| Legal Information |
|
Tier I servers contain the IMS (Internet Mail Service), which carry mail from the internal system to the external gateways for access to the Internet. IMS servers need to be able to send mail outside of the system through the UNIX send-mail host, which must be operational for this to occur. Although this falls into the hand of the UNIX OS support team, port #25 on these boxes should be monitored nonetheless.
The impact of any problems on the IMS will only affect messages that travel outside the environment. IMS problems will not affect site to site or post office to post office operations. However, IMS failures will cause messages destined for external addresses to queue at the bridgehead server trying to send the message. The message will remain in queue until the IMS is operational or it is removed from queue with a diagnostic tool.
Consider scheduled downtime when monitoring Exchange services and processes. Exchange administrators should be aware of servers scheduled for maintenance to avoid false alerts from the monitors.
Also, temporarily disable any "auto-fix" type of monitors during scheduled maintenance. Suggestion: disable all monitors during the same part of the day that maintenance is scheduled to occur. First, make sure the efforts of the Exchange administrators and those performing maintenance are coordinated.
All EventLog ID numbers assume use of Microsoft Exchange version 5.0. EventLog IDs for Exchange 5.5 may differ, but the problem description and resolution will remain the same.
Severity definition:
| Problem Description | Method of Detection | Recommended Action | Monitoring Interval | Severity | Threshold | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Connectivity | Unable to send mail upstream | Telnet to Port #25 of IMS to obtain a "ESMTP spoken here" response Troubleshoot TCP/IP status on machine. Ensure port #25 is operational and not used by another application. Check the c:\winnt\system32\drivers\etc\services file to determine which application may be using port #25 | 15 min. | 1 | 1 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Database problems Database too fragmented | EventLog ID 65 detected | Use "edbutil" to defrag database (should be done by Exchange admins. Only) | 15 min. | 2 | 1 time every 3 months | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Database in inconsistent state (This message may also appear in the Directory or Information Store database, in the case of a power failure. This error usually means that the database is in an inconsistent state and cannot start.) | Event Log ID Error -550 has occurred | Confirm that the database state database is inconsistent, and then try a defragmentation repair | 15 min. | 2 | 1
| Database reaching capacity | EventLog ID 1112 detected or IS size reached 80% of logical disk capacity | Normally logged after database has shutdown for reaching capacity, this requires that the server run edbutil /d to free space up. After completion of edbutil database, restart Information store. | 20 min. | 2 | 1
| Database cache hit rate too low | Monitor the database buffer cache hit ratio for the IS and DS database | DS and IS buffers can be increased if there is sufficient RAM. If these fall below 95% frequently, it indicates the buffers are too low. To correct the problem, manually run
| perfwiz -v .30 min. | 3 | Baseline
| MTA messages per second too low or too high | Monitor the number of messages being processed by the MTA. | Check the status of the MTA and the CPU and memory consumption of the processes. | 15 min. | 1 | Baseline
| MTA process is down | Monitor the number of threads in use by the MTA and EventLog ID 2110 detected | Restart MTA Service. If service fails to restart, restart ALL Exchange services in order. | 10 min. | 1 | 1
| MTA Work Queue length too high | Monitor MTA Queue length on server | Check the MTA Service is up and the MTA service on upstream connections (i.e. if MTA queue length of bridgehead server is too high, check the MTA on the IMS) | 15 min. | 23 | Baseline
| Directory updates failed | EventLog ID 1171 detected - exception event | Directory Service Problem followed by a 1214 Error in the Event log indicates a Server failing on a deletion or addition of a directory object. Contact Microsoft (PSS) for troubleshooting | 15 min. | 2 | 1
| Directory updates failed | EventLog ID 1214 detected - KCC event | Knowledge consistency checker fails to complete successfully. Indicates a corruption in the Directory schema that may affect more than one (1) server in a site or Organizational Unit. Contact Microsoft PSS for troubleshooting | 15 min. | 2 | 1
| Directory Services Pending Replications too high | Monitor the number of pending replications in the DS | Huge lag in Directory updates may indicate a problem with Network connectivity to other bridgehead servers and confirms that the ability to ping other Bridgehead servers that this server uses for directory replication still exists. This can also occur with servers in the same site. | 30 min. | 2 | Baseline
| Directory Services remaining replication updates not decreasing | Monitor the number of objects being processed by the DS | Indicates a directory problem with either the server failing to exchange directory replication messages due to Network issues or directory problems. Check Event logs on Server for details | 30 min. | 2 | Baseline
| IMS NDRs are high | Monitor the NDR for the IMS.
| EventLog ID 1001 detected. Confirm Sendmail, Unix Relay host is available from Server. EventLog ID 1001 means the IMS service has been stopped or has shutdown. EventLog ID 1026 or 2007: contact Microsoft PSS. | 30 min. | 2 | Baseline
| IMS inbound queue too high | Monitor the IMS inbound queue | Check the IMS Service. | 30 min. | 2 | Baseline
| IMS outbound queue too high | Monitor the IMS outbound queue | Check the IMS Service | 30 min. | 2 | Baseline
| Overall Exchange problems | Exchange services down | Monitor the service control manager to detect status of services.Check all Exchange services. Restart services that are down in order. Gracefully reboot server if necessary. | 5 min. | 1 | 1
| Exchange process dead | Monitor the CPU and thread utilization of the Exchange processes | Check all of the Exchange services. Restart services that are down in order. Gracefully reboot server if necessary | 5 min. | 1 | Baseline
| Runaway Exchange process | Monitor the CPU and memory utilization of the Exchange processes | Check all of the Exchange services. Restart services that are down in order. Gracefully reboot server if necessary | .5 min. | 1 | Baseline
| Paging too high | Monitor the paging frequency of the operating systems (pagefile usage) | Excessive paging requires the need for upgrade of memory. If paging persists, treat as bug. | 5 min. | 2 | Baseline
| Low logical disk free space | Monitor the logical disk space of the Exchange machines | Delete unnecessary files to free up disk space. Install new disk space if necessary. | 15 min. | 1 | Baseline
| CPU Queue Length too high | Monitor the overall queue length of the CPU over a prolonged period. | Use Performance Monitor to identify CPU bottlenecks and rectify as necessary | 30 min. | 2 | Baseline
| Compaq Insight Manager errors | Monitor the internal temperature of server | Check hardware for errors | 10 min. | 1 | Baseline
| Compaq Insight Manager errors | Monitor any critical IDE or SCSI disk failures | Check hardware for errors | 10 min. | 1 | Baseline
| Compaq Insight Manager errors | Monitor NIC failures | Check hardware for errors. | 10 min.. | 1. | Baseline
| Compaq Insight Manager errors | Monitor any fan failures | Check hardware for errors | 10 min. | 1 | Baseline
| Compaq Insight Manager errors | Monitor any correctable memory errors | Check hardware for errors | 10 min. | 1 | Baseline
| Network utilization high | Monitor total bytes per second processed by network interface card. | Check and/or tune performance of NIC card. | 10 min. | 3 | Baseline
| ICMP errors | Monitor the receipt time for ICMP packets | Check and/or tune performance of NIC card. | 10 min. | 3 | Baseline
| ICMP errors | Monitor the level of unreachable destinations | Check and/or tune performance of NIC card. | 10 min. | 3 | Baseline
| |
| Search Knowledge Base | Feedback |