11.2 Monitoring messaging system health

---

The goals of System Health Monitoring are:

• Rapid detection and notification of actual failures. This allows the administrator to restore the system to proper working order as quickly as possible, thus minimizing the user impact.

• Problem resolution. Monitoring provides detailed knowledge of the problem, giving the administrator an important head start for restoring the system.

• Predicting impending failures. This enables the administrator to correct the impending problem before it affects users.

At a minimum, the scope of system health monitoring should include the Exchange server hardware, Windows operating system software, Exchange software, antivirus software, backup software, Internet Information Services, and any other software that is essential for reliable operation of the messaging environment. If the network operations staff is not already monitoring key network components, such as Domain Name System servers and Simple Mail Transfer Protocol (SMTP) relay systems, these should be added to the list of monitored components.

Exchange server events can be generated from system-detected events written to the Windows event log, events detected by system and network management tools, or events generated by Exchange management software agents as a result of a monitored state change or threshold violation.

Important messaging system health indicators are not all generated by messaging system monitors. The following sources of information are often the first place where a potential problem can be seen.

• Events written to the Windows event log. Critical events should be sent to the monitoring console. This may be done by configuration of the Windows event log to generate Simple Network Management Protocol traps to the management systems or by use of management agents that generate alerts using a proprietary or custom mechanism.

• Events detected by system and network management tools. Often, events detected by agents monitoring the underlying systems or network can have a direct impact on the Exchange messaging environment. The Exchange operations team needs to be informed of critical events detected by system management tools or by network monitoring tools. This will allow correlation of system and network faults with Exchange alerts. This correlation of events can be done either manually or automatically using event correlation software that is part of many third-party products.

• Exchange state changes and threshold violations. Events generated by the Exchange management software agents because of detection of a monitored state change or threshold violation may indicate a server fault or a resource that is being depleted.

The process of monitoring the Exchange messaging environment includes periodically checking the Exchange services, servers, queues, connections, and underlying network for problems and then alerting the appropriate people to correct the problems. Included with Windows and Exchange products are the following primary monitoring components:

• Exchange System Manager (ESM) console

• Windows Performance Monitor

• Windows Event Viewer

---