Chapter 26: Monitoring Exchange Server 2003

One key to running a successful network is keeping a close eye on its operation, especially if you are running a complex system such as a Microsoft Exchange Server 2003. By keeping close watch over your organization and its components, you can spot potential problems before they occur and can quickly respond to the problems that do occur. Monitoring also allows you to identify trends in network use that signal opportunities for optimization and future planning.

This chapter covers many of the tools that you can use to monitor Exchange Server 2003. Some of these tools, such as Event Viewer and System Monitor, are provided by Microsoft Windows Server 2003. Other tools, such as server and link monitors, are part of Exchange Server 2003 itself.

Using Event Viewer

As you might know, Windows Server 2003 records many events in its own event logs. You can view the logs of both local and remote servers by using the Event Viewer utility, which you can find in the Administrative Tools folder on the Programs menu. Windows maintains three distinct logs:

• Application The application log is a record of events generated by applications. All Exchange Server 2003 services write their status information to this log. If you enable diagnostics logging for any Exchange components, that information is also recorded in the application log. This log is the most valuable one for monitoring the general health of an Exchange server. Figure 26-1 shows an entry made in the application log following a directory access error.

  
  Figure 26-1: Reviewing an application event created by Exchange Server 2003.

• Security The security log is a record of events based on the auditing settings specified in the local policy of a machine or by group policy that applies to the machine.

• System The system log is a record of events that concern components of the system itself, including such events as device driver and network failures.

  Note

  You might also see additional event logs in Event Viewer based upon the services installed on your server. For example, a server running Domain Name System (DNS) will show a DNS Service log. Domain controllers will also show a File Replication Service and Directory Service log.

If you have a particular log file that you want to save, you have at your disposal three formats in which to save it. You can save it as a binary event log file with the .EVT extension, as a text file with the .TXT extension, or as a comma- delimited text file with the .CSV extension. Binary files with the .EVT extension can be read only with Event Viewer; the two text files can be read with your favorite ASCII editor/viewer.

You will encounter five types of events in the three logs, and a unique icon identifies each event type so that you can easily distinguish between the information entries and the error entries. Table 26-1 shows these icons and describes each of them. Normally, you will encounter only the first three icons in the table in relation to Exchange Server. The classification of events is controlled by the applications and system and cannot be configured by the administrators.

Table 26-1: Event types displayed in Event Viewer

Icon	Event	Description
	Error	A significant problem has occurred, such as an Exchange Server service that may not have started properly.
	Warning	An event has occurred that is not currently detrimental to the system but might indicate a possible future problem.
	Information	A successful operation has occurred. For example, an Exchange Server service starting successfully might trigger this type of event.
	Audit success	An audited security access attempt—for example, a successful logon to the system—was successful.
	Audit failure	An audited security access attempt—for example, a failed access to an audited file or directory—was not successful.