP4) ---- Major Current Connections is the number of connections that are currently open on the IMAP service. Current Connections (POP3) ---- Major Current Connections is the number of connections that are currently open on the POP service. Current User Count ---- Major Current User Count is the number of users who are currently logged on to Outlook Web Access. This value monitors the number of active user sessions, so that users are only removed from this count after they log off or their session times out. DNS Queries per second ---- Major DNS Queries per second is the number of DNS queries per second performed by the Sender Id agent. DOTNET - Bytes In All Heaps ---- Major Bytes in all Heaps is the sum of four other counters: Gen 0 Heap Size, Gen 1 Heap Size, Gen 2 Heap Size, and Large Object Heap Size. This counter indicates the current memory allocated in bytes on the GC Heaps. Chapter 3: QoS Threshold Metrics 19

20 exchange_monitor Alert Metrics Default Settings Alarm Metric Error Threshold Error Severity Description DOTNET - Exception Thrown Per Sec ---- Major Exception Thrown per sec is the number of exceptions thrown per second. These include both.net Framework exceptions and unmanaged exceptions that get converted into.net Framework exceptions. For example, the null pointer reference exception in unmanaged code would get thrown again in managed code as a.net Framework System.NullReferenceException. This counter includes both handled and un-handled exceptions. DOTNET - Time In GC ---- Major Time in GC shows when garbage collection has occurred. When the counter exceeds the threshold, it indicates that CPU is cleaning up and isn't being used efficiently for load. Adding memory to the server would improve this situation. Dumpster delete per sec ---- Major Delete Rate is the rate at which items are deleted from the Transport Dumpster on this server. Dumpster insert per sec ---- Major Insert Rate is the rate at which items are inserted into the Transport Dumpster on this server. Dumpster Item Count ---- Major Item Count is the total number of mail items that are currently in the Transport Dumpster on this server. Dumpster size ---- Major Item Size is the total size (in bytes) of mail items that are currently in the Transport Dumpster on this server. Edge Servers total ---- Major Edge Servers total is the total number of Edge Transport servers found by EdgeSync. Elapsed Time - emsmta ---- Major The total elapsed time that this process has been running. 20 Probe Guide for Exchange Server Monitor

21 exchange_monitor Alert Metrics Default Settings Alarm Metric Error Threshold Error Severity Description Elapsed Time - mad ---- Major The total elapsed time that this process has been running. Elapsed Time - store ---- Major The total elapsed time that this process has been running. Errors per Second ---- Major Network Errors per Second is the rate at which serious unexpected errors are occurring. Such errors generally indicate that the Redirector and one or more Servers are having serious communication difficulties. Exchange Servers total ---- Major Exchange Servers total is the total number of Exchange Servers found by EdgeSync. Folder Opens per Second - Mailboxes ---- Major Indicates user activity. Folder Opens per Second - MBX ---- Major Indicates user activity. One instance of this profile will monitor each Mailbox Store. Folder Opens per Second - PF ---- Major Indicates user activity. One instance of this profile will monitor each Public Folder Store. Folder Opens per Second - Public Folders ---- Major Indicates user activity. Hub Transport Servers total ---- Major Hub Transport Servers total is the total number of Hub Transport servers found by EdgeSync. Items queued for delivery ---- Major Items queued for delivery per second. Kilobytes Received per Second ---- Major Shows the rate, in incidents per second, at which bytes were received over each network adapter. The counted bytes include framing characters. Bytes Received/sec is a subset of Bytes Total/sec. One instance of this profile will monitor each Network Interface. Chapter 3: QoS Threshold Metrics 21

22 exchange_monitor Alert Metrics Default Settings Alarm Metric Error Threshold Error Severity Description Kilobytes Sent per Second ---- Major Shows the rate, in incidents per second, at which bytes were sent over each network adapter. The counted bytes include framing characters. Bytes Sent/sec is a subset of Bytes Total/sec. One instance of this profile will monitor each Network Interface. Kilobytes Total per Second ---- Major Shows the rate, in incidents per second, at which bytes were sent and received on the network interface, including framing characters. Bytes Total/sec is the sum of the values of Bytes Received/sec and Bytes Sent/sec. One instance of this profile will monitor each Network Interface. Kilobytes Total per Second - Redirector ---- Major Kilobytes Total per Second is the rate the Redirector is processing data. This includes all application and file data in addition to protocol information such as packet headers. Local Queue Length 4 Major The number of messages in the local SMTP queue. Logon Operations per sec ---- Major Logon Operations/sec is the rate of Logon requests in the mailbox store. Message Opens per Second - Mailboxes ---- Major This will show how often your users are opening messages. Peak load may show this coinciding with other system behavior. Message Opens per Second - MBX ---- Major This will show how often your users are opening messages. Peak load may show this coinciding with other system behavior. One instance of this profile will monitor each Mailbox Store. 22 Probe Guide for Exchange Server Monitor

23 exchange_monitor Alert Metrics Default Settings Alarm Metric Error Threshold Error Severity Description Message Opens per Second - PF ---- Major This will show how often your users are opening messages. Peak load may show this coinciding with other system behavior. One instance of this profile will monitor each Public Folder Store. Message Opens per Second - Public Folders ---- Major This will show how often your users are opening messages. Peak load may show this coinciding with other system behavior. Message Recipients Delivered per sec ---- Major Messages Delivered/sec is the rate that messages are delivered to all recipients. Messages Delivered per Second ---- Major The rate that messages are delivered to local mailboxes. Messages Evaluated by Sender Filter per second Messages Filtered by Sender Filter per second Messages Missing Originating IP per second (Agent_ID) ---- Major Messages Evaluated by Sender Filter per second is the number of messages evaluated by the Sender Filter agent per second Major Messages Filtered by Sender Filter per second is the number of messages filtered by the Sender Filter agent per second Major Messages Missing Originating IP per second is the number of messages per second for which the originating IP could not be determined. Chapter 3: QoS Threshold Metrics 23

24 exchange_monitor Alert Metrics Default Settings Alarm Metric Error Threshold Error Severity Description Messages per Second ---- Major This is the count of messages per second that the MTA is processing inbound and outbound. Using this counter with the Work Queue Length counter will give an indication of how long on average messages are queued before delivery. Divide the average Work Queue Length amount by the average Messages/Sec amount to calculate how long a message can expect to remain in the queue before being delivered.informational for drill down. Messages Queued For Delivery ---- Major Messages Queued For Delivery is the number of messages currently queued in one or more queues. Messages queued for delivery per second ---- Major Messages queued for delivery per second. Messages Queued For Submission ---- Major Messages Queued For Submission is the current number of submitted messages which are not yet processed by transport. Messages Received per Second ---- Major The rate that inbound messages are being received. Messages Received per second (inbound) Messages Scanned per second (content filter agent) Messages Sent per second (outbound) ---- Major Messages Received per second is the number of messages received by the SMTP server each second Major The number of messages scanned per second ---- Major Messages Sent per second is the number of messages sent by the SMTPSend connector each second. Messages Sent per sec ---- Major Messages Sent/sec is the rate that messages are sent to the transport. Messages Submitted Per Second ---- Major Messages Submitted Per Second is the number of messages enqueued in the submission queue per second. 24 Probe Guide for Exchange Server Monitor

25 exchange_monitor Alert Metrics Default Settings Alarm Metric Error Threshold Error Severity Description Messages Validated per second ---- Major Messages Validated per second is the number of messages validated per second. Messages With No PRA per second ---- Major Messages With No PRA per second is the number of messages per second that do not have a valid PRA. Messages with Originating IP on IP Allow List per second Messages with Originating IP on IP Allow List Providers per second Messages with Originating IP on IP Block List per second ---- Major Messages with Originating IP on IP Allow List per second is the number of messages with originating IP on the IP Allow List per second Major Messages with Originating IP on IP Allow List Providers per second is the number of messages with originating IP on the IP Allow List providers per second Major Messages with Originating IP on IP Block List per second is the number of messages with originating IP on the IP Block List per second. Open connections to Global Catalogs ---- Major Open connections to Global Catalogs in this process Page Faults per Second ---- Major The page faults/sec counter should not show a consistently high single figure amount. If Page faults/sec is high and if Memory- pages/second counter is less than 10, it is not a concern. Pages per Second 50 Major Pages per Second is the rate at which pages are read from or written to disk to resolve hard page faults. This counter is a primary indicator of the kinds of faults that cause system-wide delays. Paging File Usage ---- Major The amount of the Page File instance in use in percent. Chapter 3: QoS Threshold Metrics 25

26 exchange_monitor Alert Metrics Default Settings Alarm Metric Error Threshold Error Severity Description Percent Disk Time 60 Major % Disk Time is the percentage of elapsed time that the selected disk drive was busy servicing read or write requests. Poison Queue Length ---- Major Poison Queue Length is the number of items in the poison queue. Pool Nonpaged Megabytes 100 Major Pool Nonpaged Megabytes is the size of the nonpaged pool, an area of system memory for objects that cannot be written to disk, but must be in physical memory as long as they are allocated. Processor Time 80 Major % Processor Time is the percentage of elapsed time that the processor spends to execute a non-idle thread. Processor Time - emsmta 75 Major % Processor Time is the percentage of elapsed time that the processor spends to execute a non-idle thread of the process. Processor Time - inetinfo 75 Major % Processor Time is the percentage of elapsed time that the processor spends to execute a non-idle thread of the process. Processor Time - lsass 75 Major % Processor Time is the percentage of elapsed time that the processor spends to execute a non-idle thread of the process. Processor Time - mad 75 Major % Processor Time is the percentage of elapsed time that the processor spends to execute a non-idle thread of the process. Processor Time - store 75 Major % Processor Time is the percentage of elapsed time that the processor spends to execute a non-idle thread of the process. Processor Time - System 75 Major % Processor Time is the percentage of elapsed time that the processor spends to execute a non-idle thread of the process. 26 Probe Guide for Exchange Server Monitor

27 exchange_monitor Alert Metrics Default Settings Alarm Metric Error Threshold Error Severity Description Proxy User Requests per sec ---- Major Proxy User Requests/sec is the number of proxy requests made per second. Queued Conversion Requests ---- Major Queued Conversion Requests is the number of requests for conversion that are currently waiting to be processed. Receive Queue Size - Mailboxes 2 Major This is the queue of all messages destined inbound for the IS. As with the Send Queue this should also stay at non-zero during normal operating conditions. Receive Queue Size - MBX 2 Major This is the queue of all messages destined inbound for the IS. As with the Send Queue this should also stay at non-zero during normal operating conditions. One instance of this profile will monitor each Mailbox Store. Receive Queue Size - PF 2 Major This is the queue of all messages destined inbound for the IS. As with the Send Queue this should also stay at non-zero during normal operating conditions. One instance of this profile will monitor each Public Folder Store. Receive Queue Size - Public Folders 2 Major This is the queue of all messages destined inbound for the IS. As with the Send Queue this should also stay at non-zero during normal operating conditions. Recipients Rejected by Block List per second Recipients Rejected by Recipient Validation per second ---- Major Recipients Rejected by Block List per second is the number of recipients rejected by block list per second Major Recipients Rejected by Recipient Validation per second is the number of recipients rejected by recipient validation per second. Remote Queue Length 1000 Major The number of messages in the remote SMTP queue. Chapter 3: QoS Threshold Metrics 27

28 exchange_monitor Alert Metrics Default Settings Alarm Metric Error Threshold Error Severity Description Requests per sec ---- Major Requests/sec is the number of requests handled by Outlook Web Access per second. Requests per sec (ActiveSync) ---- Major Requests/sec is the number of HTTP requests that are received from the client via ASP.NET per second. Requests per sec Failed ---- Major Requests/sec Failed is the number of Outlook Web Access requests that failed, per second. Requests per second (WS) ---- Major Requests per second is the number of requests processed each second. Retry Mailbox Delivery Queue Length ---- Major Retry Mailbox Delivery Queue Length is the number of items in retry in the retry mailbox queues. Send Queue Size - Mailboxes 2 Major This counter displays the queue of messages outbound from the IS to the MTA. In the case where the MTA is down or reduced in performance there will be a non-zero value for this queue. In normal operating conditions this queue should rarely stay at a non-zero value for any significant duration. Send Queue Size - MBX 2 Major This counter displays the queue of messages outbound from the IS to the MTA. In the case where the MTA is down or reduced in performance there will be a non-zero value for this queue. In normal operating conditions this queue should rarely stay at a non-zero value for any significant duration. One instance of this profile will monitor each Mailbox Store. 28 Probe Guide for Exchange Server Monitor

29 exchange_monitor Alert Metrics Default Settings Alarm Metric Error Threshold Error Severity Description Send Queue Size - PF 2 Major This counter displays the queue of messages outbound from the IS to the MTA. In the case where the MTA is down or reduced in performance there will be a non-zero value for this queue. In normal operating conditions this queue should rarely stay at a non-zero value for any significant duration. One instance of this profile will monitor each Public Folder Store. Send Queue Size - Public Folders 2 Major This counter displays the queue of messages outbound from the IS to the MTA. In the case where the MTA is down or reduced in performance there will be a non-zero value for this queue. In normal operating conditions this queue should rarely stay at a non-zero value for any significant duration. Sync Commands per sec (ActiveSync) ---- Major Sync Commands/sec is the number of Sync commands that are processed per second. Clients use this command to synchronize items within a folder. Unreachable Queue Length ---- Major Unreachable Queue Length is the number of items in the unreachable queues. User Count ---- Major This is the actual count of people (Not connections) that are currently using the IS. Virtual Megabytes used by Information Store ---- Major Virtual Megabytes is the current size of the virtual address space the Information Store is using. Use of virtual address space does not necessarily imply corresponding use of either disk or main memory pages. Virtual space is finite, and the process can limit its ability to load libraries. Chapter 3: QoS Threshold Metrics 29

30 exchange_monitor Alert Metrics Default Settings Alarm Metric Error Threshold Error Severity Description VM Largest Block Size - Information Store 150 Major Size of the larges free virtual memory block. VM Total 16MB Free Blocks 3 Major Less than 3 indicates a problem. VM Total Large Free Block Megabytes 32 Major Less then 32 MB. Suggest restart Node on Cluster. Failover first. Work Queue Length 2 Major This is the most important counter because it gives the total of all queues. This single counter can tell an administrator at a glance the overall MTA health. This is the queue length for the whole of the MTA. It covers both inbound and outbound messages for the Information Store, the Directory and any connectors that route through the MTA. If this counter is above zero for a sustained amount of time it may indicate a communications problem with one of the Exchange components, a connector or a remote Exchange MTA. Input-Output Log Read Average Latency 200 Major Indicates the average time, in ms, to read data from a log file. Specific to log replay and database recovery operations. Note: This counter will work for DAG also. DatabaseMounted 1 Major Indicates whether database copy is mounted on local server. Note: This counter will work for DAG also. Age of the Last Notification Indexed Major Indicates content indexing backlog in seconds. Note: This counter will work for DAG also. Input-Output Log Writes Average Latency 10 Major Indicates the average time, in ms, to write a log buffer to the active log file. Note: This counter will work for DAG also. 30 Probe Guide for Exchange Server Monitor

31 exchange_monitor Alert Metrics Default Settings Alarm Metric Error Threshold Error Severity Description Time Since Last Notification Was Indexed 3600 Major Indicates the time in seconds since last notification was indexed for content indexing in passive Database. Note: This counter will work for DAG also. Exchange search zero result query 0 Major Indicates that more than one hundred search queries have returned zero results. This may indicate that a corruption or other problem affects the content indexing catalog. Note: This counter will work for DAG also. Logical Disk Percentage Free Space 35 Major Indicates the free space of logical disk in Percentage. Note: This counter will work for DAG also. Anti-Malware Agent Messages Blocked Anti-Malware Agent Messages Containing Malware Anti-Malware Agent Messages Scanned Per Second Anti-Malware Agent Messages Scanned ---- Major Messages Blocked is the number of messages in the past minute that contained malware and were blocked Major Messages Containing Malware is the number of messages in the past minute that contained malware Major Messages Scanned per Second is the average numbero of messages scanned each second, calculated over the past minute Major Messages Scanned is the number of messages scanned in the past minute. OAB Request Handling Average Time Major Average Time(in seconds) of handling a file download request during the sampling period. Messages Delivered Per Sec - Store Major Shows the rate that messages are delivered to all recipients. Indicates current message delivery rate to the store. Chapter 3: QoS Threshold Metrics 31

32 exchange_monitor Alert Metrics Default Settings Alarm Metric Messages Submitted Per Second - Information Store Inbound: Recipients Delivered Per Second-2013 Inbound: MessageDeliveryAttemptsPerSecond Error Threshold Error Severity Inbound: Major LocalDeliveryCallsPerSecond Description Major Messages Submitted Per Second is the number of messages enqueued in the submission queue per second Major Shows the number of inbound recipients delivered per second. Determines current load. Compare values to historical baselines Major Shows the number of attempts for delivering transport mail items per second. Determines current load. Compare values to historical baselines. Shows the number of local delivery attempts per second. Determines current load. Compare values to historical baselines. Monitoring profiles (Type=Process) EdgeSync ---- Major Belongs to Microsoft Exchange EdgeSync Service. EdgeTransport ---- Major Child process of the Microsoft Exchange Transport Service. File Distribution ---- Major Belongs to Microsoft Exchange File Distribution Service. Inetinfo ---- Major Belongs to Microsoft Internet Information Services (IIS). Information Store ---- Major Process of the Microsoft Exchange Information Store. Lsass ---- Major Process of the Local Security Authority Subsystem Service. Mail Submission ---- Major Belongs to Microsoft Exchange Mail Submission Service. Mailbox Assistants ---- Major Belongs to Microsoft Exchange Mailbox Assistants Service. 32 Probe Guide for Exchange Server Monitor

33 exchange_monitor Alert Metrics Default Settings Alarm Metric Error Threshold Error Severity Description Message Transfer Agent ---- Major Process of the Microsoft Exchange Message Transfer Agent. Replication ---- Major Belongs to Microsoft Exchange Replication Service. Search Indexer ---- Major Belongs to Microsoft Search Indexer service. Service Host ---- Major Belongs to Microsoft Exchange Service Host Service. System Attendant ---- Major Process of the Microsoft Exchange System Attendant. LDAP Searches timed out per minute 10 Major LDAP Searche s timed out per minute shows the number of LDAP searche s that returne d LDAP_Ti meout during the last minute. LDAP Read Time Processes 50 Major LDAP Read Time shows the time (in ms) to send an LDAP read request to the specified domain controller and receive a response. LDAP Search Time Processes 50 Major LDAP Search Time shows the time (in ms) to send an LDAP search request and receive a response. Long Running LDAP Operations Per Minute 50 Major Long running LDAP operations/min shows the number of LDAP operations on this domain controller that took longer than the specified threshold per minute. (Default threshold is 15 seconds.) Chapter 3: QoS Threshold Metrics 33

34 exchange_monitor Alert Metrics Default Settings Alarm Metric Error Threshold Error Severity Description Average Search Time ---- Major Shows the average time that elapsed while waiting for a search to complete. NSPI RPC Requests Average Latency 1000 Major Shows the average time, in ms, that NSPI requests took to complete during the sampling period. NSPI RPC Browse Requests Average Latency Unreachable Queue Length - Transport 1000 Major Shows the average time, in ms, that Name Service Provider Interface (NSPI) browse requests took to complete during the sampling period. 100 Major Unreachable Queue Length is the number of items in the unreachable queues. Mailbox Searches Per Sec Store 10 Major Number of search queries/second received per database. Transport ---- Major Belongs to Microsoft Exchange Transport Service. Transport Log Search ---- Major Belongs to Microsoft Exchange Transport Log Search Service. Monitoring profiles (Type=Service) HTTP SSL ---- Major This service implements the secure hypertext transfer protocol (HTTPS) for the HTTP service, using the Secure Socket Layer (SSL). If this service is disabled, any services that explicitly depend on it will fail to start. IIS Admin Service ---- Major Enables this server to administer Web and FTP services. If this service is stopped, the server will be unable to run Web, FTP, NNTP, or SMTP sites or configure IIS. If this service is disabled, any services that explicitly depend on it will fail to start. Microsoft Exchange Active Directory Topology Service ---- Major Provides Active Directory topology information to Exchange services. 34 Probe Guide for Exchange Server Monitor

35 exchange_monitor Alert Metrics Default Settings Alarm Metric Error Threshold Error Severity Description Microsoft Exchange ADAM ---- Major Microsoft Exchange ADAM (Active Directory Application Mode). Microsoft Exchange Address Book ---- Major Manages client address book connections. This service is dependent upon the Microsoft Exchange Active Directory Topology service. Microsoft Exchange Anti-spam Update ---- Major The Microsoft Forefront Security for Exchange Server anti-spam update service. Microsoft Exchange Credential Service ---- Major The Microsoft Exchange Credential Service. Microsoft Exchange EdgeSync ---- Major The Microsoft EdgeSync service. Microsoft Exchange File Distribution ---- Major The Microsoft File Distribution service. Microsoft Exchange Forms-Based Authentication ---- Major Provides forms-based authentication to Microsoft Office Outlook Web App and the Exchange Control Panel. If this service is stopped, Outlook Web App and the Exchange Control Panel won't authenticate users. Microsoft Exchange IMAP Major Provides Internet Message Access Protocol (IMAP4) Services to clients. Microsoft Exchange Information Store ---- Major Manages the Microsoft Exchange Information Store. This includes mailbox stores and public folder stores. Microsoft Exchange Mail Submission ---- Major Submits messages from the Mailbox server to the Hub Transport servers. Microsoft Exchange Mailbox Assistants ---- Major Performs background processing of mailboxes in the Exchange store. Chapter 3: QoS Threshold Metrics 35

36 exchange_monitor Alert Metrics Default Settings Alarm Metric Microsoft Exchange Mailbox Replication Service Error Threshold Error Severity Description ---- Major Processes mailbox moves and move requests. This service is dependent upon the Microsoft Exchange Active Directory Topology and Net.Tcp Port Sharing service. Microsoft Exchange Monitoring ---- Major Allows applications to call the Exchange diagnostic cmdlets. Microsoft Exchange MTA Stacks ---- Major The Microsoft Exchange Exchange MTA Stacks service. Microsoft Exchange POP Major Provides Post Office Protocol version 3 (POP3) Services to clients. Microsoft Exchange Protected Service Host Microsoft Exchange Replication Service ---- Major Provides a host for several Exchange services that must be protected from other services. This service is dependent upon the Microsoft Exchange Active Directory Topology service Major The Microsoft Exchange Replication Service provides replication functionality for Mailbox server role databases and is used by local continuous replication and cluster continuous replication. Microsoft Exchange Routing Engine ---- Major The Microsoft Exchange Routing Engine service. Microsoft Exchange RPC Client Access ---- Major Manages client RPC connections for Exchange. Microsoft Exchange Search Indexer ---- Major The Microsoft Exchange Replication Service provides replication functionality for Mailbox server role databases and is used by local continuous replication and cluster continuous replication. Microsoft Exchange Server Extension for Windows Server Backup ---- Major Enables Windows Server Backup users to back up and recover application data for Microsoft Exchange Server. 36 Probe Guide for Exchange Server Monitor

37 exchange_monitor Alert Metrics Default Settings Alarm Metric Error Threshold Error Severity Description Microsoft Exchange Service Host ---- Major Provides a host for several Microsoft Exchange services. Microsoft Exchange System Attendant ---- Major Provides monitoring, maintenance, and Active Directory lookup services, for example, monitors services and connectors, defragments the Exchange store, and forwards Active Directory lookups to a Global Catalog server. Microsoft Exchange Throttling ---- Major Limits the rate of user operations. Microsoft Exchange Transport ---- Major The Microsoft Exchange Transport Service. Microsoft Exchange Transport Log Search ---- Major Provides remote search capability for Microsoft Exchange Transport log files. Microsoft Search (Exchange) ---- Major Quickly creates full-text indexes on content and properties of structured and semi-structured data to allow fast linguistic searches on this data. SMTP ---- Major The Exchange Simple Mail Transfer Protocol server World Wide Web Publishing Service ---- Major Provides Web connectivity and administration through the Internet Information Services Manager. Monitoring profiles (Type=ntevl) MSExchange event ---- From Event Event log messages with source containing 'MSExchange'. DAG Number of Active Database copies Number of active database copies on current exchange server. Number of passive Database copies Number of passive database copies on current Mailbox server. Chapter 3: QoS Threshold Metrics 37

38 exchange_monitor Alert Metrics Default Settings Alarm Metric Error Threshold Error Severity Description Number of mounted Database copies Number of mounted database copies on current Mailbox server. Number of Non Mounted Database copies Number of database copies whose state is not "mounted" on current Mailbox server CopyQueueLength-DAG 1 Minor Shows the number of transaction log files waiting to be copied to the passive copy log file folder. A copy isn't considered complete until it has been checked for corruption. ReplayQueueLength-DAG 1 Minor Shows the number of transaction log files waiting to be replayed into the passive copy. Database copies status-failed 1 Minor The mailbox database copy is in a Failed state because it isn't suspended, and it isn't able to copy or replay log files. While in a Failed state and not suspended, the system will periodically check whether the problem that caused the copy status to change to Failed has been resolved. After the system has detected that the problem is resolved, and barring no other issues, the copy status will automatically change to Healthy. Database copies status-seeding 1 Minor The mailbox database copy is being seeded, the content index for the mailbox database copy is being seeded, or both are being seeded. Upon successful completion of seeding, the copy status should change to Initializing. Database copies status-seedingsource 1 Minor The mailbox database copy is being used as a source for a database copy seeding operation. 38 Probe Guide for Exchange Server Monitor