Chapter 25, "Monitoring Exchange," goes into more detail about how to use monitors to diagnose problems.
The following terms are pertinent to using Exchange monitoring tools:
As an Exchange administrator, there are two fundamental ways in which you can be notified of a downed messaging link:
Link monitors watch for successful message connections between two points in an Exchange organization. They also can be configured to test connections to foreign messaging systems. Link monitors accomplish this by sending out a test message, called a ping message, and timing the round trip of that message.
A link monitor sends a ping message to test messaging connections. At the polling interval, a ping message is sent to every Exchange server and foreign system listed on the link monitor's servers' property page.
To create a new link monitor, follow this procedure:
FIG. 26.1 The Monitors container shows all monitors in the selected site. In our example, monitors can be made and executed anywhere in the organization with proper permissions.
The link monitor has several property pages which enable the following options:
These pages are described in more detail in the following sections.
The General page enables you to name the monitor, set the polling interval, and optionally select a log file location. Use the following procedure to configure the link monitor:
FIG. 26.2 The Link Monitor property page enables you to define a polling interval for this monitor.
NOTE: Logging for link monitor activity is optional, so you need not specify a Log File location.
The Notification property page enables you to configure what happens when abnormal message link functioning is detected by a server monitor. There are three main types of notification:
The Notification property page is primarily one main display window list where all notification objects are displayed (see Figure 26.3). By default, this window is blank, and no notification is specific.
FIG. 26.3 The Link Monitor Notification property page shows whom to contact in case of malfunctions.
Click New to define a new notification object. Select the type of notification (see Figure 26.4).
FIG. 26.4 Select a Notification Type.
Launching a Notification Process Configuring an external notification application is as easy as choosing the application and setting the time delay for notification. You must configure that external process for the specific type of notification it provides (see Figure 26.5). All Exchange does is launch the process and pass along any additional required parameters.
FIG. 26.5 Configure the parameters for the notification process.
To configure the Launch Process Notification properties, do the following:
TIP: If the external notification application is already configured, you can now use the Test button to verify a property is functioning.
You can change a notification by selecting it from the Notification list and clicking Edit. You can delete a notification by selecting it from the list and clicking Remove.
Using Mail Message Notification Mail notification will alert an administrator via e-mail that a server has entered an alert state (or a warning state) due to excessive delays between message returns.
To configure Mail Message Notification properties, follow the procedure detailed in the list following Figure 26.6.
FIG. 26.6 Configure mail message Notification properties.
Using Windows NT Alerts otification by Windows NT Alert (see Figure 26.7) is useful only if the recipient computer is turned on and a user is logged on to it. These alerts are transmitted via the Windows NT Message service and are displayed on-screen to a user.
FIG. 26.7 Define Windows NT Alert parameters.
To configure notification properties for Windows NT Alert, follow these steps:
The Servers property page enables you to determine to which Exchange servers the link monitor will send ping messages. Follow these steps:
FIG. 26.8 Select which Exchange servers will receive ping messages.
The Recipients property page enables you to configure ping message recipients in foreign messaging systems. At each polling interval, selected foreign recipients will receive a ping message. You must configure each recipient as a custom recipient in the Exchange administrator program. The link monitor will look at the returned ping message subject line for confirmation of message integrity. Alternatively, you can have the link monitor look at the returned message's body.
For link monitoring, ping messages must be returned by a foreign system. You must write a script that will return the ping message. Another common solution is to send a message to a nonexistent address on that system; the system then returns the nondeliverable message to the link monitor.
NOTE: Some systems do not automatically return messages sent to nonexistent addresses; they redirect them into a default mailbox. Make sure the foreign system is configured to bounce back messages sent to nonexistent addresses.
TIP: Create a separate container to hold the custom recipients created for foreign system link monitoring. Also, set the Hide from Address Book option for each recipient, so that others in your organization will not accidentally send messages to the custom recipients.
The Bounce property page allows you the maximum allowable round-trips before a server enters a warning or alert state.
CAUTION: If you have created redundant paths to other Exchange sites or foreign messaging systems, the link monitor will not inform you that the primary link is down if the secondary link returns the ping message prior to the server entering an alert state.
To define bounce times, follow this procedure:
After configuring all Link Monitor property pages, you must start the link monitor for it to carry out its functions. See the section "Starting and Using a Monitor" later in this chapter.
FIG. 26.9 Use this page to define threshold time before entering warning and alert states.
A server monitor watches a selected list of Windows NT services for proper functioning. At each polling interval, the server monitor checks to see that the server is running by connecting to that server via a remote procedure call. The server's status is displayed in the server monitor's display window. You can also control (start, stop, or pause) services via the server monitor display window.
Additionally, these monitors can be used to monitor services that are not directly pertinent to Exchange if desired.
To create a new server monitor, follow this procedure:
The server monitor has several property pages, which enable the following options:
The Services property page shown on Figure 26.12 enables you to define which services a Microsoft Exchange server monitor will check. It is identical to the page found on the Server Monitor Servers page. The top display window shows all services currently installed on this Windows NT server; the bottom display window shows the monitored services. Follow this procedure:
If your organization includes several people who need to be notified of servers' malfunction, you must create separate server monitors. Also, if you want to set a different polling interval for a specific group of servers, you must create unique server monitors.
The General property page allows you to name the server monitor, determine the polling interval, and determine the location for a log file, if one is desired.
To configure general settings for the server monitor, follow this procedure:
FIG. 26.10 Name this monitor and set its polling interval.
The Notification property page enables you to configure what happens when a server monitor detects abnormal functioning. There are three main types of notification:
The Notification property page is primarily one main display window in which all notification objects are displayed. By default, this property page is blank.
Click New to define a new notification object. Select the type of notification.
Launching a Notification Process Configuring an external notification application is as easy as choosing the application and setting the time delay for notification. You must configure that external process for the specific type of notification it provides. All Exchange does is launch the process and pass along any additional required parameters.
To configure Launch Process Notification properties, follow this procedure:
TIP: If the external notification application is already configured, you may now use the Test button to verify a property is functioning.
You can change a notification by selecting it from the Notification list and clicking Edit. You can delete a notification by selecting it from the list and clicking Remove.
Using Mail Message Notification Mail message notification will alert an administrator via e-mail that a server has entered an alert state (or warning state as well, if desired).
To configure Mail Notification properties, follow this procedure:
Using Windows NT Alerts otification by Windows NT Alert is useful only if the recipient computer is turned on and a user is logged on to it. These alerts are transmitted via the Windows NT Message service and are displayed on-screen to the specific user.
To configure notification properties for Windows NT Alert, follow these steps:
The Servers property page lets you determine what servers the server monitor is monitoring. Follow this procedure:
You can determine specific services to be monitored for each selected Exchange server. By default, only the core Microsoft Exchange services (Directory, Information Store, and MTA) are configured for monitoring. Monitored services can also be configured on the property pages for each individual Exchange server.
FIG. 26.11 Select which servers this monitor will watch.
Configuring Monitored Services with the Server Monitor To configure monitored services with the server monitor, follow this procedure:
NOTE: This dialog box is identical to the Services tab in an individual server's property pages.
FIG. 26.12 Add or remove services to be monitored.
Configuring Monitored Services from Exchange Server Property Pages To open Server property pages, follow this procedure:
Use the Actions property page to define what steps are to be taken when a monitored service ceases to function. By default, no action is taken when a service goes down (except notifi-cation). Settings on this dialog box apply to all Exchange servers selected on the Servers property page. If you want to define different actions for other servers, you must create additional server monitors. There are three action choices to configure:
First attempt actions are executed the first time a service is polled and found to be in a warning or alert state. The second attempt is made after the second time, and subsequent attempts are made any time after the first two.
To configure Actions, follow this procedure:
FIG. 26.13 Define what actions the server monitor should take upon detecting a service malfunction.
NOTE: Actions defined in this property page are performed in addition to any notification action.
The Clock property page configures system clock monitoring. Proper system clock synchronization is essential to running an efficient Exchange organization. Because so many connectors, gateways, and general maintenance processes depend on system-clock-based schedules, an incorrect time setting could create many problems. The monitoring computer will generate an alert if both computers' system clocks are off by a predetermined number of seconds.
To set clock monitoring, follow this procedure:
FIG. 26.14 Make sure clocks in your organization are properly synchronized.
After creating a monitor, you must start it in order for it to perform its functions. You can start a monitor manually from the administrator program or automatically from the command line. The monitor's window must be open (or minimized at all times) when it is running.
You can configure a server monitor for automatic startup by creating a program item for it in the Program Manager Startup group. The following sequence automatically starts the administrator program and designated monitors when you log on to Windows NT:
E:\exchange\bin\admin.exe /mGARLAND\WATCHSERVER\GARLAND01
E:\exchange\bin\admin.exe /mGARLAND\WATCHSERVER\GARLAND01 /mGARLAND\LinkIT\GARLAND01
You can start a monitor from another server in the organization. In the following examples the monitors were constructed and started at the Garland site. Note that the monitors exist in Los Angeles as well. To start a monitor manually from the administrator program, follow this procedure:
NOTE: You must connect to a specific server in order to execute server-based operations, such as sending mail.
FIG. 26.15 The administrator program's Start Monitor command.
Monitor status windows are the portals through which you view the current condition of monitored links and servers. The status windows periodically update and display data on their operation. With enough strategically placed monitors, you can get an overall feel of your organization's messaging conditions from a single machine in your enterprise.
The Link Monitor window displays the condition of monitored links; each line in the display represents one link. You can sort the display using the Column Heading buttons. You can also change the width of the columns to make the display easier to read (see Figure 26.16).
FIG. 26.16 A functioning Link Monitor window.
The columns indicate the following things:
Up | Link is operational. |
Down | Link is not operational. |
Exclamation point | Warning state. |
Question mark | Link is not yet monitored. |
The Server Monitor window displays one line for each server being monitored. The status icon reflects the status of all server components. If any component is down, the server is considered to be down (see Figure 26.17).
FIG. 26.17 A functioning Server Monitor window.
The columns indicate the following things:
Up | Server is operational. |
Down | Server is not operational. |
Exclamation point (!) | Warning state. |
Question mark (?) | Server is not yet monitored. |
Double-clicking a status message in either a link or server monitor will bring up property pages with status information. See Chapter 28, "Troubleshooting Exchange with Diagnostic Tools," for an explanation of these property pages.
When bringing an Exchange server down for maintenance, consider the effects on monitors watching the server. Any server monitors will notice the halted services, initiate notifications, and enter an alert state. Any link monitors watching messaging connections through this server will enter alert mode and send out applicable notifications as well.
To prevent these problems, you can put a server into maintenance mode. When a monitor polls a server in this mode, it knows not to go through the normal alert and warning routines.
The command to specify a maintenance mode for a server is as follows:
ADMIN /t
After this command is executed, each monitor learns of the server's maintenance status at the next server poll. Keep in mind each monitor's polling interval to be sure that all monitors are notified before you bring a server down.
The command can be modified with these additional switches:
-n | Halts notification processes on a monitor, but keeps monitor-initiated repairs |
-r | Keeps monitor-initiated notifications, but halts repair processes on a monitor |
-nr | Halts both notification and repair processes |
-t | Resets the monitor to normal mode |
To confirm that a monitor has received a maintenance notification, open a link or a server entry in the monitor and select its Maintenance property page. The checkboxes will reveal this information.
If your system supports SNMP (Simple Network Management Protocol), you can use SNMP to monitor and support your Exchange organization.
Microsoft Exchange Server complies with RFC 1566, which defines industry standards for Management Information Base for SNMP Mail and Directory Management, otherwise known as MADMAN MIB.
By making Windows NT Performance Monitor counters available for MIB objects, Microsoft Exchange supports SNMP.
All counters accessed by the Exchange MTA and the Internet Mail Service can be accessed by SNMP, which surpasses the requirements of RFC 1566.
Table 26.1 identifies the MIB objects defined in RFC 1566 and their corresponding Exchange Server counters.
MSExchangeIMC Counter | MSExchangeMTA MIB Object Counter | |
MTAReceivedMessages | Inbound Messages Total | Inbound Messages Total |
MTAStoredMessages | Total Messages Queued | Work Queue Length |
MTATransmittedMessages | Outbound Messages Total | Outbound Messages Total |
MTAReceivedVolume | Inbound Bytes Total | Inbound Bytes Total |
MTAStoredVolume | Total Bytes Queued | Work Bytes Queued |
MTATransmittedVolume | Outbound Bytes Total | Outbound Bytes Total |
MTAReceivedRecipients | Total Recipients Inbound | Total Recipients Inbound |
MTAStoredRecipients | Total Recipients Queued | Total Recipients Queued |
MTATransmittedRecipients | Total Recipients Outbound | Total Recipients Outbound |
MTALoopsDetected | Total Loops Detected | Total Loops Detected |
Table 26.2 lists the MIB group objects and their related MTA Connections counters.
MIB Object | MSExchangeMTA Connections Counter |
MTAGroupReceivedMessages | Inbound Messages Total |
MTAGroupRejectedMessages | Inbound Rejected Total |
MTAGroupStoredMessages | Queue Length |
MTAGroupTransmittedMessages | Outbound Messages Total |
MTAGroupReceivedVolume | Inbound Bytes Total |
MTAGroupStoredVolume | Queued Bytes |
MTAGroupTransmittedVolume | Outbound Bytes Total |
MTAGroupReceivedRecipients | Total Recipients Inbound |
MTAGroupStoredRecipients | Total Recipients Queue |
DMTAGroupTransmittedRecipients | Total Recipients Outbound |
MTAGroupOldestMessageStored | Oldest Message Queued (seconds) |
MTAGroupInboundAssociations | Current Inbound Associations |
MTAGroupOutboundAssociations | Current Outbound Associations |
MTAGroupLastInboundActivity | Last Inbound Association (seconds) |
MTAGroupLastOutboundActivity | Last Outbound Association (seconds) |
MTAGroupScheduledRetry | Next Association Retry (seconds) |
By accessing the MIBs in the mib.bin file, the Windows NT Server SNMP agent can respond to SNMP requests. To enable Exchange Server to support SNMP, you must install the MIB for the Microsoft Exchange Server computer (exchange.mib) on your server in the mib.bin file.
A compiled version of Exchange.mib is provided by Microsoft Exchange Server, which is installed by running a batch file from the Exchange Server CD-ROM. The following section, "Using the Batch File," explains how to run this file. If extension MIBs on your server have been configured, you must use other tools to install Exchange.mib rather than the batch file. These other tools to install Exchange.mib are also found on the Exchange Server CD-ROM.
NOTE: The Windows NT SNMP service must be installed prior to installing SNMP support for Exchange. To install the Windows NT SNMP service from Control Panel, choose Network. After you install the service, you must reinstall Windows NT Service Pack 3.
As mentioned in the preceding section, if you have not installed any MIBs on your server other than those included with Windows NT, you can run the batch file included on the Exchange Server CD-ROM. The batch file is located in the following directory:
SUPPORT\SNMP\platform\INSTALL.BAT
Microsoft Exchange Server provides tools for SNMP support. Perf2mib.exe compiles Performance Monitor counters into a new MIB for Exchange Server. Mibcc.exe recompiles the Perfmib.mib file created by Perf2mib.exe and creates a new mib.bin file. Use the following procedure to use Perf2mib.exe and Mibcc.exe:
Any SNMP version 1-compatible management console can view the Microsoft Exchange Server MIB. Your management console may need to load the MIB file for the object descriptions, which is available on the Exchange Server CD-ROM. You can also use the SNMPUTIL utility, available with the Windows NT Resource Kit, to view a MIB. l