Exchange 2013: Monitoring Best Practices

The aim of this document is to assist you in monitoring your Exchange 2013 architecture

 

Exchange 2013 Architecture, Concepts and Components

Exchange Server 2013 utilises two basic building blocks. Each operate as separate highly available and fault tolerant units that are independent of each other.

  • DAG: Database Availability Group
  • CAS: Client Access Server Group

ServiceNav provides you with a collection of service templates to enable monitoring of your entire Exchange 2013 estate.

 

Configuration

General

It is recommended that you monitor all the servers that make up your Exchange 2013 architecture.

To all physical or virtual servers, depending on the operating system, apply the following host templates:

  • Windows 2008 system: This template is intended for Windows 2008 servers. It notifies if the equipment is UP or DOWN as well as alerting on CPU, RAM, SWAP, and I/O disk usage. Use discovery to monitor disk partitions and network interfaces.
  • Windows 2012 system: This template is intended for Windows 2012 servers. It notifies if the equipment is UP or DOWN as well as alerting on CPU, RAM, SWAP, and disk I/O usage. Use discovery to monitor disk partitions and network interfaces.
  • Windows 2016 system: This template is intended for Windows 2016 servers. It notifies if the equipment is UP or DOWN as well as alerting on CPU, RAM, SWAP, and disk I/O usage. Use discovery to monitor disk partitions and network interfaces.

CAS (Client Access Server)

Monitor connectivity to virtual IP or VIP

On CAS servers, depending on the architecture deployed, deploy the following templates:

  • HTTP / HTTPS: tests an HTTP / HTTPS request; use to monitor the URL virtual IP
  • TCP-Port: tests that the TCP port specified in the configuration is open, and returns the connection time; use to monitor the following ports:
    • IMAP4 customers (143-993)
    • POP3 customers (110-995)
    • SMTP Authenticated Client (587)
    • SMTP (25)
    • HTTP (80)
    • Front Transport Service (717)

Exchange Services on Exchange 2013 Client Access Servers

On CAS servers, monitor the startup status of BLOCKING or DEGRADING services using the MS-WIN-ServicesList-Started service template:

BLOCKING Impact Services:

  • MSExchangeADTopology
  • MSExchangeDiagnostics
  • MSExchangeFrontEndTransport
  • MSExchangeServiceHost

DEGRADING Impact Services:

  • MSExchangeHM
  • MSExchangeIMAP4
  • MSExchangePOP3
  • HostControllerService
  • MSExchangeUMCR

Monitor Exchange Performance on Exchange 2013 Client Access Servers

On CAS servers, deploy the following templates – do not be concerned about the template naming conventions naming, the following templates are compatible with Exchange 2013:

  • MS-EXCHANGE2013-QUEUE-LENGTH: Measures the length of a queue, expressed as the number of messages.
  • MS-EXCHANGE2007_2010-ADAccess: Measures the number of Microsoft Exchange Server searches to the Active Directory exceeding time in the last minute.
  • MS-EXCHANGE2007-SMTP-MSGS-RECEIVED: Measures the delivery frequency of SMTP messages to the transport server, expressed in messages per second.
  • MS-EXCHANGE2007-SMTP-MSGS-SENT: Measures the frequency of sending SMTP messages from the transport, expressed in messages per second.
  • MS-Exchange-Certificate-Expiration: Calculates the number of days remaining before the Exchange certificate will expire. In case of multiple certificates, it calculates the number of days remaining before the expiration date of each certificate and alerts if, for at least one certificate, the threshold is exceeded.

Edge Transport

Exchange Services on Exchange 2013 Edge Transport Servers

On Edge Transport servers, monitor the startup of BLOCKING or DEGRADING services using the MS-WIN-ServicesList-Started service template:

 

BLOCKING Impact Services:

  • ADAM_MSExchange
  • MSExchangeDiagnostics

DEGRADING Impact Services:

  • MSExchangeAntispamUpdate
  • MSExchangeEdgeCredential
  • MSExchangeHM
  • MSExchangeServiceHost
  • MSExchangeTransport
  • MSExchangeTransportLogSearch

 

Database Availability Group (DAG)

Monitor Connectivity to Mailbox Servers (MBX)

On MBX servers, depending on the architecture deployed, deploy the following template:

  • TCP-Port: Tests if the TCP port specified in configuration is open, and reports the connection time, use it to monitor the following port:
    • HTTP (80)

Exchange Services on Exchange 2013 Mailbox Servers

On MBX servers, monitor the startup status of BLOCKING or DEGRADING services using the MS-WIN-ServicesList-Started service template:

BLOCKING Impact Services:

  • MSExchangeADTopology
  • MSExchangeDagMgmt
  • MSExchangeDiagnostics
  • MSExchangeMailboxReplication
  • MSExchangeDelivery
  • MSExchangeSubmission
  • MSExchangeRepl
  • MSExchangeRPC
  • MSExchangeFastSearch
  • HostControllerService
  • MSExchangeServiceHost
  • MSExchangeThrottling

Services with DEGRADING impact:

  • MSExchangeAntispamUpdate
  • MSExchangeEdgeSync
  • MSExchangeIMAP4BE
  • MSExchangeMailboxAssistants
  • MSExchangePOP3BE
  • WSBExchange
  • MSExchangeTransport
  • MSExchangeTransportLogSearch
  • MSExchangeUM

 

Monitor the size of Exchange databases and mailboxes

On MBX servers, apply the following templates:

  • MS-EXCHANGE-MailboxDatabaseStatusPS: Monitors the size of an Exchange database and notifies if a threshold is exceeded.
  • MS-EXCHANGE-MailboxStatusPS: Returns the quota status of mailboxes on an Exchange server.

 

Monitor DAG replication

On MBX servers, deploy the following template:

  • MS-Exchange-DAG-Replication-Status: Checks all aspects of replication and replay for a mail server within a DAG. Alert in case of problems or replication failure.

 

Monitor Exchange Performance on Exchange 2013 Mailbox Servers

On MBX servers, deploy the following templates – do not be concerned with the template naming, they are compatible with Exchange 2013:

  • MS-EXCHANGE2007-MSGS-RECEIVED-BY-MS: Indicates how often messages are delivered to the storage bank, expressed in messages per second
  • MS-EXCHANGE2007-MSGS-SENT-TO-T: Indicates the frequency of sending messages to the transport server, expressed in messages per second

Active Directory

Monitor access to the Active Directory

On AD servers, deploy the following template:

  • MS-Active_Directory: Connection test to an Active directory, notifies if the test fails.
  • Internal-DNS: Tests a DNS query internally and notifies if the test fails.
  • DNS-External: Tests an external DNS request.

IT Weather services

Once the hosts and services have been added to monitoring, create your IT Weather services by following the good implementation practices available here (user service best practices)

Get straight to the root cause of email service degradation:

 

Dashboards

Link your IT Weather services to a map-based dashboard by following the best practices available here

UK ServiceNav Product Development Manager; my priority is to be needful of the particular requirements of all ‘English-speaking’ markets where ServiceNav is sold. I have over 20 years experience of the IT monitoring field - covering a wide variety of products and technologies.