Chapter 21: Logging, Auditing, and Monitoring

Overview

On a day-to-day basis, Exchange Server does not require a lot of direct attention. Once it's is set up and configured properly, the server itself can pretty much just sit on a corner of your computer room and run. You don't need to regularly reboot the server. You don't need to be performing maintenance on the databases. There are very few day-to-day tasks that require direct management on the Exchange server.

This brings us to the big question, What do you need to do to an Exchange server? We have broken down the "daily" tasks in to "the big five." The five most important daily management tasks for Exchange Server are as follows:

• Perform and verify daily backups of Exchange data.

• Check available disk space.

• Confirm that the message hygiene system (antivirus and anti-spam) are running and have up-to-date signatures.

• Review the event logs for errors and warnings.

• Check the message queues for stalled messages.

Did you notice something about this list? There is really nothing that you are doing directly to the Exchange server except running daily backups. Everything else falls in to the "monitoring" category. Once you have been managing an Exchange organization for a while, we think you will agree that the most critical tasks are simply related to watching Exchange and making sure it continues to perform as you expect and within the boundaries that you have set.

When we talk about boundaries, we are talking about defining the expected behavior your Exchange server system. These boundaries, such as the amount of disk space you are consuming (or expect to be consuming), will change over time. Also over time you may expect the CPU load or memory usage to increase as usage on the Exchange server increases.

Topics in this chapter include the following:

• Using the Exchange Best Practices Analyzer

• Auditing and logging

• Tracking messages

• Monitoring performance

• Removing content from users' mailboxes