Using the Performance Snap-in to Tune Exchange Server 2003

It would take an entire book to discuss in depth all the extra counters installed with Exchange Server 2003 and how they can be combined to give you a particular type of report. Instead, we will focus here on the more important counters and offer a few suggestions for using them. We will cover the SMTP, Content Indexing, and Microsoft Outlook Web Access (OWA) counters. If some of the discussion of the SMTP protocols is unfamiliar to you, refer to Chapter 20, “Supporting Internet Protocols and SMTP,” where this protocol is discussed in depth.

SMTP System Monitor Counters

The SMTP server receives messages, categorizes them, places them in queues created for the intended destination, and then delivers them to that destination. Messages can be received from port 25, from the Message Transfer Agent (MTA), or from a local store submission. Table 29-6 lists the counters that are most important with the SMTP service. The main object we are looking at here is the SMTP Server object. Some counters originate in different objects; these are noted in the Counter column.

Table 29-6: Counters for monitoring SMTP

Stage	Counter	Meaning
Messages received from port 25	Messages Received Total	Total number of messages received.
	Inbound Connections Current	Number of simultaneous inbound connections over port 25.
	Pickup Directory MessagesRetrieved/Sec	Rate at which messages are being retrieved from the mail pickup directory. An unusually high number could indicate the use of a large distribution list with many mail-enabled contacts.
Messages received from the Exchange Store	MSExchange Transport Store Driver: Store/ MSExchangeMTA Submits	Total number of messages received from the Store/MTA and submitted to the Transport Core.
Messages submitted for processing	Total messages submitted	Total number of messages submitted to queuing for delivery.
Messagescategorized	Categorizer Queue Length	Number of messages that are currently being categorized or waiting to be categorized. An increasing number could indicate a problem with an event sink. A value of 0 could indicate that the SMTP service is stopped.
	Categorizations Completed Successfully	Total number of messages successfully categorized.
Categorizedmessages placed in destination queue	Remote QueueLength	Number of messages going to other servers that are waiting to be sent. An increasing number in this queue could indicate a problem with the physical connection to the Internet or between two Exchange 2003 servers. If one queue in particular has a steadily increasing number, you may want to see if the remote SMTP server is available.
Categorized messages placed in destination queue	Remote RetryQueue Length	Number of messages going to other servers that could not be sent in a former attempt and that will be retried later. A high number here indicates either a physical connection problem or that the remote SMTP server is unavailable.
	Local QueueLength	Number of messages going to local recipients, to the MTA, or to other gateways.
	MSExchangeIS Transport Driver: Current Messages to MSExchangeMTA	Number of messages going to the MTA or to other gateways only. This value is included in the Local Queue Length counter.
	Local RetryQueue Length	Number of messages going to local recipients, to the MTA, or to other gateways that could not be delivered in a former attempt and that will be retried later.
	BadmailedMessages	Number of messages that are malformed, such as having a nonexistent destination domain. These messages are delivered to the Badmail directory. A high number here could indicate that some addresses for mail-enabled contacts were entered incorrectly.

Content Indexing System Monitor Counters

Content Indexing (CI) in Exchange Server 2003 consists of two basic phases. First is the initial crawl, which can take from hours to days and needs to be done only once. Until this initial crawl is completed, the index cannot be used for searching. Second is the incremental crawl, which is done numerous times after the initial crawl and is used to keep the index up-to-date. An incremental crawl usually completes in less than an hour. Table 29-7 lists the most important counters and the circumstances under which those counters are significant. The object we are most concerned with is the Microsoft Gatherer Projects object. Table 29-8 shows counters for the Microsoft Search Indexer Catalogs object, which can provide important information about indexes.

Table 29-7: Content Indexing counters for the Microsoft Gatherer Projects object

Stage	Counter	Meaning
Crawl in progress	Crawl in Progress flag	1 if a crawl is in progress, 0 if not.
	Current Crawl IsIncremental	1 if the current crawl is an incremental crawl, 0 if not.
	Document Additions	Number of documents being added to the index since the last crawl.
	URLs in History	Total number of URLs (documents) that CI has detected. This value will climb during the crawl and, once it levels off, will represent the total number of documents to be indexed.
	Waiting Documents	Total number of URLs (documents) that CI has detected that have not yet been indexed. The difference in rate between this counter and the URLs in History counter is essential in determining how long a crawl might take.

Table 29-8: Content Indexing counters for the Microsoft Search Indexer Catalogs object

Stage	Counter	Meaning
Index complete	Index Size	Size of the index.
Number of Documents	Number of documents	Number of documents in the catalog. This value corresponds to the number shown in the Exchange System snap-in.
Merge inprogress	Merge Progress	Percentage of completeness for merges. Whereas shadow merges can happen quickly, master merges can take up to an hour.

Finally, Table 29-9 lists two of the most frequently used counters for obtaining information about the number and extent of queries against your indexes. The counters in this table are for the Microsoft Search Catalogs object.

Table 29-9: Content Indexing counters for the Microsoft Search Catalogs object

Stage	Counter	Meaning
Ongoing	Queries	Total number of queries that have been run against a catalog.
	Results	Total number of results from queries. Note that one query can return thousands of results, so expect this number to be significantly higher than the Queries value.

Outlook Web Access

Outlook Web Access allows users to access their mailboxes over the Internet through a browser, such as Microsoft Internet Explorer or Netscape Navigator. Due to differences in code paths between IE4-level (Internet Explorer 4 and Netscape Navigator) and IE 5.x-level browsers, performance counters in the MSExchange Web Mail object exist in three forms: non-IE5, IE5 and later, and _Total (which sums the former two counters). Table 29-10 shows the counters for monitoring Web Mail.

Table 29-10: Counters for monitoring Web Mail

Stage	Counter	Meaning
User connectsover port 80	Web Service:Maximum Connections	Total number of OWA connections initiated since the Web Service (W3Svc) was last started.
	Web Service:Current	Number of OWA Connections users that are currently connected.
Messages sentover OWA	Message Sends(Total)	Total number of message sends. After OWA submits a message, the message is handled by SMTP, and the applicable SMTP counters are affected.
OWA requestsflow to and fromthe store	Epoxy: Client OutQue Len: DAV	Number of requests in the queue from the client to the server.
	Epoxy: Store OutQue Len: DAV	Number of responses in the queue from the server to the client.
	Epoxy: Blocks Allocated: DAV	A secondary indication of outstanding OWA requests. High numbers in these three Epoxy counters might indicate the need for an additional OWA server.
Client disconnects	Web Service: Current Connections	Current number of connections to the Web service. OWA has no logout process. Regardless of whether the user closes out the browser session when finished, the OWA user context will time out after 60 minutes of inactivity and that user’s cached authentication will expire, causing this counter to decrement.