Monitoring Exchange 2013

With Exchange 2013 a new way of monitoring workloads appeared, at least in the windows world. Managed Availability is the name and my guess is, that we will see more of this type of monitoring going forward. As a SCOM administrator you have limited possibilities of creating overrides for Exchange 2013 monitoring. This must be done by an Exchange administrator in the Exchange Management Shell, but you still need to know how this is done so you can work with the Exchange administrator to tweak the default monitoring configuration.

I recommend reading these articles to begin with:

• Understanding how Exchange Server 2013 Management Pack reports system health on Technet.
• Exchange Server 2013 Managed Availability on WindowsITPro

In this post I’ll just give some examples on how to configure overrides.

The key thing to know is, that you can only disable/enable monitors and rules in the SCOM console. Overrides for things such as thresholds must be done in the Exchange Schell and requires Exchange Administrator Permissions i.e. the Exchange Administrator must do this unless you can be granted the required Exchange permissions. This means that the Exchange administrator him selves have control of what alerts SCOM raises.

But let’s go over and example with Exchange 2012 SP1, where we will change a threshold for the MailboxSpace StorageLogicalDriveSpaceMonitor monitor.

In SCOM you see the below alert. The alert is triggered because the free diskspace is below 100GB which is the default threshold, however we first want to see an alert when free disk space is below 30GB.

1. Open the Exchange Management Pack Shell which is installed on the Exchange server

2. Lets first get a list of all unhealthy Healthsets.

Get-HealthReport -identity <server name> |where {$_.AlertValue -eq ‘unhealthy’}

Sure enough, the MailboxSpace healthset is unhealth.

3. Now, lets set what monitors we have on that HealthSet.

Get-ServerHealth -Identity <server name> -HealthSet ‘mailboxspace’

We can see we have 5 monitor and we can see that one is unhealthy. That’s the one we need to update, but we need the identity name of the monitor.

Get-ServerHealth -Identity <server name> -HealthSet ‘MailboxSpace’ |ft -auto identity

MailboxSpace\StorageLogicalDriveSpaceMonitor is the Identity we need for over override. Notice – “\D” is the target resource which don’t need for the override.

4. Create a global or server specific override.

Global overrides are stored in Active Directory and can apply to all your Exchange Servers. Server specific overrides are stored in the registry of the Exchange Server.

Setting a Global override

We will now create an override that changes the threshold from the default 100GB to 30GB and we want it to be a permanent override. There is a parameter called –Duration but we cannot use that as you can only provide a value between 0 – and 60 days. To make the override permanent we can use the parameter –ApplyVersion and provide the Exchange version number for the version you run. When doing this we are not prompted to provide a duration. When you later upgrade, you must make the override again!

Add-GlobalMonitoringOverride -Item Monitor –Identity MailboxSpace\StorageLogicalDriveSpaceMonitor -PropertyName MonitoringThreshold -PropertyValue 30 -ApplyVersion 15.0.847.32

Setting a server specific override with a duration of 10 days

Add-ServerMonitoringOverride –Server <server name> -Item Monitor -Identity MailboxSpace\StorageLogicalDriveSpaceMonitor -PropertyName MonitoringThreshold -PropertyValue 30 –Duration 10

After having applied an override you will see the alert SCOM are auto resolved in a few minutes as well as an event in the event log on the Exchange Server saying the monitor is healthy.

Tip – you can edit the duration in registry and this way make the override kind of permanent by setting the duration to e.g. 10 years.

Other usefull stuff to now

Most improvements to monitoring will come with future UR to Exchange 2013. This post is based on Exchange 2013 SP1. When we have applied a recent UR I’ll do more test and update this blog post.

There are monitors that you cannot apply overrides for. This may change with future UR releases.

Commands

• Get-GlobalMonitoringOverride
• Get-ServerMonitoringOverride –Server <name>
• Get-ExchangeServer |ft -auto admindisplayversion – get the exchange server version
• Remove-GlobaleMonitoringOverride – it can take up to 10 min. before Exchange see that the override is removed.
• Remove-ServerMonitoringOverride – it can take up to 10 min. before Exchange see that the override is removed. Remove-ServerMonitoringOverride -Server ServerName -Identity FrontEndTransport\OnPremisesInboundProxy -ItemType Probe -PropertyName ExtensionAttributes
• MonitoringItemIdentity -Identity MailboxSpace -Server <server name> | Where {$_.Name -like "*space*" -and $_.ItemType -eq "Monitor"} – gets information about monitors for a specific healthset.

Registry key for locations

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ExchangeServer\v1\ActiveMonitoring\Overrides\Monitor

Checking the Exchange monitoring event log and events

A nice place to see the HealthSet and Monitor Names is the details tab of the event.

Get Monitoring Identity info

MonitoringItemIdentity -Identity MailboxSpace -Server <server name> | Where {$_.Name -like "*space*" –
and $_.ItemType -eq "Monitor"}

Resources

• Procedures related to post-deployment operation http://technet.microsoft.com/en-us/library/dn198286(v=exchg.150).aspx
• Great post from the Exchange Team Blog “Customizing Managed Availability” http://blogs.technet.com/b/exchange/archive/2013/08/13/customizing-managed-availability.aspx