12.3 Best practices for monitoring Exchange with Microsoft Operations Manager | Monitoring and Managing Microsoft Exchange Server 2003 (HP Technologies)

< Day Day Up >

MOM and the MOM management packs are easy to install. If you simply install the Exchange 2003 Management Pack without doing any additional configuration work, MOM automatically discovers your Exchange servers, automatically deploys agents and rules on your Exchange servers, and begins monitoring. However, the out-of-the-box management pack installation creates an Exchange monitoring solution that is most likely collecting more data than you require in some areas and not enough data (or no data) in other critical areas. You must perform some configuration tasks to complete the “automatic” installation of the management pack and to tailor it to match your environment. This section describes the additional configuration tasks required to complete the “automatic” installation of the Exchange 2003 Management Pack.

12.3.1 Install patches

No software product is error-free, therefore the first postinstallation step is to implement corrections for known problems.

Monitoring Exchange clusters

To manage an Exchange cluster, you need to list both the physical and virtual servers in the Managed Computer Rules. However, by default, events that are logged in the event log of one cluster node are also shown in the event log of the other nodes. This feature—known as event log replication— causes MOM to generate multiple alerts for issues detected on clusters. For clusters, you need to turn off event log replication. You can do this for the entire cluster or on a per-node basis by using the Cluster.exe command line tool to configure the EnableEventLogReplication property.

12.3.2 Disable unneeded rules

Before making any adjustments, the Exchange Management Pack is probably collecting quite a bit of data that you do not need. This is especially true if you are using your MOM server to monitor only Exchange servers—i.e., other groups (and other MOM servers) are responsible for monitoring Active Directory, IIS, DNS, and so on. MOM is probably also collecting the same data through similar rules in different rule groups. The following sections describe procedures for disabling unnecessary rules.

Disable % Disk Time _Total Logical Disk Rule

Monitoring the % Disk Time _Total Logical Disk performance monitor counter is meaningless for servers with multiple logical drives. Because almost all Exchange servers have multiple logical disk drives, you should use the following procedure to disable this rule for Exchange servers.

Start the MOM Administrator Console from the Windows Start menu by selecting All Programs →Microsoft Operations Manager →MOM Administrator Console.
In the left pane of the MOM Administrator Console, select Microsoft Operations Manager →Rules →Processing Rule Groups →Microsoft Windows 2000 Operating System →Windows 2000 – All Computers →Threshold Performance Counters for Windows 2000 →Performance Processing Rules.
In the right pane, right-click the % Disk Time _Total Logical Disk rule and select Properties (Figure 12.19).

Figure 12.19: % Disk Time _Total Logical Disk
Clear the Enabled check box and select OK.

Disable % Total Processor Time (95) averaged over 6 samples rule

Monitoring the % Total Processor Time (95) averaged over 6 samples performance counter can sometimes produce misleading results if you are using full-text indexing. The full-text indexing feature takes advantage of any available CPU cycles (using low-priority threads) to generate the indexes, thus giving the appearance that the server CPU is fully saturated. You should disable the % Total Processor Time (95) averaged over 6 samples rule if you are using full-text indexing. The following procedure can be used to disable this rule.

Start the MOM Administrator Console from the Windows Start menu by selecting All Programs →Microsoft Operations Manager →MOM Administrator Console.
In the left pane of the MOM Administrator Console, select Microsoft Operations Manager →Rules →Processing Rule Groups →Microsoft Windows 2000 Operating System →Windows 2000 – All Computers →Threshold Performance Counters for Windows 2000 →Performance Processing Rules.
In the right pane, right-click the % Total Processor Time (95) averaged over 6 samples rule and select Properties (Figure 12.20).

Figure 12.20: % Total Processor Time (95) averaged over 6 samples
Clear the Enabled check box and select OK.

Disable Windows System (Events and Performance) rule group

The Reporting – Windows System (Events and Performance) (shared) rule group collects a large amount of performance data. If you are only monitoring Exchange servers, you should disable these rules because there are similar rules in the Exchange Management Pack that monitor the right set of performance counters for Exchange servers. The following procedure can be used to disable this rule group.

Start the MOM Administrator Console from the Windows Start menu by selecting All Programs →Microsoft Operations Manager →MOM Administrator Console.
In the left pane of the MOM Administrator Console, select Microsoft Operations Manager →Rules →Processing Rule Groups →Microsoft Windows 2000 Operating System →Windows 2000 – All Computers →Windows 2000 System Reporting →Reporting – Windows System (Events and Performance) (shared).
In the left pane, right-click on Reporting – Windows System (Events and Performance) (shared) and select Properties (Figure 12.21).

Figure 12.21: Reporting – Windows System (Events and Performance)
Clear the Enabled check box and select OK.

Disable Default Event Collection for Microsoft Windows rule group

MOM includes a set of rules called the Default Event Collection for Microsoft Windows NT and 2000 rule group. This is a “collect everything” rule group, and you should disable all rules in this rule group to prevent collecting far more information than you need. The following procedure can be used to disable this rule group.

Start the MOM Administrator Console from the Windows Start menu by selecting All Programs →Microsoft Operations Manager →MOM Administrator Console.
In the left pane of the MOM Administrator Console, select Microsoft Operations Manager →Rules →Processing Rule Groups →Default Event Collection for Microsoft Windows NT and 2000.
In the left pane, right-click on Default Event Collection for Microsoft Windows NT and 2000 and select Properties (Figure 12.22).

Figure 12.22: Default Event Collection for Microsoft Windows NT and 2000
Clear the Enabled check box and select OK.

Disable Internet Information Server Shared Rules rule group

Because Exchange uses Internet protocol services, the Exchange Management Pack includes rules to monitor the IIS components used by Exchange. If your MOM server is only monitoring Exchange, you should disable the corresponding rules in the IIS rules group using the following procedure.

Start the MOM Administrator Console from the Windows Start menu by selecting All Programs →Microsoft Operations Manager →MOM Administrator Console.

In the left pane of the MOM Administrator Console, select Microsoft Operations Manager →Rules →Processing Rule Groups →Microsoft Internet Information Server (IIS) →IIS 5.0 →IIS Shared Rules.
In the left pane, right-click the IIS Shared Rules folder and select Properties (Figure 12.23).

Figure 12.23: Internet Information Server shared rules
Clear the Enabled check box and select OK.

Disable Internet Information Server queue length threshold rules

The SMTP queue length thresholds defined in the IIS rules are too low for most Exchange deployments. You should disable the IIS queue length threshold rules in favor of the corresponding rules found in the Exchange Management Pack. The following procedure can be used to disable the IIS rules.

Start the MOM Administrator Console from the Windows Start menu by selecting All Programs →Microsoft Operations Manager →MOM Administrator Console.
In the left pane of the MOM Administrator Console, select Microsoft Operations Manager →Rules →Processing Rule Groups →Microsoft Internet Information Server (IIS) →IIS 5.0 →Performance Counters for IIS 5.0 →Threshold Performance counters for IIS (shared) →Performance Processing Rules.
In the right pane, right-click on the Local Queue Length (50) rule and select Properties (Figure 12.24).

Figure 12.24: Local queue length (50)
Clear the Enable check box and select OK.
Repeat steps 3 and 4 for the following performance processing rules: Local Queue Length (10), Not Found Errors/sec (1), Total Not Found Errors (1000), Local Retry Queue Length (10), Local Retry Queue Length (50), Remote Queue Length (10), Remote Queue Length (50), Remote Retry Queue Length (50), and Connection Errors/sec (3).

Disable rules for unused Exchange components

You should install the entire Exchange Management Pack rather than pick and choose the rules you want to implement. Microsoft has made those choices for you, and you should use their rule selections except where there are specific Exchange components that you do not use. For example, if you do not use Post Office Protocol 3 (POP3), the following procedure can be used to turn off the POP3 rule group.

Start the MOM Administrator Console from the Windows Start menu by selecting All Programs →Microsoft Operations Manager →MOM Administrator Console.
In the left pane of the MOM Administrator Console, select Microsoft Operations Manager →Rules →Processing Rule Groups →Microsoft Exchange 2003 Server →Exchange Event Monitoring →POP3.
In the left pane, right-click the POP3 folder and select Properties (Figure 12.25).

Figure 12.25: Post Office Protocol 3
Clear the Enabled check box and select OK.
Repeat steps 3 and 4 for any other unused Exchange components, such as the Active Directory Connector, Active Sync, Exchange Cluster, IMAP4, Outlook Mobil Access, Outlook Web Access, and other components.

12.3.3 Create accounts and mailboxes

The Exchange Management Pack scripts require an agent service account and test mailboxes. The following sections describe these requirements.

Grant Exchange View-Only Administrator role to agent service account

MOM and the MOM management packs (not just the Exchange Management Pack) include many scripts. MOM uses an agent service account to run these scripts. The Exchange scripts require that you grant the existing agent service account the Exchange View-Only Administrator role. The following procedure can be used to grant the Exchange View-Only Administrator role.

Start ESM console from the Windows Start menu by selecting All Programs →Microsoft Exchange →System Manager.
In the ESM left pane, right-click on the Exchange organization object and select Delegate Control to start the wizard. When the wizard displays an introductory screen, select Next to continue.
The Users or Groups window (Figure 12.26) displays the users and groups who currently have assigned roles for the Exchange organization. If the agent service account is not listed as Exchange Full Administrator, Exchange Administrator, or Exchange View-Only Administrator, select Add to display the Delegate Control window (Figure 12.27).

Figure 12.26: Exchange Administration Delegation Wizard

Figure 12.27: Exchange Administration Delegation Wizard – User and Role Selection

In the Delegate Control window, use the Browse button to find the agent service account. Use the drop-down list to select the Exchange View-Only Administrator role. When you have selected the user and role, select OK to return to the Users or Groups window.

Select Next to display the summary screen. When you have finished reviewing the summary of changes, select Finish to implement the new role.

Create test mailbox(es)

The MAPI logon, mail flow, mailbox statistics collection, and public folder statistics collection rules require an agent mailbox on each Exchange server. For Exchange clusters, you only need to create a test mailbox for the Exchange virtual server, not for each physical node. You do not need to (and cannot) create test mailboxes on front end Exchange servers because front end servers do not have mailboxes. The following procedure can be used to create a test mailbox account for each database on each Exchange server.

On a domain controller, start the Active Directory Users and Computers.
In the left pane, right-click on Users and select New →User to display the New Object – User dialog box.
In the Full name and User logon name fields, enter the name as <server >MOM. For example, if the server name is Exc14, then the test mailbox account should be Exc14MOM. If you have multiple database files on a server, you should add more test mailbox accounts with logon name <server >MOM#, where # can be any number or word. You must name the first test mailbox account as <server >MOM. Select Next to display the password information dialog box.
Enter information about the test mailbox account password, confirm the new password by retyping it, and select the password options for User cannot change password, Password never expires, and Account is disabled. The account is disabled because the MOM scripts only need the mailbox, not the test account. The scripts use the agent service account to access the mailbox. Select Next to continue.
Select the Create an Exchange mailbox check box to automatically create an Exchange mailbox using the alias, Exchange server, and Information Store shown in the Alias, Server, and Mailbox Store fields. For servers with multiple databases, you should create separate test mailbox accounts for each database. Select Next to display a dialog box summarizing the information you entered.
Verify that the information is correct and then select Finish to create the Windows test account and associated Exchange mailbox.

Grant mailbox rights to agent service account

The Exchange MOM scripts use the agent service account to access the mailbox. The following procedure can be used to give mailbox rights to the agent service account.

On a domain controller, start the Active Directory Users and Computers.
In the right pane, right-click the test mailbox account you just created and select Properties. Select the Exchange Advanced tab.
Select the Mailbox Rights button.
In the Group or user names window, select Add to add users to the list. Add the agent service account and select the Full mailbox access check box. Select OK to grant full mailbox access to the agent service account.

12.3.4 Tailor Microsoft Operations Manager to match your needs

Collecting and storing MOM events and performance data requires network bandwidth and database storage space. Responding to events and alerts requires human bandwidth. It makes no sense to collect more information than needed to manage your environment. You should tailor MOM to match your needs.

Auto-resolve information and success alerts

You should set the Auto resolve information Alerts and Auto resolve success Alerts values to a relatively short timeframe. Success and information alerts are just informational in nature and do not require operator action. Setting these auto-resolve times to 30 minutes will keep the alerts available for a short period in case an operator is interested but will quickly auto-resolve them to minimize the “noise” level for operators. The following procedure can be used to change these values.

Start the MOM Administrator Console from the Windows Start menu by selecting All Programs →Microsoft Operations Manager →MOM Administrator Console.
In the left pane of the MOM Administrator Console, select Microsoft Operations Manager →Configuration →Global Settings.
In the left pane, right-click on Global Settings and select Edit General Settings.
On the Database Grooming tab (Figure 12.28), select the value to change and select Edit.

Figure 12.28: Global Settings – Database Grooming Settings

Configure alert resolution states

MOM is preconfigured with the resolution states shown in Figure 12.29. However, you should think about how your operations staff works and change the resolution states to fit your organization. Use the actual names of your support teams and change the SLA escalation times to match the way your organization works. The following procedure can be used to change these preconfigured values.

Figure 12.29: Global Settings – Alert Resolution States

Start the MOM Administrator Console from the Windows Start menu by selecting All Programs →Microsoft Operations Manager →MOM Administrator Console.
In the left pane of the MOM Administrator Console, select Microsoft Operations Manager →Configuration →Global Settings.
In the left pane, right-click on Global Settings and select Edit General Settings.
On the Alert Resolution States tab, select the value to change and select Modify.

Configure heartbeat frequency

The MOM agent on the managed server periodically sends a heartbeat message to the MOM server to let MOM know that the monitored server is still running and is connected to the network. By default, the agent sends a heartbeat message every 5 minutes (300 seconds). For Exchange servers, you should decrease the heartbeat frequency to 30 seconds. The following procedure can be used to configure the heartbeat frequency.

Start the MOM Administrator Console from the Windows Start menu by selecting All Programs →Microsoft Operations Manager →MOM Administrator Console.
In the left pane of the MOM Administrator Console, select Microsoft Operations Manager →Configuration →Global Settings.
In the left pane, right-click on Global Settings and select Edit Agent Settings (Figure 12.30).

Figure 12.30: Global Settings – heartbeat
Change the heartbeat period to 30 seconds. Select OK.

Enable Service Availability Checking and Reporting

You also should consider if you want to use the following availability reports: Windows Service Availability by Computer, Windows Service Availability by Server, and Windows Service Availability by Service. These are part of the MOM functionality rather than the Exchange Management Pack and provide reports on service availability and computer availability. These generate considerable data. If you do not plan to use these reports, the following procedure can be used to save database disk space:

Start the MOM Administrator Console from the Windows Start menu by selecting All Programs →Microsoft Operations Manager →MOM Administrator Console.
In the left pane of the MOM Administrator Console, select Microsoft Operations Manager →Configuration →Global Settings.
In the left pane, right-click on Global Settings and select Edit Agent Settings (Figure 12.31).

Figure 12.31: Global Settings – Service availability checking and reporting
On the Service Availability tab, clear the Enable service availability checking and reporting check box.

Enable logical disk counters

The data for the disk capacity rules come from the logical disk performance monitor counters. You must enable these counters on each monitored Exchange servers using the following procedure.

From a Windows command prompt, enter diskperf –Y.
Reboot the server.

Enable Message Tracking Logs for traffic analysis reports

The Report Collection – Message Tracking Log Data rule periodically collects, logs, and analyzes data from the Exchange message tracking logs. The traffic analysis reports use the collected data to produce reports detailing various aspects of the messaging traffic. To gather the data for these reports you must enable message tracking logs on each Exchange server using the following procedure.

Start ESM from the Windows Start menu by selecting All Programs →Microsoft Exchange →System Manager.
In the ESM left pane, select Administrative Groups →First Administrative Group →Servers.
Right-click on your server and select Properties. Select the General tab (Figure 12.32).

Figure 12.32: Exchange Server Properties – message tracking
Select the Enable message tracking check box to enable message tracking for the server. Exchange will log the sender, the time the message was sent or received, the message size, the message priority, and message recipients for each message that travels through this server.
Select OK.

Set mail queue threshold values

The predefined thresholds should be adequate as a starting point for most performance-based rules. However, the mail queue thresholds will vary greatly depending on your traffic patterns. To determine the appropriate values for your environment, you should watch the queue length over a period. After gathering historical data, the following procedure can be used to set mail queue threshold values that are appropriate for your environment.

Start the MOM Administrator Console from the Windows Start menu by selecting All Programs →Microsoft Operations Manager →MOM Administrator Console.
In the left pane of the MOM Administrator Console, select Microsoft Operations Manager →Rules Processing Rule Groups →Microsoft Exchange Server 2003 →Health Monitoring and Performance Thresholds →Mail Queue Thresholds →Performance Processing Rules.
In the right pane, right-click the queue threshold rule you want to change and select Properties. Select the Threshold tab (Figure 12.33).

Figure 12.33: Mail Queue Thresholds
Enter the new threshold value and select OK.
Repeat steps 3 and 4 as necessary to change threshold values for other queues.

12.3.5 Configure mail flow verification and services to monitor

Identify services to monitor on each Exchange server

The Service Verification Script periodically checks to determine whether Exchange services (e.g., MSExchangeIS, MSExchangeSA, MSExchangeMTA) are running. The management pack stores the list of services in a registry key, and before Service Pack 1, you had to use Regedit to enter the list of services. Microsoft included a new configuration utility in MOM Service Pack 1 that simplifies the customization of certain Exchange Management Pack features, including automating the process for designating the Exchange services to monitor. From the MOM server, this utility sets the Exchange-related registry keys on every Exchange server.

Note

You can find a zip file (Ex2KMPSnapIn.zip) containing the configuration utility Microsoft Management Console snap-in in the Support Tools directory on the MOM Service Pack 1 product CD.

The following procedure can be used to specify the key services to monitor-on each Exchange server.

Start the Exchange MP Configuration Utility from the Windows Start menu by selecting All Programs →Exchange 2000 MP Configuration Utility.
Select All Servers in the left pane.
In the right pane, right-click on the server you want to monitor and select Properties to display the Management Pack Settings dialog box (Figure 12.34).

Figure 12.34: Configuration Utility – Monitored services
In the Monitored Services window, select the check boxes for the services you want to monitor. Select OK.

Identify mail flow verification servers

The mail flow verification scripts periodically send mail between the test mailbox accounts and verify that the mail has been received. You must configure the sending and receiving servers to know where to send mail and from where to expect mail. The management pack stores this information in registry keys, and the configuration utility included in Service Pack 1 automates this process and eliminates the need to make manual registry modifications.

The following procedure can be used to specify the sending and receiving servers.

Start the Exchange MP Configuration Utility. Select All Servers in the left pane.
In the right pane, right-click on the appropriate server and select Properties to display the Management Pack Settings dialog box.
In the Send mail to window (see Figure 12.34), select the check box for the servers to which this server will send mail.
In the Expect mail from (select only one) window, select the check box for the server that will send mail to this server. Select OK.

Configure time interval for mail flow verification

Use the following procedure to configure the time interval for the mail flow verification tests for each sending and receiving Exchange.

Start the MOM Administrator Console from the Windows Start menu by selecting All Programs →Microsoft Operations Manager →MOM Administrator Console.
In the left pane of the MOM Administrator Console, select Microsoft Operations Manager →Rules →Processing Rule Groups →Microsoft Exchange Server 2003 →Availability Monitoring →Verify Mail Flow →Event Processing Rules.
Data Provider tab In the right pane, right-click the Send mail flow messages event processing rule and select Properties. Select the Data Provider tab (Figure 12.35).

Figure 12.35: Mail flow – send mail flow messages
Select the desired provider with the type Timed Event and synchronize the provider. If necessary, create and synchronize a new provider. Select OK to configure the Send mail flow messages script.
In the right pane, right-click the Receive mail flow messages event processing rule and select Properties. Select the Data Provider tab (Figure 12.36).

Figure 12.36: Mail flow – Receive mail flow messages
Select a timed event with the same frequency as the one selected for Send mail flow messages but synchronize at a different time.
Responses tab Select the Responses tab.
Select Exchange 2003 – Mail flow receiver and select Edit to display the Launch a Script dialog box.
Double-click the MAXSafeMissedRuns parameter (Figure 12.37), and enter the number of failed attempts to receive mail before generating an alert. The default is four attempts. Select OK.

Figure 12.37: Mail flow – MAXSafeMissed Runs

< Day Day Up >