Monitoring Events, Services, Servers, and Resource Usage

As an Exchange administrator, you should routinely monitor event logs, services, servers, and resource usage. These elements are the keys to ensuring that the Exchange organization is running smoothly. Because you can't be on-site 24 hours a day, you can set alerts to notify you when problems occur.

Viewing Events

System and application events generated by Exchange Server are recorded in the Windows event logs. The primary log that you'll want to check is the application log. In this log, you'll find the key events recorded by Exchange Server services. Keep in mind that related events might be recorded in other logs, including the directory service, DNS server, security, and system logs. For example, if the server is having problems with a network card and this card is causing message delivery failures, you'll have to use the system log to pinpoint the problem.

You access the application log by completing the following steps:

1. Click Start, point to All Programs, point to Administrative Tools, and then select Computer Management.

2. If you want to view the logs on another computer, in the console tree, right-click the Computer Management entry, and choose Connect To Another Computer from the shortcut menu. You can now choose the server for which you want to manage logs.

3. Expand the System Tools node, and then double-click Event Viewer. You should now see a list of logs, as shown in Figure 17-3.

   
   Figure 17-3: Event Viewer displays events for the selected log.

4. Select the Application log.

Entries in the main panel of Event Viewer provide an overview of when, where, and how an event occurred. To obtain detailed information on an event, double-click its entry. The event type precedes the date and time of the event. Event types include the following:

• Information An informational event, generally related to a successful action.

• Warning Details for warnings are often useful in preventing future system problems.

• Error An error, such as the failure of a service to start.

In addition to type, date, and time, the summary and detailed event entries provide the following information:

• Source The application, service, or component that logged the event.

• Category The category of the event, which is sometimes used to further describe the related action.

• Event An identifier for the specific event.

• User The user account that was logged on when the event occurred.

• Computer The name of the computer where the event occurred.

• Description In the detailed entries, this provides a text description of the event.

• Data In the detailed entries, this provides any data or error code output created by the event.

Use the event entries to detect and diagnose Exchange performance problems.

Managing Essential Services

Most of Exchange Server's key components run as system services. If an essential service stops, its related functionality will not be available, and Exchange Server won't work as expected. When you are troubleshooting Exchange Server problems, you'll want to check to ensure that essential services are running as expected early in your troubleshooting process. To manage system services, you'll use the Services node in the Computer Management console. You can start Computer Management and access the Services entry by completing the following steps:

1. Choose Start, choose Programs or All Programs as appropriate, point to Administrative Tools, and then select Computer Management. Or select Computer Management in the Administrative Tools folder.

2. If you want to manage the services on another computer, right-click the Computer Management entry in the console tree, and select Connect To Another Computer on the shortcut menu. You can now choose the system whose services you want to manage.

3. Expand the Services And Applications node, and then select Services.

As Figure 17-4 shows, you'll now see the available services. Services are listed by:

Figure 17-4: View the status of essential services during troubleshooting.

• Name The name of the service.

• Description A short description of the service and its purpose.

• Status The status of the service. If the entry is blank, the service is stopped.

• Startup Type The startup setting for the service.

• Log On As The account the service logs on as. The default in most cases is the local system account.

Tip 

Any service that has a startup type of Automatic should have a status of Started. If a service has a startup type of Automatic and the status is blank, the service is not running, and you should start it.

If a service is stopped and it should be started, you'll need to restart it. If you suspect a problem with a service, you may want to stop and then restart it. To start, stop, or restart a service, complete the following steps:

1. Access the Services node in the Computer Management console.

2. Right-click the service you want to manage, and then select Start, Stop, or Restart, as appropriate.

Monitoring Exchange Messaging Components

When you are troubleshooting or optimizing a server for performance, you can use performance monitoring to track the activities of Exchange messaging components. System Monitor graphically displays statistics for the set of performance parameters you've selected for display. These performance parameters are referred to as counters. System Monitor displays information for only the counters you're tracking. Thousands of counters are available, and these counters are organized into groupings called performance objects.

When you install Exchange Server 2007 on a computer, System Monitor is updated with a set of objects and counters for tracking Exchange performance. You'll find performance objects for:

• Microsoft Exchange Availability Service

• Microsoft Exchange Journaling Agent

• Microsoft Exchange Mail Submission

• Microsoft Exchange Outlook Web Access

• Microsoft Exchange Replication

• Microsoft Exchange StoreDriver

• Microsoft Exchange Information Store

• Microsoft Exchange Transport Queues

• Microsoft Exchange Transport Routing

• Web Service

You can select which counters you want to monitor by completing the following steps:

1. In Exchange Management Console, select the Toolbox node, and then double-click Performance Monitor. This opens the Exchange Server Performance Monitor.

2. Select the System Monitor entry in the left pane, as shown in Figure 17-5.

   
   Figure 17-5: Track performance objects and counters to monitor server performance.

3. System Monitor has several viewing modes. Make sure you're in View Current Activity and View Graph display mode by clicking the View Current Activity and View Graph buttons on the System Monitor toolbar.

4. To add counters, click the Add button on the System Monitor toolbar or press CTRL+L. The Add Counters dialog box appears, shown in Figure 17-6. The key fields are:

   
   Figure 17-6: Select the counters you want to monitor.

   • q Use Local Computer Counters Configure performance options for the local computer.

   • q Select Counters From Computer Enter the Universal Naming Convention (UNC) name of the server with which you want to work, such as ∖∖MAILSERVER27. Or use the selection list to select the server from a list of computers you have access to over the network.

   • q Performance Object Select the type of object with which you want to work, such as Processor.

   • q All Counters Select all counters for the current object.

   • q Select Counters From List Select one or more counters for the current object. For example, you could select % Processor Time and % User Time. After selecting a counter, click Explain to learn what the counter is used for.

   • q All Instances Select all counter instances for monitoring.

   • q Select Instances From List Select one or more counter instances to monitor.

5. When you've selected all the necessary counters, click Add to add the counters to the chart. Then repeat this process, as necessary, to add other performance parameters.

6. Click Done when you're finished adding counters.

7. You can delete counters later by clicking their entry in the lower portion of the Performance window and then clicking Delete.

Using Performance Alerting

Windows performance alerting provides a fully automated method for monitoring server performance and reporting when certain performance thresholds are reached. You can use performance alerting to track the following:

• Memory usage

• CPU utilization

• Disk usage

• Messaging components

Using notifications, you can then provide automatic notification when a server exceeds a threshold value.

Tracking Memory Usage

Physical and virtual memory is critical to normal system operation. When a server runs low on memory, system performance can suffer, and message processing can grind to a halt. To counter this problem, you should configure performance alerting to watch memory usage. You can then increase the amount of virtual memory available on the server or add additional random access memory (RAM) as needed.

You configure a memory alert by completing the following steps:

1. In Exchange Management Console, click the Toolbox node, and then double-click Performance Monitor. This opens the Exchange Server System Monitor.

2. Expand the Performance Logs And Alerts node, and then select Alerts. You should see a list of current alerts (if any) in the right pane. A green alert symbol next to the alert name indicates alerting is active. A red alert symbol indicates alerting is stopped.

3. Right-click Alerts in the left pane, and then choose New Alert Settings.

4. In the New Alert Settings dialog box, type a name for the alert, such as Memory Usage Alert. Then click OK to display a Properties dialog box for your new alert.

5. On the General tab, type an optional description of the alert. Then click Add to display the Add Counters dialog box, shown previously in Figure 17-6.

6. Use the Select Counters From Computer list to select the Exchange server for which you are configuring alerting.

7. Because you are configuring memory alerts, select Memory from the Performance Object list. Select Available Mbytes, and then click Add.

8. Select Paging File from the Performance Object list. Click %Usage, and then click Add.

9. Click Close. In the Properties dialog box, select Available Mbytes, as shown in Figure 17-7. Set the Alert When Value Is list to Under, and then enter a Limit value that is approximately 5 percent of the total physical memory (RAM) on the server for which you are configuring alerting. For example, if the server has 2 GB of RAM, you would set the value to 100 MB to alert you when the server is running low on available memory.

   
   Figure 17-7: Configure the alert threshold.

10. In the Counters list, select %Usage. Set the Alert When Value Is list to Over, and then type 98 as the Limit value. This ensures that you are alerted when more than 98 percent of the paging file is being used.

11. In the Sample Data Every field, type a sample interval, and select a time unit in seconds, minutes, hours, or days. The sample interval specifies when new data is collected. Don't sample too frequently, however; you'll use system resources and might cause the server to seem unresponsive. A good value may be once every 10 minutes.

12. In the Run As field, type the name of the account under which the counter log will run, and then click Set Password. After you type the password for the account and then confirm it, click OK to close the Set Password dialog box. To run alert logging under the default system account, type <Default>.

13. On the Action tab, shown in Figure 17-8, you can now specify any of the following actions to occur when an alert is triggered:

    
    Figure 17-8: Set actions that are executed when the alert occurs.

    • q Log An Entry In The Application Event Log Creates log entries for alerts

    • q Send A Network Message To Sends a network message to the computer specified

    • q Start Performance Data Log Sets a counter log to start when an alert occurs

    • q Run This Program Sets the complete file path of a program or batch file script to run when the alert occurs

14. When you click OK, alerting will start immediately.

To manage an alert, right-click its entry in the right pane, and then select one of the following options:

• Delete Deletes the alert

• Properties Displays the alert Properties dialog box

• Start Activates alerting

• Stop Halts alerting

Tracking CPU Utilization

You can use a CPU utilization alert to track the usage of a server's CPUs. When CPU utilization is too high, Exchange Server can't effectively process messages or manage other critical functions. As a result, performance can suffer greatly. CPU utilization at 100 percent for an extended period of time can be an indicator of serious problems on a server. Typically, you'll need to reboot a server when the CPU utilization is stuck at maximum utilization (100 percent).

You'll also want to closely track process threads that are waiting to execute. A relatively high number of waiting threads can be an indicator that a server's processors need to be upgraded.

You configure a CPU utilization alert by completing the following steps:

1. Right-click Alerts in the left pane of the Performance console, and then choose New Alert Settings.

2. In the New Alert Settings dialog box, type a name for the alert, such as CPU Utilization Alert. Then click OK to display a Properties dialog box.

3. On the General tab, type an optional description of the alert. Then click Add to display the Add Counters dialog box.

4. Use the Select Counters From Computer list to select the Exchange server for which you are configuring alerting.

5. Because you are configuring CPU alerts, select Processor from the Performance Object list. Select %Processor Time, and then click Add.

6. Select System from the Performance Object list. Click Processor Queue Length, and then click Add.

7. Click Close. In the Properties dialog box, select %Processor Time. Set the Alert When Value Is list to Over, and then type 98 as the limit value. This ensures that you are alerted when processor utilization is more than 98 percent.

8. In the Counters list, select Processor Queue Length. Set the Alert When Value Is list to Over, and then type 10 as the limit value. This ensures that you are alerted when more than 10 process threads are waiting to execute, which can be an indicator that a server's processors need to be upgraded.

9. Follow steps 11–14 under "Tracking Memory Usage."

Tracking Disk Usage

Exchange Server uses disk space for data storage, logging, tracking, and virtual memory. When hard disks run out of space, the Exchange server malfunctions and data gets lost. To prevent serious problems, you should monitor free disk space closely on all drives used by Exchange Server.

You'll also want to track closely the number of system requests that are waiting for disk access. A relatively high value for a particular disk can affect server performance and is also a good indicator that a disk is being overutilized. To resolve this problem, you will want to try to shift part of the disk's workload to other disks.

You configure disk usage alerting by completing the following steps:

1. Right-click Alerts in the left pane of the Performance console, and then choose New Alert Settings.

2. In the New Alert Settings dialog box, type a name for the alert, such as Disk Usage Alert. Then click OK to display a Properties dialog box.

3. On the General tab, type an optional description of the alert. Then click Add to display the Add Counters dialog box.

4. Use the Select Counters From Computer list to select the Exchange server for which you are configuring alerting.

5. Select LogicalDisk from the Performance Object list. Select %Free Space. Under Select Instances From List, select all individual logical disk instances except _Total, and then click Add.

6. Select PhysicalDisk from the Performance Object list. Select Current Disk Queue Length. Under Select Instances From List, select all individual physical disk instances except _Total, and then click Add.

7. Click Close.

8. In the Properties dialog box, select %Free Space for the first logical disk instance. Set the Alert When Value Is list to Under, and then type 5 as the Limit value. This ensures that you are alerted when available free space is less than 5 percent. Repeat this procedure for each logical disk.

9. In the Counters list, select Current Disk Queue Length for the first physical disk instance. Set the Alert When Value Is list to Over, and then type 2 as the Limit value. This ensures that you are alerted when more than two system requests are waiting for disk access.

10. Follow steps 11–14 under "Tracking Memory Usage."