Exchange 2010 Management Pack Guide for Operations Manager 2007

Microsoft Corporation Published: December 2014 Send suggestions and comments about this document to [email protected]. Please include the management pack guide name with your feedback.

Abstract The Microsoft Exchange Server 2010 Management Pack includes a complete health model, extensive protocol synthetic transaction coverage, and a full complement of diagnostics-based alerts and service-oriented reporting, including mail flow statistics. Alerts are classified by impact and recovery action, and are now processed by a new component called the Correlation Engine. The Correlation Engine suppresses duplicate alerts whenever possible to help front-line monitoring technicians monitor Exchange more efficiently. Most of the diagnostic information used in the Exchange 2010 Management Pack, including events and performance counters, is specifically engineered for monitoring. Very little tuning is required to monitor your Exchange organization. The Exchange 2010 Management Pack will scale with your environment. The Exchange 2010 Management Pack is engineered for organizations that include servers running Exchange 2010. It is not based on the Exchange 2007 Management Pack. Therefore, you will notice some differences in the way you deploy and configure the Exchange 2010 Management Pack if you have previously used the Exchange 2007 Management Pack. This guide was written based on version 14.02.0247.005 of the Exchange Server 2010 Management Pack. Legal Notice

This document is provided “as-is”. Information and views expressed in this document, including URL and other Internet Web site references, may change without notice. You bear the risk of using it. Some examples depicted herein are provided for illustration only and are fictitious. No real association or connection is intended or should be inferred. This document does not provide you with any legal rights to any intellectual property in any Microsoft product. You may copy and use this document for your internal, reference purposes. © 2010 Microsoft Corporation. All rights reserved. Microsoft, and MS-DOS, Windows, Windows Server, and Active Directory are trademarks of the Microsoft group of companies. All other trademarks are property of their respective owners. Contents

Exchange 2010 Management Pack Guide...... 5 Introduction to the Exchange 2010 Management Pack...... 7 Getting Started with the Exchange 2010 Management Pack...... 10 Before You Import the Exchange 2010 Management Pack...... 11 How to Import the Exchange 2010 Management Pack...... 13 Creating a New Management Pack for Customizations...... 14 Optional Configurations...... 14 Security Considerations...... 19 Understanding Management Pack Operations...... 19 Understanding Classes...... 19 Understanding Alert Correlation...... 20 Understanding the Exchange Management Pack Health State Model...... 25 Troubleshooting the Exchange 2010 Management Pack...... 41 Appendix: Reports...... 42 Appendix: Synthetic Transactions...... 44 Appendix: Scripts...... 46 Appendix: Objects the Exchange 2010 Management Pack Discovers...... 48 Appendix: Class Hierarchy...... 61 Client Access Class Hierarchy...... 62 Hub Transport Class Hierarchy...... 64 Edge Transport Class Hierarchy...... 65 Unified Messaging Class Hierarchy...... 65 Mailbox Class Hierarchy...... 66 Mailbox - High Availability and Mailbox Services Class Hierarchy...... 67 Common Classes Class Hierarchy...... 68 Roles Class Hierarchy...... 70 Groups Class Hierarchy...... 71 Appendix: Alert Correlation Relationships...... 72 Client Access - On Server Alert Correlation Relationships...... 72 Client Access - Server to Site Alert Correlation Relationships...... 73 Edge Transport Alert Correlation Relationships...... 75 Hub Transport Alert Correlation Relationships...... 76 Mailbox - High Availability Alert Correlation Relationships...... 76 Mailbox - Information Store Alert Correlation Relationships...... 77 Performance, Disks, and Public Folders Alert Correlation Relationships...... 78 Unified Messaging Alert Correlation Relationships...... 79 Exchange 2010 Management Pack Guide

The Microsoft Exchange Server 2010 Management Pack includes a complete health model, extensive protocol synthetic transaction coverage, and a full complement of diagnostics-based alerts and service-oriented reporting, including mail flow statistics. Alerts are classified by impact and recovery action, and are now processed by a new component called the Correlation Engine. The Correlation Engine suppresses duplicate alerts whenever possible to help front-line monitoring technicians monitor Exchange more efficiently. Most diagnostic information used in the Exchange 2010 Management Pack, including events and performance counters, is specifically engineered for monitoring. Very little tuning is required to monitor your Exchange organization. The Exchange 2010 Management Pack will scale with your environment. The Exchange 2010 Management Pack is engineered for organizations that include servers running Exchange 2010. It isn't based on the Exchange 2007 Management Pack. Therefore, you'll notice some differences in the way you deploy and configure the Exchange 2010 Management Pack if you used the Exchange 2007 Management Pack in the past.

Important: Running the Exchange 2010 Management Pack installation program installs a new Windows service component named the Correlation Engine service. For more information, see Before You Import the Exchange 2010 Management Pack.

Document Version This guide was written based on version 14.3.210.2/ 14.03.0038.004 of the Exchange 2010 Management Pack.

Revision History

Release date Changes

November 2009 The initial release of this guide was published for version 14.0.650 of the Exchange 2010 Management Pack.

February 2011  Updates were added throughout this guide to make it more comprehensive and to make it apply to the code changes in Exchange 2010 Service Pack 1 and the latest version of the Exchange 2010 Management Pack.  Added a reference in the introduction to note that the Exchange 2010 Management

4 Release date Changes

Pack installation package installs a service.  Added a section to summarize improvements in the latest version of the management pack.  Updated "Before You Import the Exchange 2010 Management Pack" to note that the Microsoft Exchange Correlation Engine service is installed when you install the Exchange 2010 Management Pack.  Updated "Supported Configurations" to reflect virtual environment support and cluster support.  Added "Create Test Mailboxes for Synthetic Transaction Tests" to explain how to create test mailboxes.  Added "Disable the Automatic Alert Resolution Feature in Correlation Engine" to explain how to disable automatic alert resolution.  Added "How Health Rolls Up" to explain how health rolls up in the Exchange 2010 Management Pack health model.  Added "Troubleshooting the Exchange 2010 Management Pack" to explain how to troubleshoot two issues that you may notice when deploying the management pack.  Updated "Appendix: Reports" to include added reports.  Updated "Appendix: Synthetic Transactions" to include added synthetic transactions.  Added "Appendix: Scripts" to include added troubleshooting scripts.  Updated "Appendix: Objects the Exchange 2010 Management Pack Discovers" to include added objects.  Updated the class hierarchy diagrams and the alert correlation relationship diagrams.

5 Release date Changes

June 2012  Maintenance release to coincide with the release of Exchange 2010 Service Pack 2.

December 2014  Added a new MSI(Exchange2010PowershellFix) that should be used if the management pack doesn’t work on an Exchange 2010 server that has Powershell 2.0/3.0+ installed side by side. Please refer to the “Changes included in 14.3.210.2 (PS 3.0+ Update)” section for more information.

Send suggestions and comments about this document to mailto:[email protected]. Please include the title of this guide, "Exchange 2010 Management Pack Guide," with your feedback.

Introduction to the Exchange 2010 Management Pack You can find the Microsoft Exchange Server 2010 Management Pack in the System Center Management Pack Catalog (http://www.microsoft.com/en-in/download/details.aspx?id=692).

What's New for Exchange 2010 Management Pack The Exchange 2010 Management Pack includes features that weren't included in the Exchange 2007 Management Pack. The following are some of the features that were added in the RTM version of the Exchange 2010 Management Pack:  Alert correlation By maintaining the health model in memory, and processing state change events, the Exchange 2010 Management Pack determines when to raise an alert based on the state of the system.  Alert classification The Exchange 2010 Management Pack uses the following alert categories to classify alerts: Key Health Indicator (KHI), Non-Service Impacting (NSI), and Forensic.  Mail flow statistics reporting Hourly and daily e-mail transaction statistics are collected by using message tracking log data.  Service-oriented reporting Uptime is reported based on the uptime of the application, service, and feature uptime rather than on server uptime.  Exchange-aware availability modeling Client availability uptime is measured for each type of Exchange client, based on test user transactions.

Changes included in 14.3.210.2 (PS 3.0+ Update) Exchange 2010 MP versions 14.03.0038.004 and earlier required ONLY Powershell 2.0 to be installed on the Exchange server for it to work. When Powershell 3.0 or higher is installed on

6 Exchange 2010 servers that were working with only Powershell 2.0 installed, Exchange MP stops working.

The new MSI (Exchange2010PowershellFix.MSI) that has been included in this release enables Exchange 2010 MP to work on servers that have Powershell 2.0 installed side by side with Powershell 3.0+. This new MSI should be used only if your existing Exchange 2010 MP isn’t able to monitor your Exchange 2010 server that has Powershell 2.0 and Powershell 3.0+ installed side by side. This will NOT work if the server has only Powershell 3.0 or higher installed.

If you already have 14.03.0038.004 installed, please execute the 14.3.210.2 “Exchange2010PowershellFix” MSI and import the MP’s contained within it.

Note: You must install the 14.03.0038.004 package (Exchange2010ManagementPackForOpsMgr2007-x64.msi/ Exchange2010ManagementPackForOpsMgr2007-x86.msi) prior to applying the 14.3.210.2 update (Exchange2010PowershellFix) in order for the Exchange 2010 MP to function correctly.

Changes included in the Service Pack 2 Update The Exchange 2010 SP2 version of the Exchange 2010 Management Pack includes many fixes intended to increase the scalability and address customer reported issues since the Service Pack 1 Update. The following list includes some of the new features and updates:

 Resolved ObjectNotFoundExceptions in correlation engine The SP1 version of the Correlation Engine could encounter ObjectNotFoundExceptions on a regular basis. The number of exceptions of this type is significantly reduced in this update.  Reduced load on RMS/MS A number of improvements were made to reduce the load of the Management Pack on the RMS/MS. The following specific changes were made:  Reduced the number of read operations the Correlation Engine makes to the SDK to get entity and monitor states  Improved cache handling in Correlation Engine when Management Pack updates are applied  Increased correlation interval time from 1.5 minutes to 5 minutes  Reduced load due to discovery The discovery interval was increased from 4 hours to 24 hours and improved handling of Domain Controller objects to decrease churn  Improved Database Copy Health monitoring Replaced KHI: Database dismounted or service degraded with One Healthy Copy monitor to decrease load on RMS  Improved Performance monitoring Non reporting Perf Instances are now enabled by default and some write operations were removed to decrease unnecessary writes to the database

7 Changes included in the Service Pack 1 Update The Exchange 2010 SP1 version of the Exchange 2010 Management Pack includes significant improvements beyond those included in the RTM version of the Exchange 2010 Management Pack. The following list includes some of the new features and updates:  Capacity planning and performance reports New reports dig deep into the performance of individual servers and provide detailed information about how much capacity is used in each site.  SMTP and remote PowerShell availability report The management pack now includes two new availability reports for SMTP client connections and management end points.  New Test-SMTPConnectivity synthetic transaction In addition to the inbound mail connectivity tasks for protocols such as Outlook Web App, Outlook, IMAP, POP, and Exchange ActiveSync, the Management Pack now includes SMTP-connectivity monitoring for outbound mail from IMAP and POP clients. For information about how to enable this feature, see Optional Configurations.  New Test-ECPConnectivity view Views for the Exchange Control Panel test task are now included in the monitoring tree.  Cross-premises mail flow monitoring and reporting The Management Pack includes new mail flow monitoring and reporting capabilities for customers who use our hosted service.  Improved Content Indexing and Mailbox Disk Space monitoring New scripts have been created to better monitor context indexing and mailbox disk space. These new scripts enable automatic repair of indexes and more accurately report of disk space issues.  The ability to disable Automatic Alert Resolution in environments that include OpsMgr connectors When you disable Automatic Alert Resolution, the Correlation Engine won't automatically resolve alerts. This lets you use your support ticketing system to manage your environment. For information about how to disable this feature, see Optional Configurations.  Several other updates and improvements were also added to this version of the Management Pack, including the following.  Suppression of alerts when the alerts only occur occasionally was added to many monitors.  Most of the event monitors in the Exchange 2010 Management Pack are automatically reset by the Correlation Engine. Automatic reset was added to those event monitors so that issues aren't missed the next time they occur. For a list of the event monitors that are not reset automatically, see Understanding Alert Correlation.  Monitoring was added for processes that crash repeatedly.  Additional performance monitoring was added for Outlook Web App.  Monitoring of Active Directory access was improved.  Monitoring of anonymous calendar sharing was added.  Reliability of database offline alerts was improved.  Monitoring for the database engine (ESE) was added.

8 Supported Configurations The following table shows the supported configurations for the Exchange 2010 Management Pack and the Correlation Engine component.

Configuration Support

Windows Server 2003 Exchange 2010 computers that the Windows Server 2008 Exchange 2010 Management Pack monitors must be running a 64-bit version Windows Server 2008 R2 of Windows Server 2008. This is based on the minimum requirements for Exchange 2010. The Correlation Engine supports 32-bit and 64- bit architectures.

Agentless monitoring Not supported.

Virtual environment Environments supported by both System Center Operations Manager and Exchange 2010 are supported.

System Center Operations Manager System Center Operations Manager 2007 Service Pack 1 and System Center Operations Manager 2007 R2 are supported.

Clustered Root Management Adding the Correlation Engine service to a Server/Correlation Engine clustered installation is supported, provided it's configured so that only one instance of the service is running at a time.

Getting Started with the Exchange 2010 Management Pack There are actions that you must take before you import the Microsoft Exchange Server 2010 Management Pack and steps that you must take to properly import the Exchange Server 2010 Management Pack. There is also information that you must consider when making management pack customizations. Review the following topics to properly deploy the Exchange Server 2010 Management Pack in your environment.  Before You Import the Exchange 2010 Management Pack  How to Import the Exchange 2010 Management Pack  Creating a New Management Pack for Customizations

9 Before You Import the Exchange 2010 Management Pack Before you import the Microsoft Exchange Server 2010 Management Pack, take the following actions:  Consider the supported configurations for the Exchange 2010 Management Pack. For more information about the supported configurations, see Introduction to the Exchange 2010 Management Pack.  Ensure that all Exchange 2010 computers that are managed by the Operations Manager use LocalSystem as the Agent Action Account.  If you are monitoring Exchange 2010 database availability groups (DAGs), ensure that all DAG members are monitored by Operations Manager 2007.  Ensure that all agents on Exchange 2010 computers have Agent Proxy enabled.  Install the update specified in Microsoft Knowledge Base article 971541, Description of System Center Operations Manager 2007 Service Pack 1 Update (http://go.microsoft.com/fwlink/?linkid=3052&kbid=971541) if you're running Operations Manager 2007 SP1. Install the update specified in Microsoft Knowledge Base article 974144, System Center Operations Manager 2007 R2 Cumulative Update 1 Release Notes (http://go.microsoft.com/fwlink/?linkid=3052&kbid=974144) if you're running Operations Manager 2007 R2. These updates resolve several critical issues that are more likely to occur when you're running the Exchange 2010 Management Pack.

Important: For the Exchange 2010 Management Pack to function correctly, you must install the referenced Operations Manager updates. These updates enable the monitors that the Exchange 2010 Management Pack uses to correctly set the health state and generate alerts. These updates also allow the Exchange 2010 Management Pack to accurately monitor whether the Exchange databases are mounted. Also, if you don't install the updates on your root management server and all agent computers, availability reporting will be inaccurate.  The Exchange 2010 Management Pack includes a Windows service called the Correlation Engine. The Correlation Engine is installed when you install the Exchange 2010 Management Pack. It determines the best alert to raise by examining the Exchange 2010 health model using the Operations Manager Software Development Kit (SDK) service. To correctly install the Correlation Engine, consider the following when you install the Exchange 2010 Management Pack:  Determine which server will host the Correlation Engine. While not strictly required, it's strongly recommended that the Correlation Engine be installed on the root management server.  Make sure that you download and install the Exchange 2010 Management Pack that matches the operating system for the selected server. You can install the 32-bit or 64-bit version.  Make sure that you run the Microsoft Installer (.msi) package on the server where you want the Exchange 2010 Management Pack and the Correlation Engine to be installed and complete the installation.

10 After the installation is complete, the Correlation Engine service will have been installed on the server, and the Management Pack files will have been copied to the System Center Management Packs folder. By default, the installation directory is C:\Program Files\System Center Management Pack. For more information about the Correlation Engine, see Understanding Alert Correlation.

Files to Download The Exchange 2010 Management Pack installation package includes the following files:  Microsoft.Exchange.2010.mp  Microsoft.Exchange.2010.Reports.mp The installation package also includes the files required by the Correlation Engine in addition to the Exchange 2010 Management Pack license agreement.

Recommended Additional Management Packs To provide complete monitoring coverage for Exchange 2010 and the services on which Exchange 2010 depends, we recommend that you also install the following management packs:  Active Directory  Internet Information Services (IIS)  Domain Name System (DNS)  Windows Server 2008 or Windows Server 2008 R2

Other Requirements The Correlation Engine requires the following:  It must be installed on a computer running Windows Server 2003, or either the 32-bit or 64-bit version of Windows Server 2008 or Windows Server 2008 R2.  The computer running the Correlation Engine must have network connectivity to the root management server.  The System Center Operations Manager 2007 console must be installed on the computer that's running the Correlation Engine.  Administrators should not disable discovery as this will cause critical pieces of the Management Pack to not function correctly.  As mentioned previously, the discovery interval has been increased to 24 hours to decrease the impact on a Management Group. Administrators should exercise caution should they decide to decrease this value.

How to Import the Exchange 2010 Management Pack For instructions about importing a management pack, see How to Import a Management Pack in Operations Manager 2007 (http://go.microsoft.com/fwlink/?LinkId=142351). 1. Log on to the computer with an account that is a member of the Operations Manager Administrators role for the Operations Manager 2007 management group.

11 2. In the Operations console, click Administration.

Note: When you run the Operations console on a computer that is not a management server, the Connect to Server dialog box displays. In the Server name text box, type the name of the management server to which you want to connect. 3. Right-click the Management Packs node, and then click Import Management Packs. 4. The Import Management Packs wizard opens. Click Add, and then click Add from disk. 5. If prompted to connect to the online catalog, click No. 6. The Select Management Packs to import dialog box appears. Go to the directory where your management pack file is located. By default, the location is C:\Program Files\System Center Management Packs. 7. Select both management pack files to import from that directory, and then click Open. 8. On the Select Management Packs page, the management packs that you selected for import are listed. An icon next to each management pack in the list indicates the status of the selection, as follows: a. A green check mark indicates that the management pack can be imported. A blue exclamation point indicates that an older version of the management pack is installed. When all of the management packs in the list display one of these icons, click Import. b. A red error icon indicates that the management pack is dependent on one or more management packs that are not in the Import list and are not available in the catalog. To view the missing management packs, click Error in the Status column. To remove the management pack with the error from the Import list, right-click the management pack, and then click Remove.

Note: When you click Import, any management packs in the Import list that display the Error icon are not imported. 9. You will receive a prompt indicating that the management pack presents a security risk. This is due to the management pack's use of agent proxying. Click Yes to allow the import. 10. The Import Management Packs page appears and shows the progress for each management pack. Each management pack is downloaded to a temporary directory, imported to Operations Manager, and then deleted from the temporary directory. If there is a problem at any stage of the import process, select the management pack in the list to view the status details. Click Close.

Discovery Each discovery in the management pack is discovered by default. No additional configuration should be necessary in most customer environments. See Appendix: Objects the Exchange 2010 Management Pack Discovers later in this guide for a table of discoveries and the classes that they discover.

12 Creating a New Management Pack for Customizations Most vendor management packs are sealed so that you cannot change any of the original settings in the management pack file. However, you can create customizations, such as overrides or new monitoring objects, and save them to a different management pack. By default, System Center Operations Manager 2007 saves all customizations to the Default Management Pack. As a best practice, you should instead create a new management pack for each sealed management pack you want to customize. Creating a new management pack for storing overrides has the following advantages:  It simplifies the process of exporting customizations that were created in your test and pre-production environments to your production environment. For example, instead of exporting the Default Management Pack that contains customizations from multiple management packs, you can export just the management pack that contains customizations of a single management pack.  You can delete the original management pack without first needing to delete the Default Management Pack. A management pack that contains customizations is dependent on the original management pack. This dependency requires you to delete the management pack with customizations before you can delete the original management pack. If all of your customizations are saved to the Default Management Pack, you must delete the Default Management Pack before you can delete an original management pack.  It is easier to track and update customizations to individual management packs. For more information about sealed and unsealed management packs, see Management Pack Formats (http://go.microsoft.com/fwlink/?LinkId=108355). For more information about management pack customizations and the Default Management Pack, see About Management Packs in Operations Manager 2007 (http://go.microsoft.com/fwlink/?LinkId=108356).

Optional Configurations The Microsoft Exchange Server 2010 Management Pack has been deployed at Microsoft for more than two years in a wide range of environments. These deployments have helped us to make significant improvements to the Management Pack. They've also helped us improve the overall monitoring capability of Exchange Server 2010. The Management Pack works effectively in most Exchange configurations using the default configuration. Although some fine-tuning may be required for certain environments, the Exchange 2010 Management Pack discovery process generally loads the correct monitors on the various servers in an Exchange organization. For example, performance threshold rules are based on scalable calculations and not fixed-digit thresholds. In the Exchange 2010 Management Pack, you’ll find a number of rate and percentile counters that are designed to allow the Management Pack to scale from small deployments to large datacenter environments.

13 Create Test Mailboxes for Synthetic Transaction Tests The Exchange 2010 Management Pack can run synthetic transactions to help you measure the performance of monitored objects in your Exchange organization. The Exchange 2010 Management Pack uses the Test-OwaConnectivity, Test-ActiveSyncConnectivity, and Test- WebServicesConnectivity cmdlets to test Microsoft Office Outlook Web App, Exchange ActiveSync, and Exchange Web Services connectivity from Client Access servers to Mailbox servers. These cmdlets require that a test mailbox be created in each Active Directory site that you want to test. For more information about synthetic transactions, see Monitoring by Using Synthetic Transactions in the System Center Operations Manager 2007 R2 documentation.

Caution: If you don't create a test mailbox on one or more Mailbox servers, the Management Pack will return the following warning: “The test mailbox was not initialized. Run new- TestCasConnectivityUser.ps1 to ensure that the test mailbox is created.” Perform the following steps to create a test mailbox for Outlook Web App, Exchange ActiveSync, and Exchange Web Services connectivity monitoring. In this procedure you create test mailboxes for Outlook Web App, Exchange ActiveSync, and Exchange Web Services to monitor connectivity by using PowerShell to run the New- TestCasConnectivityUser.ps1 script. 1. Open the Exchange Management Shell. 2. In the Shell, change directory to the C:\ Program Files\Microsoft\Exchange Server\V14\Scripts folder by running the following command: Set-Location C:\Program Files\Microsoft\Exchange Server\V14\Scripts 3. Run the test-user script using the following command: New-TestCasConnectivityUser.ps1 4. Follow the on-screen installation instructions in the Shell to create the test mailbox. You'll be prompted to enter a temporary secure password for creating test users. You'll also be prompted to specify the Mailbox server where you want the test user created. 5. Repeat this process on an Exchange 2010 Mailbox server in each Active Directory site that you want to test.

Disable the Automatic Alert Resolution Feature in the Correlation Engine The Automatic Alert Resolution feature automatically closes related alerts when the Exchange 2010 Management Pack determines that the underlying issue is no longer a problem. This feature is provided by the Correlation Engine, and is enabled by default. Using Automatic Alert Resolution can cause multiple alerts to be logged if the same alert is logged again for another instance of the problem before the associated ticket has been resolved by support teams. You may also want to disable this feature under the following or other conditions:  If you're using ticketing or another support system that wouldn't work correctly if alerts are automatically resolved.

14  If you're using a connector with Operations Manager 2007. A connector is a custom service or program that allows Operations Manager to communicate with external systems. For example, you may want to disable this feature if you're using a connector that allows an external application to track Exchange 2010 Management Pack alerts. To disable Automatic Alert Resolution, perform the following steps: 1. Log on to the server that's hosting the Microsoft Exchange Monitoring Correlation Engine service. 2. Locate the Correlation Engine configuration file named Microsoft.Exchange.Monitoring.CorrelationEngine.exe.config. By default, the file is located in C:\Program Files\Microsoft\Exchange Server\V14\Bin\, where C:\ is the Exchange installation directory. 3. Open Microsoft.Exchange.Monitoring.CorrelationEngine.exe.config in a text editor such as Notepad. 4. Locate the following line in the configuration file: 5. Change to 6. Restart the Microsoft Exchange Monitoring Correlation Engine service.

Enable Event Collection for Synthetic Transaction Rules The Exchange 2010 Management Pack uses synthetic transactions, for example, running the Test-MapiConnectivity, Test-OwaConnectivity, and other commands, to scan your Exchange organization for basic connection responses and to test simple operations such as signing in to a mailbox. Whether these tests succeed or fail, their output is useful for investigating the state of the Exchange environment. However, because there is a large amount of output for each task, the event output isn't stored by default. The views for these tests in the Operations Console are populated if you enable the event collection rules for each respective test. For more information about synthetic transactions, see Monitoring by Using Synthetic Transactions in the System Center Operations Manager 2007 R2 documentation.

Caution: When you enable these collection rules, make sure you have sufficient disk space to accommodate the additional data. Each task creates from 4 to 12 event messages every time it runs. By default, each test runs every five minutes. To enable the event collection rules for synthetic transaction output: 1. In System Center Operations Manager 2007, click Authoring. 2. In the Authoring pane, expand Management Pack Objects, and then click Rules. 3. In the Rules pane, click Change Scope. 4. In the Scope Management Pack Target(s) by object dialog box, in the Look for box, type "Exchange Server 2010." 5. Click View all targets.

15 6. Click Select All if it’s not disabled (it is only disabled when all rows are already selected). 7. Click OK to close the dialog box. 8. After the rules have loaded, type "Script event collection" in the Look for box near the top of the console. 9. For each test task that you would like to enable, perform the following steps: a. Right-click the rule and select Overrides > Override the Rule > For all objects of class:. b. Select the Override check box. c. Set the override value to True. d. Click OK. It will take some time for the overrides to be picked up by the agents and for events to appear in the built-in views.

Enable an Optional Monitor If You're Using Kerberos Authentication with a Client Access Server Array If your organization is using Kerberos authentication with a Client Access server array, you'll need to manage the shared alternate service account credential password. Exchange 2010 Service Pack 1 contains a management script that helps automate the distribution and updating of the alternate service account credential (ASA credential) to all Client Access servers within the scope of the script. For more information about this script, see Configuring Kerberos Authentication for Load-Balanced Client Access Servers. If you're using the RollAlternateServiceAccountPassword.ps1 script to perform regular password maintenance, the Exchange 2010 Management Pack includes two monitors to help you make sure that the script is running correctly. The following two monitors are only helpful if you're relying on the script to perform regular password maintenance and you have the script running as a scheduled task.  The powershell script rolling out alternate service account password for CAS array Kerberos authentication has failed - RollAlternateServiceAccountPassword.ps1 This monitor is enabled by default. The alert for this monitor is logged when the script fails. This monitor detects script failures by watching for failure event IDs in Application and Services Logs.  Kerberos Authentication for CAS array - shared alternate service account credential password for Kerberos authentication has not been updated in 28 days and may be stale This monitor isn't enabled by default because most Exchange deployments don't use a shared ASA credential and therefore don't need to run the RollAlternateServiceAccountCredential.ps1 script as a scheduled task. The alert for this monitor will fire if it doesn't detect that the script has been successfully run in the past 28 days. The alert reminds you to check the credential to make sure it won't expire and cause a Kerberos authentication outage. This monitor detects whether the script has been running by monitoring the Application and Services Logs on the computer that is running the scheduled task. This alert can be logged, for example, when the user name and password that are being used to run the scheduled

16 task need to be updated. This monitor must be enabled for the specific Client Access server computer that's running the scheduled task. To enable this monitor, use the following steps: 1. In System Center Operations Manager 2007, click Authoring. 2. In the Authoring pane, expand Management Pack Objects, and then click Monitors. 3. On the toolbar, click Scope. 4. In the Scope Management Pack Target(s) by object dialog box, in the Look for box, type "Outlook Service Availability." 5. Click View all targets. 6. Click Select All if it’s not disabled (it's only disabled when all rows are already selected). 7. Click OK to close the dialog box. 8. After the rules have loaded, click Outlook Service Availability > Entity Health > Availability. 9. Under Availability, right-click the rule Kerberos Authentication for CAS array - shared alternate service account credential password for Kerberos authentication has not been updated in 28 days and may be stale, and then click Overrides > Override the Monitor > For a specific objects of type: Outlook Service Availability. 10. In the Select Object dialog box, select the instance of the rule that includes the server on which you're running the RollAlternateServiceAccountPassword.ps1 script, and then click OK. 11. In the Override Properties dialog box, select the Override check box. 12. Set the override value to True. 13. Click OK. It will take some time for the overrides to be picked up by the agents and for events to appear in the built-in views.

Security Considerations Due to the security model under which Microsoft Exchange Server 2010 has been tested, running the agent as anything other than LocalSystem has not been tested.

Caution: If you run the agent as anything other than LocalSystem, then the synthetic transactions fail to run. You may also experience other issues.

Understanding Management Pack Operations It's important to understand the classes and alert correlation used by the Microsoft Exchange Server 2010 Management Pack. Review the following topics to learn more about the classes and alert correlation for the Exchange 2010 Management Pack:  Understanding Classes

17  Understanding Alert Correlation  Understanding the Exchange Management Pack Health State Model

Understanding Classes The Microsoft Exchange Server 2010 includes an extensive class model. Diagrams showing the class model are provided in the Appendix: Class Hierarchy later in this guide. Consider the following information about Client Access server classes and site-wide aggregated classes. Client Access Protocol and Client Access Service Classes The Client Access server role is strongly associated with Active Directory site boundaries. The class model for client access reflects this association. For most protocol classes hosted on the Exchange/agent computer, there is a class hosted on the Root Management Server (RMS) that represents the health of that protocol for the site. State rolls up from that protocol on each server to the site-wide instance. Site-Wide Aggregated Classes The site-wide aggregated classes use an aggregation on their dependency monitors so that the state changes only when all of the Client Access servers detect a protocol failure for a given protocol. This is intended to model the corrective actions taken by load balancing technologies to divert the load to functional servers as protocols/servers fail. In the Appendix: Class Hierarchy in this guide, these classes have the suffix "Service." These classes are represented in the "Service State" view. For more details about how these site-wide aggregated classes impact availability reporting, see "Appendix: Reports" later in this guide.

Understanding Alert Correlation At the core of the Microsoft Exchange Server 2010 Management Pack is the Correlation Engine. The goal of the Correlation Engine is to significantly reduce the number of alerts that may not require an action by the administrator that is monitoring the Exchange environment by watching the System Center Operations Manager Console.

Architecture The Correlation Engine is a stand-alone Windows service that uses the Operations Manager SDK interface to first retrieve the health model (or instance space) and then process state change events. By maintaining the health model in memory, and processing state change events, the Correlation Engine is able to determine when to raise an alert based on the state of the system.

18 In the diagram above, you can see that, in response to a problem, several monitors change state, and the corresponding state change events are forwarded by the agent to the Root Management Server (RMS). Once received by the RMS, they are processed by the Correlation Engine, which may raise an alert via the RMS’s Software Development Kit (SDK) interface. This alert is then visible on the Operations Manager Console.

Alert Classification Exchange Server 2010 Management Pack alerts are classified into one of three categories. Use the following guidelines to understand these alert classifications.  Key Health Indicator (KHI) KHIs are issues that affect the health of the service. Most alerts fall into this category (for example, "A mailbox database is dismounted.")  Non-Service Impacting (NSI) NSI monitors detect problems that may affect some users, but not every user of the system. A good example of an NSI situation is two users with the same proxy address – mail to this address will be returned as non-deliverable, but the overall transport system is not otherwise impaired.  Forensic Forensic monitors are used to record information that may be relevant while troubleshooting an issue, but isn’t necessarily indicative of an eminent or existing system failure. "CPU activity >90% for 5 minutes" is an example of a forensic issue – there may be a process inappropriately consuming CPU cycles, or the server may have been rebooted and is catching up on normal system activity. These monitors are visible in the Alert Context field of the alert properties and in Health Explorer. Alerts are not raised for Forensic monitors.

Note: State is not updated when a single forensic monitor alert is raised. However, state may be updated based on the aggregation of current forensic monitor alerts for each component.

Alert Severity Exchange Server 2010 Management Pack alerts are also classified by the severity of the alerts. Use the following guidelines to understand alert severity.  Error alerts Error alerts are alerts that require human intervention to restore the service to proper operation.

19  Warning alerts Warning alerts provide an early warning that the system may fail (which would then raise an Error, if appropriate).  Informational alerts Informational alerts are not raised by the Exchange 2010 Management Pack.

Correlation Factors The actions taken by the Correlation Engine is determined based on the several factors. Monitor state change events Monitors, which watch for the specific diagnostics from Exchange such as event log messages, performance counter thresholds, and PowerShell task output events, register state change events when they detect that a problem has occurred or cleared (red to green or green to red), or as agents become unavailable or are placed in maintenance mode (and subsequently made available, and/or removed from maintenance mode). Typically, alert rules are configured to fire when green to red state changes occur. In the Exchange Server 2010 Management Pack, you’ll find that this is not the case. Specifically, alerts are not automatically raised by monitor state changes. The Correlation Engine may determine the best alert to raise. Health Model The class hierarchy imported into Operations Manager by the Exchange Server 2010 Management Pack is extensive. The class hierarchy includes class relationships that define component dependencies throughout the system. By defining these component dependencies in the object representation of the product, the Exchange Server 2010 Management Pack is able to better understand the health of the Exchange organization. For example, if the Exchange Server 2010 Management Pack identifies Active Directory as offline, it will also report that Exchange messaging is not fully functional. Timing The Correlation Engine works in 90-second intervals. When state change events for multiple monitors come in at the same time, it waits to see whether anything else potentially related to the failure is detected so that it can make the most effective determination of the root cause.

Correlation Algorithm Overview of the Correlation Engine process 1. First, it connects to the Operations Manager SDK service to download the Health Model hierarchy and instance state (on service startup only, or as needed if errors require it). 2. Next, it queries Operations Manager for the latest state change events related to entities in the Exchange Management Pack. 3. If new NSI state changes are detected, then it raises alerts for them. 4. KHI monitors are then evaluated, and "chains" of red KHI monitors are isolated. These "chains" indicate issues where a dependency has failed and is impacting dependent processes. Recognizing these relationships is the key step. 5. Alerts are raised for the root cause monitor in the KHI chain. 6. It then waits 90 seconds, and then starts over at step 2 above. Additional points of interest regarding the correlation engine process

20  If the "chain" of KHIs includes both error and warning monitors, then the alert is raised as an error, regardless of the class of the root cause monitor. For example, if a top-level process defines an error monitor to catch failure cases, and if it is correlated to a warning monitor in a dependency, then the alert will be raised against the dependency, but it will be marked as an error instead of a warning.  Not every class relationship is used for alert correlation. See the Appendix: Class Hierarchy later in this guide for the specific relationships used by the Correlation Engine.  The KHI chain, including any forensic monitors, is included in the Alert Context field available in the properties of the final alert. This allows inspection of the monitors correlated to the given alert and, in the case of alerts firing from dependency monitors, is required to determine the specific failure referenced by the alert.  Monitors in maintenance mode are simply skipped when evaluating the health model. What is and is not Affected by Alert Correlation A key point to understand about the Exchange Server 2010 Management Pack, and the Correlation Engine in particular, is what the Correlation Engine affects, and what it doesn’t affect. The following items are different due to the Correlation Engine:  Monitors are configured not to alert automatically on state change events. This allows the Correlation Engine to determine the best alert to raise (as described above).  The Exchange Server 2010 Management Pack doesn't raise Exchange alerts that correspond to the health of your environment when the Correlation Engine is stopped. If the Correlation Engine is stopped, a general alert is raised to notify you that the Correlation Engine is not running. The following items are not different due to the presence of the Correlation Engine:  Overrides still work as expected; you can change certain values or disable monitors just as you do today.  Monitors/objects in maintenance mode are skipped by the Correlation Engine. No special consideration is required since the monitors don’t raise state change events for consumption by the Correlation Engine.  Per-monitor alert rules were added to the Exchange Server 2010 Management Pack. Per-monitor alert rules allow monitoring personnel to enter company-specific notes for a given alert into the Company Knowledge field, even when the alert rules aren’t used to raise alerts for their corresponding monitors.  Other management packs are not affected by the presence of the Correlation Engine. In summary, keep in mind that it’s just the "monitor state change to alert" step that is enhanced by correlation. Operational Notes Since the Correlation Engine needs to maintain the instance space of the management group in memory to determine related monitors/alerts, its memory footprint is relative to the number of instances in the management group. In plain terms, the more Exchange servers and databases you have, the more memory it will require.

21 In observing environments at Microsoft, the Correlation Engine scales roughly at about 5 megabytes per monitored Exchange server. There are factors that can drive this number up or down, but it’s a good starting point toward understanding the resource impact on the server hosting the service. As stated above, the preferred location for the service is on the RMS role given the close SDK interaction and core functionality of raising alerts.

Automatic Reset of Event Monitors in the Exchange 2010 Management Pack In the Exchange 2010 Management Pack, most of the event monitors are automatically reset by the Correlation Engine. Automatic reset was added to those event monitors so that issues aren't missed the next time they occur. The following are the event monitors that are not reset automatically.

Monitor Name

There was an error loading the journaling agent configuration.

A hanging delivery has been detected.

Your Autodiscover service configuration isn't secure. To fix this problem, disable anonymous access on the Autodiscover virtual directory.

Exchange failed to create the log directory. Logs won't be generated until the reason for the failure is corrected.

Exchange failed to write the logs because of an error. The source component and cause of the error are specified in the event description.

Read-only files have been found in the Pickup directory.

MSExchangeTransport has detected a critical storage error and has taken an automated recovery action by moving the database.

File Distribution Service: Failed to read the security descriptor from Active Directory for the offline address book.

ExBPA Warning.

ExBPA Error.

Unable to move mailbox.

DsProxy DLL is required but cannot be loaded.

Performance counters for NSPI Proxy could not

22 Monitor Name be initialized.

The local database copy experienced an index corruption. Please reseed the catalog by using the Update-MailboxDatabaseCopy cmdlet with the -CatalogOnly parameter.

Unable to load the performance counters for the Microsoft Exchange Mail Submission Service. The respective Performance object is named MSExchangeMail Submission.

The local topology server does not belong to any Active Directory site.

The Microsoft Mail Submission Service encountered an exception when trying to load network topology information.

The Exchange Topology discovery couldn't find the local Exchange server in Active Directory.

A hanging submission has been detected

Database copy encountered a serious I/O error (lost flush) that may have affected all copies of the database.

Database copy encountered a serious I/O error (active lost flush) that may have affected all copies of the database.

Local database copy encountered a serious I/O error (active lost flush) that may have affected all copies of the database.

The database engine has consumed 99% of the "b-trees" resource (87048 used out of a maximum of 87696) for the database.

A database copy's incremental reseed files failed to removed.

Failed to remove continuous replication files for a database copy.

Single page restore initiated to correct an error in a database copy.

Single page restore successfully corrected a

23 Monitor Name detected error of a database copy.

Failed to remove a log file for database. Either the file is in use or the service has insufficient permissions.

The correlation interval value specified is less than the minimum allowed value.

The specified correlation time window value is less than the minimum allowed value.

Understanding the Exchange Management Pack Health State Model The Exchange 2010 Management Pack monitors the health of components, systems, services, servers, or applications in your Exchange environment. Health in this context means the way they're functioning and performing. When they are operating as expected, for example, the health state is determined to be "Running." A health state model describes the health states that an application or component can be in, as well as the criteria that cause it to transition from one state to another (for example, from a green state to a red state or from a red state to a green state). To calculate the health state of the Exchange environment, the Exchange 2010 Management Pack organizes Exchange components into layers. The health of one layer can depend on the health at a lower level. Each dependency can be described in a containment relationship. A containment relationship indicates that a class (the source class) can contain another class (the target class). For example, when a target class is identified as no longer being in a healthy state and changes from a green state to a red state, the parent class is also identified as not being in a healthy state and changes to a red state. The following provides an example of a selected portion of the Exchange 2010 Management Pack health model, and provides a list of the containment relationships that for your reference.

How Health is Calculated for the Client Access Server Role The Exchange 2010 Management Pack uses many classes and containment relationships to calculate health state. The following is a partial example of how heath is calculated for the Client Access server role: Organization Availability Services Availability - IMAP4 Service – SiteA Availability - POP3 Service – SiteA Availability - MAPI Service – SiteA

24 Availability - OWA Service – SiteA Availability - IMAP4 Service – SiteB Availability - POP3 Service – SiteB Availability - MAPI Service – SiteB Availability - OWA Service – SiteB OWA Service – Site B Availability – OWA – Server [OWA Monitors]

Forensic Monitor Types The Exchange 2010 Management Pack uses forensic monitors to record information that may be relevant while troubleshooting an issue, but doesn't necessarily indicate of an imminent or existing system failure. As discussed in Understanding Alert Correlation, alerts aren't raised for forensic monitors. Also, forensic monitors don't impact the way the Exchange 2010 Management Pack calculates health. The following is an example of the monitors you'll see for a class that includes forensic monitors: Forensic Data - Forensic Monitors – Monitor A Monitor B Forensic: Overall Health – Forensic monitors are prevented from calculating the health state for the following reasons:  The "Forensic: Overall Health" monitor targets an event that's never logged and the health state for this monitor always remains in a green state.  The Overall Health monitor and the Forensic Monitors objects have a containment relationship with Forensic Data monitor. Because Overall Health is always in a green state, Forensic Data is always in a green state. For this reason, the health state of Forensic Monitors is prevented from rolling up higher in the tree.

Containment Relationships The following table lists the containment relationships that the Exchange 2010 Management Pack uses to calculate health. Consider the following as you review the table:  The class Root contains Organization, the class Organization contains Service, and so on.  All the classes whose names end with “Service” are site-level entities. Their health is rolled up to the servers in the same site.  For clarity, the prefix “Microsoft.Exchange.2010.” for class names has been omitted from the classes listed in the following table. For example, the classes

25 Microsoft.Exchange.2010.Root, Microsoft.Exchange.2010.Organization, and Microsoft.Exchange.2010.Server are identified as Root, Organization, and Server in the table.

Source class Target class

Root Organization

Organization Service

Server ServerRole

ClientAccessActiveSyncService ClientAccessActiveSync

ClientAccessOutlookWebAccessService ClientAccessOutlookWebAccess

ClientAccessExchangeControlPanelServic ClientAccessExchangeControlPanel e

ClientAccessWebServicesService ClientAccessWebServices

ClientAccessAvailabilityServicesService ClientAccessAvailabilityService

ClientAccessAnonymousCalendarSharingS ClientAccessAnonymousCalendarSharing ervice

ClientAccessOfflineAddressBookService ClientAccessOfflineAddressBook

ClientAccessImap4Service ClientAccessImap4

ClientAccessPop3Service ClientAccessPop3

EdgeTransportService EdgeTransportComponent

HubTransportService HubTransportComponent

MailboxMapiService Mailbox.MailboxMonitoring

UnifiedMessagingService ClientAccessUnifiedMessaging

CommonRemotePowerShellService CommonRemotePowerShell

ClientAccessOutlookService ClientAccessOutlook

ClientAccessOutlookServerService ClientAccessOutlookLocalServer

ClientAccessOutlookPerformanceService ClientAccessOutlookDirectory

ClientAccessOutlookPerformanceService ClientAccessOutlookRpcProxy

ClientAccessMailboxReplicationServicesSe ClientAccessMailboxReplicationService rvice

DomainControllerFunctionalityService DomainControllerFunctionalityServer

CommonRemotePowerShell CommonConfigurationAuthorization

CommonConfigurationAuthorization CommonActiveDirectoryAccess

CommonTransportThrottlingClient MailboxTransportThrottlingServer

26 Source class Target class

ClientAccessActiveSync ClientAccessServiceMonitoring

ClientAccessActiveSync CommonActiveDirectoryAccess

ClientAccessActiveSync CommonAllServerRoles

ClientAccessActiveSync CommonBestPracticeAnalyzer

ClientAccessActiveSync CommonProblemAnalysis

ClientAccessActiveSync CommonServer

ClientAccessAutoDiscovery ClientAccessServiceMonitoring

ClientAccessAutoDiscovery CommonActiveDirectoryAccess

ClientAccessAutoDiscovery CommonAllServerRoles

ClientAccessAutoDiscovery CommonBestPracticeAnalyzer

ClientAccessAutoDiscovery CommonProblemAnalysis

ClientAccessAutoDiscovery CommonServer

ClientAccessFileDistributionService ClientAccessServiceMonitoring

ClientAccessFileDistributionService CommonActiveDirectoryAccess

ClientAccessFileDistributionService CommonAllServerRoles

ClientAccessFileDistributionService CommonBestPracticeAnalyzer

ClientAccessFileDistributionService CommonFileDistributionService

ClientAccessFileDistributionService CommonProblemAnalysis

ClientAccessFileDistributionService CommonServer

ClientAccessImap4 ClientAccessServiceMonitoring

ClientAccessImap4 CommonActiveDirectoryAccess

ClientAccessImap4 CommonAllServerRoles

ClientAccessImap4 CommonBestPracticeAnalyzer

ClientAccessImap4 CommonProblemAnalysis

ClientAccessImap4 CommonServer

ClientAccessInformationWorker ClientAccessServiceMonitoring

ClientAccessInformationWorker CommonActiveDirectoryAccess

ClientAccessInformationWorker CommonAllServerRoles

ClientAccessInformationWorker CommonBestPracticeAnalyzer

ClientAccessInformationWorker CommonProblemAnalysis

ClientAccessInformationWorker CommonServer

ClientAccessOutlookWebAccess ClientAccessServiceMonitoring

ClientAccessOutlookWebAccess CommonActiveDirectoryAccess

ClientAccessOutlookWebAccess CommonAllServerRoles

ClientAccessOutlookWebAccess CommonBestPracticeAnalyzer

ClientAccessOutlookWebAccess CommonProblemAnalysis

ClientAccessOutlookWebAccess CommonServer

ClientAccessExchangeControlPanel ClientAccessServiceMonitoring

ClientAccessExchangeControlPanel CommonActiveDirectoryAccess

ClientAccessExchangeControlPanel CommonAllServerRoles

ClientAccessExchangeControlPanel CommonBestPracticeAnalyzer

ClientAccessExchangeControlPanel CommonProblemAnalysis

ClientAccessExchangeControlPanel CommonServer

ClientAccessPop3 ClientAccessServiceMonitoring

ClientAccessPop3 CommonActiveDirectoryAccess

ClientAccessPop3 CommonAllServerRoles

ClientAccessPop3 CommonBestPracticeAnalyzer

ClientAccessPop3 CommonProblemAnalysis

ClientAccessPop3 CommonServer

ClientAccessWebServices ClientAccessServiceMonitoring

ClientAccessWebServices CommonActiveDirectoryAccess

ClientAccessWebServices CommonAllServerRoles

ClientAccessWebServices CommonBestPracticeAnalyzer

ClientAccessWebServices CommonProblemAnalysis

ClientAccessWebServices CommonServer

ClientAccessAvailabilityService ClientAccessWebServices

ClientAccessAvailabilityService ClientAccessAutoDiscovery

ClientAccessAvailabilityService ClientAccessServiceMonitoring

ClientAccessAvailabilityService CommonAllServerRoles

ClientAccessAvailabilityService CommonBestPracticeAnalyzer

ClientAccessAvailabilityService CommonProblemAnalysis

ClientAccessAvailabilityService CommonServer

ClientAccessAnonymousCalendarSharing CommonAllServerRoles

ClientAccessAnonymousCalendarSharing CommonBestPracticeAnalyzer

ClientAccessAnonymousCalendarSharing CommonProblemAnalysis

ClientAccessAnonymousCalendarSharing CommonServer

ClientAccessOfflineAddressBook ClientAccessServiceMonitoring

ClientAccessOfflineAddressBook CommonAllServerRoles

ClientAccessOfflineAddressBook CommonBestPracticeAnalyzer

ClientAccessOfflineAddressBook CommonProblemAnalysis

ClientAccessOfflineAddressBook CommonServer

ClientAccessOutlook ClientAccessServiceMonitoring

ClientAccessOutlook ClientAccessAutoDiscovery

ClientAccessOutlook CommonAllServerRoles

ClientAccessOutlook CommonBestPracticeAnalyzer

ClientAccessOutlook CommonProblemAnalysis

ClientAccessOutlook CommonServer

ClientAccessUnifiedMessaging ClientAccessServiceMonitoring

ClientAccessUnifiedMessaging CommonAllServerRoles

ClientAccessUnifiedMessaging CommonBestPracticeAnalyzer

ClientAccessUnifiedMessaging CommonProblemAnalysis

ClientAccessUnifiedMessaging CommonServer

ClientAccessTestConfig ClientAccessServiceMonitoring

ClientAccessTestConfig CommonActiveDirectoryAccess

ClientAccessTestConfig CommonAllServerRoles

ClientAccessTestConfig CommonServer

ClientAccessTestConfig ClientAccessActiveSync

ClientAccessTestConfig ClientAccessImap4

ClientAccessTestConfig ClientAccessOutlookWebAccess

ClientAccessTestConfig ClientAccessExchangeControlPanel

ClientAccessTestConfig ClientAccessPop3

ClientAccessTestConfig ClientAccessWebServices

ClientAccessMailboxReplicationService CommonActiveDirectoryAccess

ClientAccessMailboxReplicationService CommonAllServerRoles

ClientAccessMailboxReplicationService CommonBestPracticeAnalyzer

ClientAccessMailboxReplicationService CommonProblemAnalysis

ClientAccessMailboxReplicationService CommonServer

EdgeTransportAgentsAddressRewrite EdgeTransportServiceMonitoring

EdgeTransportAgentsAddressRewrite CommonActiveDirectoryAccess

EdgeTransportAgentsAddressRewrite CommonAllServerRoles

EdgeTransportAgentsAddressRewrite CommonBestPracticeAnalyzer

EdgeTransportAgentsAddressRewrite CommonProblemAnalysis

EdgeTransportAgentsAddressRewrite CommonTransport

EdgeTransportAgentsAddressRewrite CommonTransportAgents

EdgeTransportAgentsAddressRewrite CommonTransportLogSearch

EdgeTransportAgentsAddressRewrite CommonServer

EdgeTransportAgentsAttachmentFilter EdgeTransportServiceMonitoring

EdgeTransportAgentsAttachmentFilter CommonActiveDirectoryAccess

EdgeTransportAgentsAttachmentFilter CommonAllServerRoles

EdgeTransportAgentsAttachmentFilter CommonBestPracticeAnalyzer

EdgeTransportAgentsAttachmentFilter CommonProblemAnalysis

EdgeTransportAgentsAttachmentFilter CommonTransport

EdgeTransportAgentsAttachmentFilter CommonTransportAgents

EdgeTransportAgentsAttachmentFilter CommonTransportLogSearch

EdgeTransportAgentsAttachmentFilter CommonServer

EdgeTransportAgentsConnectionFilter EdgeTransportServiceMonitoring

EdgeTransportAgentsConnectionFilter CommonActiveDirectoryAccess

EdgeTransportAgentsConnectionFilter CommonAllServerRoles

EdgeTransportAgentsConnectionFilter CommonBestPracticeAnalyzer

EdgeTransportAgentsConnectionFilter CommonProblemAnalysis

EdgeTransportAgentsConnectionFilter CommonTransport

EdgeTransportAgentsConnectionFilter CommonTransportAgents

EdgeTransportAgentsConnectionFilter CommonTransportLogSearch

EdgeTransportAgentsConnectionFilter CommonServer

EdgeTransportAgentsContentFilter EdgeTransportServiceMonitoring

EdgeTransportAgentsContentFilter CommonActiveDirectoryAccess

EdgeTransportAgentsContentFilter CommonAllServerRoles

EdgeTransportAgentsContentFilter CommonBestPracticeAnalyzer

EdgeTransportAgentsContentFilter CommonProblemAnalysis

EdgeTransportAgentsContentFilter CommonTransport

EdgeTransportAgentsContentFilter CommonTransportAgents

EdgeTransportAgentsContentFilter CommonTransportLogSearch

EdgeTransportAgentsContentFilter CommonServer

EdgeTransportAgentsProtocolAnalysis EdgeTransportServiceMonitoring

EdgeTransportAgentsProtocolAnalysis CommonActiveDirectoryAccess

EdgeTransportAgentsProtocolAnalysis CommonAllServerRoles

EdgeTransportAgentsProtocolAnalysis CommonBestPracticeAnalyzer

EdgeTransportAgentsProtocolAnalysis CommonProblemAnalysis

EdgeTransportAgentsProtocolAnalysis CommonTransport

EdgeTransportAgentsProtocolAnalysis CommonTransportAgents

EdgeTransportAgentsProtocolAnalysis CommonTransportLogSearch

EdgeTransportAgentsProtocolAnalysis CommonServer

EdgeTransportAgentsRecipientFilter EdgeTransportServiceMonitoring

EdgeTransportAgentsRecipientFilter CommonActiveDirectoryAccess

EdgeTransportAgentsRecipientFilter CommonAllServerRoles

EdgeTransportAgentsRecipientFilter CommonBestPracticeAnalyzer

EdgeTransportAgentsRecipientFilter CommonProblemAnalysis

EdgeTransportAgentsRecipientFilter CommonTransport

EdgeTransportAgentsRecipientFilter CommonTransportAgents

EdgeTransportAgentsRecipientFilter CommonTransportLogSearch

EdgeTransportAgentsRecipientFilter CommonServer

EdgeTransportAgentsSenderFilter EdgeTransportServiceMonitoring

EdgeTransportAgentsSenderFilter CommonActiveDirectoryAccess

EdgeTransportAgentsSenderFilter CommonAllServerRoles

EdgeTransportAgentsSenderFilter CommonBestPracticeAnalyzer

EdgeTransportAgentsSenderFilter CommonProblemAnalysis

EdgeTransportAgentsSenderFilter CommonTransport

EdgeTransportAgentsSenderFilter CommonTransportAgents

EdgeTransportAgentsSenderFilter CommonTransportLogSearch

EdgeTransportAgentsSenderFilter CommonServer

EdgeTransportAgentsSenderId EdgeTransportServiceMonitoring

EdgeTransportAgentsSenderId CommonActiveDirectoryAccess

EdgeTransportAgentsSenderId CommonAllServerRoles

EdgeTransportAgentsSenderId CommonBestPracticeAnalyzer

EdgeTransportAgentsSenderId CommonProblemAnalysis

EdgeTransportAgentsSenderId CommonTransport

EdgeTransportAgentsSenderId CommonTransportAgents

EdgeTransportAgentsSenderId CommonTransportLogSearch

EdgeTransportAgentsSenderId CommonServer

EdgeTransportDsn EdgeTransportServiceMonitoring

EdgeTransportDsn CommonActiveDirectoryAccess

EdgeTransportDsn CommonAllServerRoles

EdgeTransportDsn CommonBestPracticeAnalyzer

EdgeTransportDsn CommonProblemAnalysis

EdgeTransportDsn CommonTransport

EdgeTransportDsn CommonTransportLogSearch

EdgeTransportDsn CommonServer

EdgeTransportMessageSecurity EdgeTransportServiceMonitoring

EdgeTransportMessageSecurity CommonActiveDirectoryAccess

EdgeTransportMessageSecurity CommonAllServerRoles

EdgeTransportMessageSecurity CommonBestPracticeAnalyzer

EdgeTransportMessageSecurity CommonProblemAnalysis

EdgeTransportMessageSecurity CommonTransport

EdgeTransportMessageSecurity CommonTransportLogSearch

EdgeTransportMessageSecurity CommonServer

EdgeTransportQueues EdgeTransportServiceMonitoring

EdgeTransportQueues CommonActiveDirectoryAccess

EdgeTransportQueues CommonAllServerRoles

EdgeTransportQueues CommonBestPracticeAnalyzer

EdgeTransportQueues CommonProblemAnalysis

EdgeTransportQueues CommonTransport

EdgeTransportQueues CommonTransportLogSearch

EdgeTransportQueues CommonServer

HubTransportAgentsConnectionFilter HubTransportServiceMonitoring

HubTransportAgentsConnectionFilter CommonActiveDirectoryAccess

HubTransportAgentsConnectionFilter CommonAllServerRoles

HubTransportAgentsConnectionFilter CommonBestPracticeAnalyzer

HubTransportAgentsConnectionFilter CommonProblemAnalysis

HubTransportAgentsConnectionFilter CommonTransport

HubTransportAgentsConnectionFilter CommonTransportAgents

HubTransportAgentsConnectionFilter CommonTransportLogSearch

HubTransportAgentsConnectionFilter CommonServer

HubTransportAgentsContentFilter HubTransportServiceMonitoring

HubTransportAgentsContentFilter CommonActiveDirectoryAccess

HubTransportAgentsContentFilter CommonAllServerRoles

HubTransportAgentsContentFilter CommonBestPracticeAnalyzer

HubTransportAgentsContentFilter CommonProblemAnalysis

HubTransportAgentsContentFilter CommonTransport

HubTransportAgentsContentFilter CommonTransportAgents

HubTransportAgentsContentFilter CommonTransportLogSearch

HubTransportAgentsContentFilter CommonServer

HubTransportAgentsMessagingPolicies HubTransportServiceMonitoring

HubTransportAgentsMessagingPolicies CommonActiveDirectoryAccess

HubTransportAgentsMessagingPolicies CommonAllServerRoles

HubTransportAgentsMessagingPolicies CommonBestPracticeAnalyzer

HubTransportAgentsMessagingPolicies CommonProblemAnalysis

HubTransportAgentsMessagingPolicies CommonTransport

HubTransportAgentsMessagingPolicies CommonTransportAgents

HubTransportAgentsMessagingPolicies CommonTransportLogSearch

HubTransportAgentsMessagingPolicies CommonServer

HubTransportAgentsProtocolAnalysis HubTransportServiceMonitoring

HubTransportAgentsProtocolAnalysis CommonActiveDirectoryAccess

HubTransportAgentsProtocolAnalysis CommonAllServerRoles

HubTransportAgentsProtocolAnalysis CommonBestPracticeAnalyzer

HubTransportAgentsProtocolAnalysis CommonProblemAnalysis

HubTransportAgentsProtocolAnalysis CommonTransport

HubTransportAgentsProtocolAnalysis CommonTransportAgents

HubTransportAgentsProtocolAnalysis CommonTransportLogSearch

HubTransportAgentsProtocolAnalysis CommonServer

HubTransportAgentsRecipientFilter HubTransportServiceMonitoring

HubTransportAgentsRecipientFilter CommonActiveDirectoryAccess

HubTransportAgentsRecipientFilter CommonAllServerRoles

HubTransportAgentsRecipientFilter CommonBestPracticeAnalyzer

HubTransportAgentsRecipientFilter CommonProblemAnalysis

HubTransportAgentsRecipientFilter CommonTransport

HubTransportAgentsRecipientFilter CommonTransportAgents

HubTransportAgentsRecipientFilter CommonTransportLogSearch

HubTransportAgentsRecipientFilter CommonServer

HubTransportAgentsSenderFilter HubTransportServiceMonitoring

HubTransportAgentsSenderFilter CommonActiveDirectoryAccess

HubTransportAgentsSenderFilter CommonAllServerRoles

HubTransportAgentsSenderFilter CommonBestPracticeAnalyzer

HubTransportAgentsSenderFilter CommonProblemAnalysis

HubTransportAgentsSenderFilter CommonTransport

HubTransportAgentsSenderFilter CommonTransportAgents

HubTransportAgentsSenderFilter CommonTransportLogSearch

HubTransportAgentsSenderFilter CommonServer

HubTransportAgentsSenderId HubTransportServiceMonitoring

HubTransportAgentsSenderId CommonActiveDirectoryAccess

HubTransportAgentsSenderId CommonAllServerRoles

HubTransportAgentsSenderId CommonBestPracticeAnalyzer

HubTransportAgentsSenderId CommonProblemAnalysis

HubTransportAgentsSenderId CommonTransport

HubTransportAgentsSenderId CommonTransportAgents

HubTransportAgentsSenderId CommonTransportLogSearch

HubTransportAgentsSenderId CommonServer

HubTransportAgentsSMS HubTransportServiceMonitoring

HubTransportAgentsSMS CommonActiveDirectoryAccess

HubTransportAgentsSMS CommonAllServerRoles

HubTransportAgentsSMS CommonBestPracticeAnalyzer

HubTransportAgentsSMS CommonProblemAnalysis

HubTransportAgentsSMS CommonTransport

HubTransportAgentsSMS CommonTransportAgents

HubTransportAgentsSMS CommonTransportLogSearch

HubTransportAgentsSMS CommonServer

HubTransportDsn HubTransportServiceMonitoring

HubTransportDsn CommonActiveDirectoryAccess

HubTransportDsn CommonAllServerRoles

HubTransportDsn CommonBestPracticeAnalyzer

HubTransportDsn CommonProblemAnalysis

HubTransportDsn CommonTransport

HubTransportDsn CommonTransportLogSearch

HubTransportDsn CommonServer

HubTransportEdgeSync HubTransportServiceMonitoring

HubTransportEdgeSync CommonActiveDirectoryAccess

HubTransportEdgeSync CommonAllServerRoles

HubTransportEdgeSync CommonBestPracticeAnalyzer

HubTransportEdgeSync CommonProblemAnalysis

HubTransportEdgeSync CommonTransport

HubTransportEdgeSync CommonTransportLogSearch

HubTransportEdgeSync CommonServer

HubTransportQueues HubTransportServiceMonitoring

HubTransportQueues CommonActiveDirectoryAccess

HubTransportQueues CommonAllServerRoles

HubTransportQueues CommonBestPracticeAnalyzer

HubTransportQueues CommonProblemAnalysis

HubTransportQueues CommonTransport

HubTransportQueues CommonTransportLogSearch

HubTransportQueues CommonServer

HubTransportDsn HubTransportStoreDriver

HubTransportQueues HubTransportStoreDriver

MailboxSystemAttendant Mailbox.ServiceMonitoring

MailboxSystemAttendant CommonActiveDirectoryAccess

MailboxSystemAttendant CommonAllServerRoles

MailboxSystemAttendant CommonBestPracticeAnalyzer

MailboxSystemAttendant CommonProblemAnalysis

MailboxSystemAttendant CommonServer

MailboxTestConfig CommonActiveDirectoryAccess

MailboxTestConfig CommonAllServerRoles

MailboxTestConfig CommonServer

Mailbox.AllDatabaseServices Mailbox.DatabaseService

Mailbox.DatabaseCopyMounted Mailbox.InformationStore

Mailbox.DatabaseCopyMounted Mailbox.ClusterService

Mailbox.DatabaseCopySearchable Mailbox.ContentIndexingService

Mailbox.ContentIndexingService Mailbox.InformationStorePerformance

Mailbox.DatabaseRedundancy Mailbox.ClusterService

Mailbox.DatabaseRedundancy Mailbox.DatabaseCopy

Mailbox.DatabaseCopy Mailbox.DatabaseCopyCorruption

Mailbox.DatabaseCopy Mailbox.DatabaseCopyIntegritySuppression

Mailbox.DatabaseCopy Mailbox.ReplayService

Mailbox.DatabaseCopy Mailbox.DatabaseCopySubmission

Mailbox.DatabaseCopy Mailbox.DatabaseCopyReplication

Mailbox.DatabaseCopy Mailbox.DatabaseCopyReplay

Mailbox.DatabaseCopy Mailbox.DatabaseCopyEdbLogicalDiskSpace

Mailbox.DatabaseCopy Mailbox.DatabaseCopyLogLogicalDiskSpace

Mailbox.DatabaseCopyPerformance Mailbox.InformationStorePerformance

Mailbox.DatabaseCopyPerformance Mailbox.DatabaseCopyLogLogicalDiskPerformance

Mailbox.DatabaseCopyPerformance Mailbox.DatabaseCopyEdbLogicalDiskPerformance

Mailbox.InformationStorePerformance Mailbox.InformationStore

Mailbox.ReplayService Mailbox.InformationStore

Mailbox.Assistants Mailbox.InformationStore

Mailbox.MailSubmission Mailbox.InformationStore

Mailbox.DatabaseSearchCopy Mailbox.DatabaseCopyCorruption

Mailbox.DatabaseSearchCopy Mailbox.DatabaseCopyIntegritySuppression

Mailbox.DatabaseSearchCopy Mailbox.ContentIndexingService

Mailbox.VirusScan Mailbox.InformationStore

Mailbox.PublicFolderDatabase Mailbox.InformationStore

Mailbox.PublicFolderDatabasePerformance Mailbox.InformationStorePerformance

Mailbox.PublicFolderDatabasePerformance Mailbox.PublicFolderDatabase

Mailbox.PublicFolderDatabase Mailbox.PublicFolderDatabaseEdbLogicalDiskSpac e

Mailbox.PublicFolderDatabase Mailbox.PublicFolderDatabaseLogLogicalDiskSpace

Mailbox.PublicFolderDatabasePerformance Mailbox.PublicFolderDatabaseEdbLogicalDiskPerfor mance

Mailbox.PublicFolderDatabasePerformance Mailbox.PublicFolderDatabaseLogLogicalDiskPerfor mance

Mailbox.MailboxOnDatabase Mailbox.DatabaseService

Mailbox.MailboxOnDbCopy Mailbox.DatabaseCopyMounted

Mailbox.AllAcrossClusters Mailbox.DatabaseAvailabilityGroup

Mailbox.AllAcrossClusters Mailbox.ClusterService

Mailbox.InformationStore CommonActiveDirectoryAccess

Mailbox.MailboxMonitoring CommonProblemAnalysis

Mailbox.ReplayService CommonActiveDirectoryAccess

UnifiedMessagingComponent CommonActiveDirectoryAccess

UnifiedMessaging.Component.Pipeline UnifiedMessaging.GeneralSensor.MailboxFailures

UnifiedMessaging.Component.Pipeline CommonTransport

UnifiedMessaging.Telephony.Outbound UnifiedMessaging.Availability.Gateway

UnifiedMessagingService UnifiedMessaging.Availability.Service

UnifiedMessaging UnifiedMessagingServiceMonitoring

UnifiedMessaging CommonActiveDirectoryAccess

UnifiedMessaging CommonAllServerRoles

UnifiedMessaging CommonBestPracticeAnalyzer

UnifiedMessaging CommonProblemAnalysis

UnifiedMessaging CommonServer

ClientAccessOutlook CommonActiveDirectoryAccess

ClientAccessOutlookDirectory CommonActiveDirectoryAccess

38 Troubleshooting the Exchange 2010 Management Pack The following issues may occur when you deploy the Microsoft Exchange 2010 Management Pack. This topic provides solutions for and information about common issues that occur.

Account Lockout Some customers who have enabled account lockout policies in their environment have reported issues with the test user being locked out. If you experience lockout problems in your environment, see Microsoft Knowledge Base article 2022687, Exchange Test CAS Connectivity user gets locked out when using Exchange 2010 MP (http://go.microsoft.com/fwlink/? linkid=3052&kbid=2022687).

Event Messages Concerning MSExchange Management Event Log If the Exchange Server 2010 Service Pack 1 (SP1) version of the Management Pack is imported before all Exchange servers are upgraded to Exchange Server 2010 Service Pack 1 (SP1), the event log message below may be logged regularly. The logging of this event is expected behavior when servers that have the RTM version of Exchange 2010 installed use the Exchange 2010 SP1 Management Pack. The Exchange Server 2010 Service Pack 1 (SP1) version of the Management Pack will still monitor Exchange computers that are running Exchange Server 2010 Service Pack 1 (SP1) and Exchange Server 2010 RTM while this event is being logged. Log Name: Operations Manager Source: Health Service Modules Event ID: 26004 Level: Error Description: The Windows Event Log Provider is still unable to open the MSExchange Management event log on computer 'server'. The Provider has been unable to open the MSExchange Management event log for 565200 seconds.

Most recent error details: The specified channel could not be found. Check channel configuration.

One or more workflows were affected by this.

Appendix: Reports The following reports are included in the Microsoft Exchange Server 2010 Management Pack. Allow up to 30 minutes for reports from a new management pack to appear in the Reporting console.

39 Report Description Data Source

Service Availability Provides availability data for Custom aggregation based on clients that access mailboxes daily OpsMgr state through Microsoft Office Outlook aggregation. and Outlook Web App. It also provides availability data for Mailbox databases.

Client Access Availability Provides availability data for each Custom aggregation based on client access protocol running on a daily OpsMgr state Client Access server. For each aggregation. protocol, the report provides availability data at the server, site, and datacenter (management group) level.

Remote PowerShell Provides availability data for Custom aggregation based on Availability Remote PowerShell endpoints on daily OpsMgr state all Exchange servers. aggregation.

SMTP Availability Provides client SMTP submission Custom aggregation based on availability data as measured by daily OpsMgr state synthetic transactions. aggregation.

Unified Messaging Provides availability data for the Custom aggregation based on Availability Local Voice Unified Messaging daily OpsMgr state task. aggregation.

Performance Summary Provides detailed performance Performance collection rules. Report information that can be used to analyze capacity planning problems.

Datacenter Capacity Provides capacity utilization Custom aggregation based on Trending information at the Active Directory performance data. site level.

Machine Capacity Trending Provides capacity utilization Custom aggregation based on information at the server level. performance data.

Outlook Client Performance Provides client performance Performance data collected statistics based on the by Client Access servers as performance data submitted to reported to them by Exchange by Outlook. Outlook clients.

Daily Mailflow Statistics Provides statistics from message Custom dataset based on tracking logs to provide message tracking log information about mail flow summaries collected from latency, by the day. Hub servers.

40 Report Description Data Source

Hourly Mailflow Statistics Provides statistics from message Custom dataset based on tracking logs to provide message tracking log information about mail flow summaries collected from latency, by the hour. Hub servers.

Distribution Group Usage Provides usage data for Custom dataset based on distribution groups. message tracking log summaries collected from Hub servers.

Top Users Provides usage data for the clients Custom dataset based on that send the most messages, message tracking log receive the most messages, and summaries collected from experience the most failures. Hub servers.

Cross-Premises Mailflow Provides mail flow reporting data Mailflow output specific to the Monitoring for organizations that use both on- cross-premises scenario. premises and hosted versions of Microsoft Exchange.

Availability Reporting Calculations Definitions  Mailbox Database—Daily Availability A mailbox database is available when one of its copies is mounted. The state of a mailbox database and its copies is reported by Operations Manager. The daily availability is the percentage of the day that the mailbox database is available.  Outlook Web App—Daily Availability Both the server-level and site-level Outlook Web App states are reported by Operations Manager monitors. The Outlook Web App Service class is considered to be available when at least one Outlook Web App server is available.  Outlook—Daily Availability Both the server-level and site-level Outlook states are reported by Operations Manager monitors. The Outlook Service class is considered available when at least one Outlook server is available. Calculated Availabilities  Site Mailbox Database—Daily Availability A site’s mailbox database availability is an average of the availability of all mailboxes.  Site—Daily Availability A site’s availability is the availability of its Mailbox database minus the average length of time that the Outlook Web App Service class and Outlook Service class are unavailable.  Datacenter—Daily Availability A datacenter’s availability is the average availability for all of the sites in the datacenter.

41  Monthly Availability The monthly availability of an entity is the sum of its daily availabilities divided by the number of days in the month. Raw Uptime vs. Availability Raw Uptime = 1 – Downtime Availability = Raw Uptime + Planned Maintenance Maintenance Mode When an entity in Operations Manager is in maintenance mode, its monitors are in either the unplanned maintenance state or the planned maintenance state. This maintenance state is recorded instead of the monitor’s green, yellow, or red state. Since the monitors are unloaded while in maintenance mode, the actual availability of the component cannot be measured. As a result, Operations Manager planned maintenance is counted as uptime in the availability calculation, and unplanned maintenance is counted as downtime. Availability Database Tables The availability data is stored in the Operations Manager data warehouse database (OperationsManagerDW). The Service Level Agreement (SLA) report uses data from the Exchange2010.vAvailabilityObjListV14 and Exchange2010.vAvailabilityOnObjectDailyV14 tables:  Exchange2010.vAvailabilityObjListV14 is a list of objects that have measured availabilities. These objects are mailbox databases, Outlook Web App and Outlook servers, and the Outlook Web App and Outlook service objects (one per site). The name of each object's site is stored in this table.  Exchange2010.vAvailabilityOnObjectDailyV14 contains daily availabilities as percentages for each object in Exchange2010.vAvailabilityObjListV14.

Appendix: Synthetic Transactions The following synthetic transitions are included in the Microsoft Exchange Server 2010 Management Pack. For information about synthetic transactions, see Optional Configurations.

Task Command Frequenc y

ActiveSyncConnectivity Test-ActiveSyncConnectivity -MonitoringInstance: 12 Internal $ScriptContext.ManagementGroupName minutes -TrustAnySSLCertificate:$true -LightMode:$true

CalendarConnectivity Test-CalendarConnectivity -TestType:External 5 External minutes

CalendarConnectivity Test-CalendarConnectivity -TestType:Internal 5 Internal minutes

CasConnectivityTestCredenti Set-CasConnectivityTestCredentials 15 als minutes

ECPConnectivity External Test-EcpConnectivity -TestType:External 5

42 Task Command Frequenc y

-TrustAnySSLCertificate:$true -LightMode:$true minutes

ECPConnectivity Internal Test-EcpConnectivity -TestType:Internal 5 -TrustAnySSLCertificate:$true -LightMode:$true minutes

EdgeSynchronization Test-EdgeSynchronization 15 minutes

EdgeSyncMServ Test-EdgeSyncMserv 15 minutes

ExchangeSearch Test-ExchangeSearch 20 minutes

IMAPConnectivity Test-ImapConnectivity -ConnectionType:2 12 -TrustAnySSLCertificate:$true -LightMode:$true minutes

Mailflow CrossPremises Test-Mailflow -CrossPremises:$true 10 minutes

MAPIConnectivity Test-MAPIConnectivity -PerConnectionTimeout:60 2 -AllConnectionsTimeout:90 minutes

MRSHealth Test-MRSHealth 3 minutes

OutlookConnectivity End To Test-OutlookConnectivity -Protocol:Http 5 End -TrustAnySSLCert:$true minutes

OutlookConnectivity Test-OutlookConnectivity -Protocol:Tcp 5 Enterprise End To End -TrustAnySSLCert:$true minutes

OutlookConnectivity Test-OutlookConnectivity -RpcTestType:Server 5 Enterprise Internal -TrustAnySSLCert:$true minutes

OutlookConnectivity Internal Test-OutlookConnectivity -RpcProxyTestType:Internal 5 -RpcTestType:Server -TrustAnySSLCert:$true minutes

OWAConnectivity External Test-OwaConnectivity -TestType:External 12 -TrustAnySSLCertificate:$true -LightMode:$true minutes

OWAConnectivity Internal Test-OwaConnectivity -TestType:Internal 12 -TrustAnySSLCertificate:$true -LightMode:$true minutes

POPConnectivity Test-PopConnectivity -ConnectionType:2 12 -TrustAnySSLCertificate:$true -LightMode:$true minutes

PowerShellConnectivity Test-PowerShellConnectivity -TestType:Internal 10 Internal -TrustAnySSLCertificate:$true minutes

ReplicationHealth Test-ReplicationHealth 5

43 Task Command Frequenc y

-TransientEventSuppressionWindow 3 minutes

SmtpConnectivity Test-SmtpConnectivity 5 minutes

Test-OutlookWebServices Test-OutlookWebServices 3 minutes

UMConnectivity Local Voice Test-UMConnectivity 5 minutes

WebServicesConnectivity Test-WebServicesConnectivity 12 Internal -TrustAnySSLCertificate:$true -LightMode:$true minutes

Appendix: Scripts The following scripts are included in the Microsoft Exchange Server 2010 Management Pack.

Script Purpose

Exchange_Execute_Diagnostic_Task.js Runs synthetic transactions through PowerShell using the Exchange Monitoring Service.

GetSite.js Returns the Active Directory site name used by the Exchange server.

MicrosoftExchangeServerRoleDiscovery.js Discovery script that creates Exchange 2010 server role instances.

MicrosoftExchangeOrganizationDiscovery.js Discovery script that creates site- level "Service" entities for rollup of state by services used by Exchange, including but not limited to the Post Office Protocol 3 (POP3), Internet Messaging Access Protocol 4 (IMAP4), and Outlook Web App services.

MicrosoftExchangeClientAccessComponentDiscovery.js Discovery script for Client Access server entities.

MicrosoftExchangeEdgeTransportComponentDiscovery.js Discovery script for Edge Transport server entities.

44 Script Purpose

MicrosoftExchangeHubTransportComponentDiscovery.js Discovery script for Hub Transport server entities.

MicrosoftExchangeMailboxComponentDiscovery.js Discovery script for Mailbox server entities.

MicrosoftExchangeMailboxDiscovery.ps1 Discovery script for Mailbox High- Availability and Database Availability Groups.

MicrosoftExchangeDomainControllerDiscovery.ps1 Discovery script for the Active Directory topology used by Active Directory driver monitoring.

MicrosoftExchangeUnifiedMessagingComponentDiscovery.js Discovery script for Unified Messaging entities.

MicrosoftExchangeMonitoringRoleServiceBaseDiscovery.js Discovery script for the Monitoring role components, which include the Correlation Engine.

MicrosoftExchangeMonitoringCorrelationEngineDiscovery.js Discovery script for the Correlation Engine.

DiagnosticScriptCommonLibrary.ps1 Common library file for use by other Management Pack scripts.

ExecuteDiagnosticScript.ps1 Provides a generic wrapper to run other PowerShell scripts within the Management Pack (without requiring Operations Manager 2007 R2).

TestGenericRollupHealth.ps1 Manages the health state calculations for your environment.

Troubleshoot-CI.ps1 Detects and resolves issues related to content indexing on Exchange 2010 Mailbox servers.

Troubleshoot-DatabaseSpace.ps1 Provides a disk space monitor to accurately monitor Exchange 2010 Mailbox servers.

45 Appendix: Objects the Exchange 2010 Management Pack Discovers The Microsoft Exchange Server 2010 Management Pack discovers the object types described in the following table. By default, all discovery rules are enabled. In the following table, the prefix “Microsoft.Exchange.2010.” has been omitted to make the table easier to view.

Discovery Objects

ClientAccessRole.DiscoveryRule Server

ClientAccessRole.DiscoveryRule ClientAccessRole

ClientAccessRole.DiscoveryRule CommonRole

EdgeTransportRole.DiscoveryRule Server

EdgeTransportRole.DiscoveryRule EdgeTransportRole

EdgeTransportRole.DiscoveryRule CommonRole

HubTransportRole.DiscoveryRule Server

HubTransportRole.DiscoveryRule HubTransportRole

HubTransportRole.DiscoveryRule CommonRole

MailboxRole.DiscoveryRule Server

MailboxRole.DiscoveryRule MailboxRole

MailboxRole.DiscoveryRule CommonRole

UnifiedMessagingRole.DiscoveryRule Server

UnifiedMessagingRole.DiscoveryRule UnifiedMessagingRole

UnifiedMessagingRole.DiscoveryRule CommonRole

DomainControllerRole.DiscoveryRule DomainControllerRole

DomainControllerRole.DiscoveryRule DomainControllerFunctionalityServer

DomainControllerRole.DiscoveryRule DomainControllerFunctionalityService

Organization.DiscoveryRule Organization

Organization.DiscoveryRule ClientAccessActiveSyncService

Organization.DiscoveryRule ClientAccessOutlookWebAccessService

Organization.DiscoveryRule ClientAccessExchangeControlPanelService

Organization.DiscoveryRule ClientAccessWebServicesService

Organization.DiscoveryRule ClientAccessAvailabilityServicesService

Organization.DiscoveryRule ClientAccessOfflineAddressBookService

46 Organization.DiscoveryRule ClientAccessImap4Service

Organization.DiscoveryRule ClientAccessPop3Service

Organization.DiscoveryRule ClientAccessTestConfigService

Organization.DiscoveryRule EdgeTransportService

Organization.DiscoveryRule HubTransportService

Organization.DiscoveryRule MailboxMapiService

Organization.DiscoveryRule ClientAccessMailboxReplicationServicesService

Organization.DiscoveryRule UnifiedMessagingService

Organization.DiscoveryRule CommonRemotePowerShellService

Organization.DiscoveryRule ClientAccessAnonymousCalendarSharingService

ClientAccessComponent.DiscoveryRule ClientAccessActiveSync

ClientAccessComponent.DiscoveryRule ClientAccessAutoDiscovery

ClientAccessComponent.DiscoveryRule ClientAccessFileDistributionService

ClientAccessComponent.DiscoveryRule ClientAccessImap4

ClientAccessComponent.DiscoveryRule ClientAccessInformationWorker

ClientAccessComponent.DiscoveryRule ClientAccessOutlookWebAccess

ClientAccessComponent.DiscoveryRule ClientAccessExchangeControlPanel

ClientAccessComponent.DiscoveryRule ClientAccessPop3

ClientAccessComponent.DiscoveryRule ClientAccessServiceMonitoring

ClientAccessComponent.DiscoveryRule ClientAccessWebServices

ClientAccessComponent.DiscoveryRule ClientAccessAvailabilityService

ClientAccessComponent.DiscoveryRule ClientAccessOfflineAddressBook

ClientAccessComponent.DiscoveryRule ClientAccessUnifiedMessaging

ClientAccessComponent.DiscoveryRule ClientAccessTestConfig

ClientAccessComponent.DiscoveryRule ClientAccessMailboxReplicationService

ClientAccessComponent.DiscoveryRule ClientAccessAnonymousCalendarSharing

ClientAccessComponent.DiscoveryRule CommonAllServerRoles

ClientAccessComponent.DiscoveryRule CommonBestPracticeAnalyzer

ClientAccessComponent.DiscoveryRule CommonFileDistributionService

ClientAccessComponent.DiscoveryRule CommonProblemAnalysis

ClientAccessComponent.DiscoveryRule CommonServer

47 ClientAccessComponent.DiscoveryRule CommonServiceMonitoring

ClientAccessComponent.DiscoveryRule CommonMSExchangeRPCServiceMonitoring

ClientAccessComponent.DiscoveryRule CommonInternalRoleServices

ClientAccessComponent.DiscoveryRule CommonRemotePowerShell

ClientAccessComponent.DiscoveryRule CommonConfigurationAuthorization

ClientAccessComponent.DiscoveryRule CommonProvisioningBroker

ClientAccessComponent.DiscoveryRule ClientAccessOutlookService

ClientAccessComponent.DiscoveryRule ClientAccessOutlook

ClientAccessComponent.DiscoveryRule ClientAccessOutlookServerService

ClientAccessComponent.DiscoveryRule ClientAccessOutlookLocalServer

ClientAccessComponent.DiscoveryRule ClientAccessOutlookPerformanceService

ClientAccessComponent.DiscoveryRule ClientAccessOutlookInstancePerformance

ClientAccessComponent.DiscoveryRule ClientAccessOutlookDirectory

ClientAccessComponent.DiscoveryRule ClientAccessOutlookRpcProxy

ClientAccessComponent.DiscoveryRule CommonTransportThrottlingClient

EdgeTransportComponent.DiscoveryRule EdgeTransportAgentsAddressRewrite

EdgeTransportComponent.DiscoveryRule EdgeTransportAgentsAttachmentFilter

EdgeTransportComponent.DiscoveryRule EdgeTransportAgentsConnectionFilter

EdgeTransportComponent.DiscoveryRule EdgeTransportAgentsContentFilter

EdgeTransportComponent.DiscoveryRule EdgeTransportAgentsProtocolAnalysis

EdgeTransportComponent.DiscoveryRule EdgeTransportAgentsRecipientFilter

EdgeTransportComponent.DiscoveryRule EdgeTransportAgentsSenderFilter

EdgeTransportComponent.DiscoveryRule EdgeTransportAgentsSenderId

EdgeTransportComponent.DiscoveryRule EdgeTransportDsn

EdgeTransportComponent.DiscoveryRule EdgeTransportMessageSecurity

EdgeTransportComponent.DiscoveryRule EdgeTransportQueues

EdgeTransportComponent.DiscoveryRule EdgeTransportServiceMonitoring

EdgeTransportComponent.DiscoveryRule CommonAllServerRoles

EdgeTransportComponent.DiscoveryRule CommonBestPracticeAnalyzer

EdgeTransportComponent.DiscoveryRule CommonExtensibleStorageEngine

EdgeTransportComponent.DiscoveryRule CommonProblemAnalysis

48 EdgeTransportComponent.DiscoveryRule CommonTransport

EdgeTransportComponent.DiscoveryRule CommonTransportAgents

EdgeTransportComponent.DiscoveryRule CommonTransportLogSearch

EdgeTransportComponent.DiscoveryRule CommonServer

EdgeTransportComponent.DiscoveryRule CommonServiceMonitoring

CommonDomainController.DiscoveryRule CommonActiveDirectoryAccessService

CommonDomainController.DiscoveryRule CommonADAccessDomainControllerService

CommonDomainController.DiscoveryRule CommonActiveDirectoryAccess

CommonDomainController.DiscoveryRule CommonDomainController

HubTransportComponent.DiscoveryRule HubTransportAgentsConnectionFilter

HubTransportComponent.DiscoveryRule HubTransportAgentsContentFilter

HubTransportComponent.DiscoveryRule HubTransportAgentsMessagingPolicies

HubTransportComponent.DiscoveryRule HubTransportAgentsProtocolAnalysis

HubTransportComponent.DiscoveryRule HubTransportAgentsRecipientFilter

HubTransportComponent.DiscoveryRule HubTransportAgentsSenderFilter

HubTransportComponent.DiscoveryRule HubTransportAgentsSenderId

HubTransportComponent.DiscoveryRule HubTransportAgentsSMS

HubTransportComponent.DiscoveryRule HubTransportDsn

HubTransportComponent.DiscoveryRule HubTransportEdgeSync

HubTransportComponent.DiscoveryRule HubTransportQueues

HubTransportComponent.DiscoveryRule HubTransportServiceMonitoring

HubTransportComponent.DiscoveryRule HubTransportStoreDriver

HubTransportComponent.DiscoveryRule CommonInternalRoleServices

HubTransportComponent.DiscoveryRule CommonAllServerRoles

HubTransportComponent.DiscoveryRule CommonBestPracticeAnalyzer

HubTransportComponent.DiscoveryRule CommonExtensibleStorageEngine

HubTransportComponent.DiscoveryRule CommonProblemAnalysis

HubTransportComponent.DiscoveryRule CommonTransport

HubTransportComponent.DiscoveryRule CommonTransportAgents

HubTransportComponent.DiscoveryRule CommonTransportLogSearch

HubTransportComponent.DiscoveryRule CommonServer

49 HubTransportComponent.DiscoveryRule CommonServiceMonitoring

HubTransportComponent.DiscoveryRule CommonRemotePowerShell

HubTransportComponent.DiscoveryRule CommonConfigurationAuthorization

HubTransportComponent.DiscoveryRule CommonProvisioningBroker

HubTransportComponent.DiscoveryRule CommonTransportThrottlingClient

MailboxComponent.DiscoveryRule Mailbox.ServiceMonitoring

MailboxComponent.DiscoveryRule MailboxSystemAttendant

MailboxComponent.DiscoveryRule MailboxUnifiedMessaging

MailboxComponent.DiscoveryRule CommonAllServerRoles

MailboxComponent.DiscoveryRule CommonBestPracticeAnalyzer

MailboxComponent.DiscoveryRule CommonExtensibleStorageEngine

MailboxComponent.DiscoveryRule CommonProblemAnalysis

MailboxComponent.DiscoveryRule CommonServer

MailboxComponent.DiscoveryRule CommonServiceMonitoring

MailboxComponent.DiscoveryRule CommonInternalRoleServices

MailboxComponent.DiscoveryRule CommonMSExchangeRPCServiceMonitoring

MailboxComponent.DiscoveryRule CommonRemotePowerShell

MailboxComponent.DiscoveryRule CommonConfigurationAuthorization

MailboxComponent.DiscoveryRule CommonProvisioningBroker

MailboxComponent.DiscoveryRule MailboxTransportThrottlingServer

MailboxComponent.DiscoveryRule CommonTransportLogSearch

MailboxComponent.DiscoveryRule UnifiedMessaging.WithoutCorrelation

CrossPremisesMailflowMonitoring.Discovery Mailbox.CrossPremisesMailflowMonitoring Rule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseService eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopyMounted eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopy eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopyPerformance eryRule

50 Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopiesPerformance eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopyCorruption eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopiesCorruption eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopyIntegritySuppression eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopiesIntegritySuppression eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopySubmission eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopiesSubmission eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopyReplication eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopiesReplication eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopyReplay eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopiesReplay eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.ReplayService eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseRedundancy eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseSearchCopy eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.ContentIndexingService eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.ClusterService eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseAvailabilityGroup eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.MailSubmission eryRule

51 Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.InformationStore eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.InformationStorePerformance eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.Assistants eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.Network eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.AllDatabaseServices eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.ManyDatabaseServices eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.ClusterQuorumGroup eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.ClusterFsw eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.AllClusterQuorumGroups eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.AllClusterFsws eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.AcrossCluster eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.AllAcrossClusters eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.AllNetworks eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopiesFailed eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.MailboxMonitoring eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseSearchService eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopySearchable eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopyEdbLogicalDisk eryRule

52 Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopyLogLogicalDisk eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.PublicFolderDatabase eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.PublicFolderDatabasePerformance eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.PublicFolderDatabaseEdbLogicalDisk eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.PublicFolderDatabaseLogLogicalDisk eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopyLogLogicalDiskPerforman eryRule ce

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopyEdbLogicalDiskPerforman eryRule ce

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopyLogLogicalDiskSpace eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopyEdbLogicalDiskSpace eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.MailboxOnDbCopy eryRule

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.PublicFolderDatabaseEdbLogicalDiskSp eryRule ace

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.PublicFolderDatabaseLogLogicalDiskSpa eryRule ce

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.PublicFolderDatabaseEdbLogicalDiskPer eryRule formance

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.PublicFolderDatabaseLogLogicalDiskPerf eryRule ormance

Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.VirusScan eryRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseService overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopyMounted overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopy overyRule

53 Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopyPerformance overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopiesPerformance overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopyCorruption overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopiesCorruption overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopyIntegritySuppression overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopiesIntegritySuppression overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopySubmission overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopiesSubmission overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopyReplication overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopiesReplication overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopyReplay overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopiesReplay overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.ReplayService overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseRedundancy overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseSearchCopy overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.ContentIndexingService overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.ClusterService overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseAvailabilityGroup overyRule

54 Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.MailSubmission overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.InformationStore overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.InformationStorePerformance overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.Assistants overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.Network overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.AllDatabaseServices overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.ManyDatabaseServices overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.ClusterQuorumGroup overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.ClusterFsw overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.AllClusterQuorumGroups overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.AllClusterFsws overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.AcrossCluster overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.AllAcrossClusters overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.AllNetworks overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopiesFailed overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.MailboxMonitoring overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseSearchService overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopySearchable overyRule

55 Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopyEdbLogicalDisk overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopyLogLogicalDisk overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.PublicFolderDatabase overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.PublicFolderDatabasePerformance overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.PublicFolderDatabaseEdbLogicalDisk overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.PublicFolderDatabaseLogLogicalDisk overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopyLogLogicalDiskPerforman overyRule ce

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopyEdbLogicalDiskPerforman overyRule ce

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopyLogLogicalDiskSpace overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopyEdbLogicalDiskSpace overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.MailboxOnDbCopy overyRule

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.PublicFolderDatabaseEdbLogicalDiskSp overyRule ace

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.PublicFolderDatabaseLogLogicalDiskSpa overyRule ce

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.PublicFolderDatabaseEdbLogicalDiskPer overyRule formance

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.PublicFolderDatabaseLogLogicalDiskPerf overyRule ormance

Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.VirusScan overyRule

UnifiedMessagingComponent.DiscoveryRule UnifiedMessaging

UnifiedMessagingComponent.DiscoveryRule UnifiedMessagingPerformanceReporting

UnifiedMessagingComponent.DiscoveryRule UnifiedMessagingServiceMonitoring

UnifiedMessagingComponent.DiscoveryRule UnifiedMessaging.Availability.Service

56 UnifiedMessagingComponent.DiscoveryRule UnifiedMessaging.Availability.Gateway

UnifiedMessagingComponent.DiscoveryRule UnifiedMessaging.GeneralSensor.TransportFailur es

UnifiedMessagingComponent.DiscoveryRule UnifiedMessaging.SubComponent.PartnerTranscr iptionFailures

UnifiedMessagingComponent.DiscoveryRule UnifiedMessaging.GeneralSensor.MailboxFailures

UnifiedMessagingComponent.DiscoveryRule UnifiedMessaging.SubComponent.Pipeline

UnifiedMessagingComponent.DiscoveryRule UnifiedMessaging.SubComponent.ProtectedVoice Message

UnifiedMessagingComponent.DiscoveryRule UnifiedMessaging.WithoutCorrelation

UnifiedMessagingComponent.DiscoveryRule CommonAllServerRoles

UnifiedMessagingComponent.DiscoveryRule CommonBestPracticeAnalyzer

UnifiedMessagingComponent.DiscoveryRule CommonFileDistributionService

UnifiedMessagingComponent.DiscoveryRule CommonProblemAnalysis

UnifiedMessagingComponent.DiscoveryRule CommonServer

UnifiedMessagingComponent.DiscoveryRule CommonServiceMonitoring

UnifiedMessagingComponent.DiscoveryRule CommonInternalRoleServices

UnifiedMessagingComponent.DiscoveryRule CommonRemotePowerShell

UnifiedMessagingComponent.DiscoveryRule CommonConfigurationAuthorization

UnifiedMessagingComponent.DiscoveryRule CommonProvisioningBroker

UnifiedMessagingComponent.DiscoveryRule CommonTransportThrottlingClient

UnifiedMessagingComponent.DiscoveryRule UnifiedMessagingService

UnifiedMessagingComponent.DiscoveryRule CommonRemotePowerShellService

CorrelationEngineRole.DiscoveryRule CorrelationEngineRole

MonitoringCorrelationEngine.DiscoveryRule MonitoringCorrelationEngine

ClientAccessRole.DiscoveryRule Server

ClientAccessRole.DiscoveryRule ClientAccessRole

ClientAccessRole.DiscoveryRule CommonRole

EdgeTransportRole.DiscoveryRule Server

EdgeTransportRole.DiscoveryRule EdgeTransportRole

EdgeTransportRole.DiscoveryRule CommonRole

HubTransportRole.DiscoveryRule Server

57 HubTransportRole.DiscoveryRule HubTransportRole

HubTransportRole.DiscoveryRule CommonRole

MailboxRole.DiscoveryRule Server

MailboxRole.DiscoveryRule MailboxRole

MailboxRole.DiscoveryRule CommonRole

UnifiedMessagingRole.DiscoveryRule Server

UnifiedMessagingRole.DiscoveryRule UnifiedMessagingRole

UnifiedMessagingRole.DiscoveryRule CommonRole

DomainControllerRole.DiscoveryRule DomainControllerRole

DomainControllerRole.DiscoveryRule DomainControllerFunctionalityServer

DomainControllerRole.DiscoveryRule DomainControllerFunctionalityService

Organization.DiscoveryRule Organization

Organization.DiscoveryRulee ClientAccessActiveSyncService

Organization.DiscoveryRule ClientAccessOutlookWebAccessService

Organization.DiscoveryRule ClientAccessExchangeControlPanelService

Organization.DiscoveryRule ClientAccessWebServicesService

Organization.DiscoveryRule ClientAccessAvailabilityServicesService

Organization.DiscoveryRule ClientAccessOfflineAddressBookService

Organization.DiscoveryRule ClientAccessImap4Service

Organization.DiscoveryRule ClientAccessPop3Service

Organization.DiscoveryRule ClientAccessTestConfigService

Organization.DiscoveryRule EdgeTransportService

Organization.DiscoveryRule HubTransportService

Organization.DiscoveryRule MailboxMapiService

Organization.DiscoveryRule ClientAccessMailboxReplicationServicesService

Appendix: Class Hierarchy The Microsoft Exchange Server 2010 Management Pack uses an extensive class hierarchy. This extensive class hierarchy helps the Exchange Server 2010 Management Pack to effectively monitor the health of your Exchange environment.

58 Use the following diagrams to understand the class hierarchy for the Exchange Server 2010 Management Pack:  Client Access Class Hierarchy  Common Classes Class Hierarchy  Edge Transport Class Hierarchy  Groups Class Hierarchy  Hub Transport Class Hierarchy  Mailbox - High Availability and Mailbox Services Class Hierarchy  Mailbox Class Hierarchy  Roles Class Hierarchy  Unified Messaging Class Hierarchy

Client Access Class Hierarchy In this figure, the color red is used to show class hierarchy relationships that are new in this version of the Exchange 2010 Management Pack, released with Exchange 2010 Service Pack 1 (SP1). Shaded areas indicate class hierarchy relationships that existed in the RTM version of the Exchange 2010 Management Pack. Not every class relationship is used for alert correlation. For the specific relationships used by the Correlation Engine, see Appendix: Class Hierarchy.

59 60 Hub Transport Class Hierarchy

61 Edge Transport Class Hierarchy

Unified Messaging Class Hierarchy In this figure, the color red is used to show class hierarchy relationships that are new in this version of the Exchange 2010 Management Pack, released with Exchange 2010 Service Pack 1 (SP1). Shaded areas indicate class hierarchy relationships that existed in the RTM version of the Exchange 2010 Management Pack. Not every class relationship is used for alert correlation. For the specific relationships used by the Correlation Engine, see Appendix: Class Hierarchy.

62 Mailbox Class Hierarchy In this figure, the color red is used to show class hierarchy relationships that are new in this version of the Exchange 2010 Management Pack, released with Exchange 2010 Service Pack 1 (SP1). Shaded areas indicate class hierarchy relationships that existed in the RTM version of the Exchange 2010 Management Pack. Not every class relationship is used for alert correlation. For the specific relationships used by the Correlation Engine, see Appendix: Class Hierarchy.

63 Mailbox - High Availability and Mailbox Services Class Hierarchy In this figure, the color red is used to show class hierarchy relationships that are new in this version of the Exchange 2010 Management Pack, released with Exchange 2010 Service Pack 1 (SP1). Shaded areas indicate class hierarchy relationships that existed in the RTM version of the Exchange 2010 Management Pack. Not every class relationship is used for alert correlation. For the specific relationships used by the Correlation Engine, see Appendix: Class Hierarchy.

64 Common Classes Class Hierarchy In this figure, the color red is used to show class hierarchy relationships that are new in this version of the Exchange 2010 Management Pack, released with Exchange 2010 Service Pack 1 (SP1). Shaded areas indicate class hierarchy relationships that existed in the RTM version of the

65 Exchange 2010 Management Pack. Not every class relationship is used for alert correlation. For the specific relationships used by the Correlation Engine, see Appendix: Class Hierarchy.

66 Roles Class Hierarchy In this figure, the color red is used to show class hierarchy relationships that are new in this version of the Exchange 2010 Management Pack, released with Exchange 2010 Service Pack 1 (SP1). Shaded areas indicate class hierarchy relationships that existed in the RTM version of the Exchange 2010 Management Pack. Not every class relationship is used for alert correlation. For the specific relationships used by the Correlation Engine, see Appendix: Class Hierarchy.

67 Groups Class Hierarchy

68 Appendix: Alert Correlation Relationships The Microsoft Exchange Server 2010 Management Pack provides a correlation engine to significantly reduce the number of alerts that may not require an action by the administrator. This reduction in the number of alerts is made possible by the processing of alerts by the Correlation Engine service. For more information about alert correlation, see Understanding Alert Correlation earlier in this guide. Use the following diagrams to better understand alert correlation:  Client Access - On Server Alert Correlation Relationships  Client Access - Server to Site Alert Correlation Relationships  Edge Transport Alert Correlation Relationships  Hub Transport Alert Correlation Relationships  Mailbox - High Availability Alert Correlation Relationships  Mailbox - Information Store Alert Correlation Relationships  Performance, Disks, and Public Folders Alert Correlation Relationships  Unified Messaging Alert Correlation Relationships

Client Access - On Server Alert Correlation Relationships In this figure, the color red is used to show alert correlation relationships that are new in this version of the Exchange 2010 Management Pack, released with Exchange 2010 Service Pack 1 (SP1). Shaded areas indicate alert correlation relationships that existed in the RTM version of the Exchange 2010 Management Pack. For information about alert correlation, see Understanding Alert Correlation.

69 Client Access - Server to Site Alert Correlation Relationships In this figure, the color red is used to show alert correlation relationships that are new in this version of the Exchange 2010 Management Pack, released with Exchange 2010 Service Pack 1 (SP1). Shaded areas indicate alert correlation relationships that existed in the RTM version of the Exchange 2010 Management Pack. For information about alert correlation, see Understanding Alert Correlation.

70 71 Edge Transport Alert Correlation Relationships

72 Hub Transport Alert Correlation Relationships

Mailbox - High Availability Alert Correlation Relationships In this figure, the color red is used to show alert correlation relationships that are new in this version of the Exchange 2010 Management Pack, released with Exchange 2010 Service Pack 1 (SP1). Shaded areas indicate alert correlation relationships that existed in the RTM version of the Exchange 2010 Management Pack. For information about alert correlation, see Understanding Alert Correlation.

73 Mailbox - Information Store Alert Correlation Relationships In this figure, the color red is used to show alert correlation relationships that are new in this version of the Exchange 2010 Management Pack, released with Exchange 2010 Service Pack 1 (SP1). Shaded areas indicate alert correlation relationships that existed in the RTM version of the

74 Exchange 2010 Management Pack. For information about alert correlation, see Understanding Alert Correlation.

Performance, Disks, and Public Folders Alert Correlation Relationships In this figure, the color red is used to show alert correlation relationships that are new in this version of the Exchange 2010 Management Pack, released with Exchange 2010 Service Pack 1 (SP1). Shaded areas indicate alert correlation relationships that existed in the RTM version of the Exchange 2010 Management Pack. For information about alert correlation, see Understanding Alert Correlation.

75 Unified Messaging Alert Correlation Relationships In this figure, the color red is used to show alert correlation relationships that are new in this version of the Exchange 2010 Management Pack, released with Exchange 2010 Service Pack 1 (SP1). Shaded areas indicate alert correlation relationships that existed in the RTM version of the Exchange 2010 Management Pack. For information about alert correlation, see Understanding Alert Correlation.