Monitoring Microsoft Exchange

There are many ways to verify that a Microsoft Exchange mail server is running. You can check mail delivery, tcp-ports, services and more. No single test will provide a complete picture of the status of your Exchange-server, hence this how-to will describe how to combine a couple of test to have a reliable set of services that together provide the complete picture of the status of the server.


Information regarding earlier releases of Microsoft Exchange:

This how-to primarily covers how to Monitor Microsoft Exchange Server 2003. In this how-to we assume you already have the Windows agent NSClient++ installed and running on your Exchange-server. The agent uses TCP port 1248 which is used by Exchange 5.5 and maybe also by Exchange 2000. If you are using earlier versions of Microsoft Exchange, you may need to use an alternate TCP-port than 1248 between the Monitor-server and NSClient++ at the Exchange-server. You can verify if port 1248 is already in use by Exchange by connecting to the RPC-server and querying it for current port-ranges. To do this, download portqryui and run the following command: portqry.exe -n 172.16.1.47 -e 135 -p TCP

If the port is used by your exchange-server, configure the agent to use another port, like 12489, by editing the agents config-file NSC.ini. Restart the agent and make alternate versions of all check_nt-check-commands in the Monitor servers config. Use these alternate commands for all check_nt-tests below. Configuring the tests/services

The test we will configure are:

  • Checking standard Exchange-related network services
  • Checking your mail-system end-to end using check_email_loop
  • Checking Exchange core win32-services
  • Checking Exchange-related performance counters

Checking standard Exchange-related network services

Scan the host (your Exchange-server) the web-gui-function 'Scan host <hostname> for generic network based services'. Select the services you want to Monitor, for example pop, imap, smtp, and https. Checking your mail-system end-to end using check_email_loop

First you need to add a new check-command, se below.

command_name: check_email_loop command_line: $USER1$/check_email_loop.pl -poph=$ARG1$ -popu=$ARG2$ -pa=$ARG3$ -smtph=$ARG4$ -from=$ARG5$ -to=$ARG6$ -pendc=2 -lostc=0

This new check-command requires that you supply six check_command_args in your servicedefinition. In the exampel service below we use the following settings. pophost pop.domain.com popuser monitor-service-user password secret smtphost smtp.domain.com fromaddress monitor-service-user@domain.com toaddress monitor-service-user@domain.com

Example service: service_name: Email loop check_command: check_email_loop check_command_args: pop.domain.com!monitor-service-user!secret!smtp.domain.com!monitor-service-user@domain.com!monitor-service-user@domain.com Checking Exchange core win32-services

service_name: Exchange core services check_command: check_nt_service check_command_args: MSExchangeIS,MSExchangeMTA,SMTPSVC,RESvc,W3SVC Checking Exchange-related performance counters

Since Exchange win32-services can be reported as running even though they're not doing their work, we want to check that the performance counters Messages Pending Routing and Remote Queue Length doesn't increase above normal levels. This will act as an early warning system for Exchange problems.

Add two new check-commands:

command_name: check_exchange_pending_routing command_line: $USER1$/check_nt -H $HOSTADDRESS$ -p 12489 -v COUNTER -l "\\SMTP Server(_Total)\\Messages Pending Routing","Messages Pending Routing are: %.f" -w $ARG1$ -c $ARG2$

command_name: check_exchange_remote_queue_length command_line: $USER1$/check_nt -H $HOSTADDRESS$ -p 12489 -v COUNTER -l "\\SMTP Server(_Total)\\Remote Queue Length","Remote Queue Length is: %.f" -w $ARG1$ -c $ARG2$

Configure two new services:

service_name: Messages Pending Routing check_command: check_exchange_pending_routing check_command_args: <supply warning and critical thresholds suitable for your mail-volumes>

service_name: Remote Queue Length check_command: check_exchange_remote_queue_length check_command_args: <supply warning and critical thresholds suitable for your mail-volumes>