In the monitoring of Exchange servers, what is the best way to monitor for resource pressure? I ask this because what we are seeing are Event ID 15004 like the one below:
Application log generated Warning Event 15004 on <cleared>
Log: ApplicationType: WarningEvent: 15004Agent Time: 2015-03-16 08:57:43ZEvent Time: 12:56:37 PM 16-Mar-2015 UTCSource: MSExchangeTransportCategory: ResourceManagerUsername: N/AComputer: <cleared>Description: The resource pressure increased from Normal to Medium.
The following resources are under pressure:Version buckets = 128 [Medium] [Normal=80 Medium=120 High=200]
The following components are disabled due to back pressure:Inbound mail submission from the InternetMail submission from Pickup directoryMail submission from Replay directoryMail delivery to remote domainsContent aggregationMail resubmission from the Message Resubmission component.Mail resubmission from the Shadow Redundancy Component
The following resources are in normal state:Queue database and disk space ("D:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\data\Queue\mail.que") = 71% [Normal] [Normal=95% Medium=97% High=99%]Queue database logging disk space ("D:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\data\Queue\") = 72% [Normal] [Normal=94% Medium=96% High=98%]Private bytes = 4% [Normal] [Normal=71% Medium=73% High=75%]Physical memory load = 67% [limit is 94% to start dehydrating messages.]Submission Queue = 0 [Normal] [Normal=2000 Medium=4000 High=10000]Temporary Storage disk space ("D:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\data\Temp") = 72% [Normal] [Normal=95% Medium=97% High=99%]
These generate Warning tickets but in man cases they are followed up by Event ID 15005 which is a decrease in the utilization. What I am looking for is the best way to monitor Exchange servers so if Exchange resources are in high use for x amount of time we get an alert.
Thank you for your assistance.
Exchange Back pressure can be measured with the following 3 states;
Most endusers won’t know when external mail stops working until they don’t receive an email that they were expecting so the Medium back pressure state would be able to proactively notify us that the Exchange server is having a back pressure issue.
Microsoft Exchange can already generate the following events for this;
I would group both the two Medium events and the two High events together and all need to decide on is what action you want to take when the Medium events are triggered and what action to take when the High events are triggered.
I attached the 2 eventlog monitor sets I made for this (see zip file) which will need to be applied against the Application Eventlog for Warning and Error type events.
Sources:http://www.msexchange.org/articles-tutorials/exchange-server-2010/management-administration/back-pressure-exchange-2010-part1.htmlhttp://www.msexchange.org/articles-tutorials/exchange-server-2010/management-administration/back-pressure-exchange-2010-part2.htmlhttp://technet.microsoft.com/en-us/library/bb201658.aspxhttp://exchangeserverpro.com/exchange-transport-server-back-pressure/
I posted a reply but the auto moderating monster ate my post, will have to wait until moderators release it.
Thank you for the information. I will see about going over this with my supervisor to see if this is what he would like to implement.
I can see how the logs are monitored, but is there a way this can be monitored via resource counters? My supervisor wants to see if we can be alerted with the high resource backpressure lasts for x amount of time, not that it occurred and then recovered.
@Salvatore DiPietro
This links will help you create the Performance counter;
technet.microsoft.com/.../bb217998%28v=exchg.80%29.aspx
technet.microsoft.com/.../ff360011%28v=exchg.140%29.aspx
thwack.solarwinds.com/.../DOC-171452 (look for the Database: Version buckets allocated part)