Kaseya Community

Monitoring Exchange Back Pressure

This question is not answered

In the monitoring of Exchange servers, what is the best way to monitor for resource pressure?  I ask this because what we are seeing are Event ID 15004 like the one below:

Application log generated Warning Event 15004 on <cleared>

Log: Application
Type: Warning
Event: 15004
Agent Time: 2015-03-16 08:57:43Z
Event Time: 12:56:37 PM 16-Mar-2015 UTC
Source: MSExchangeTransport
Category: ResourceManager
Username: N/A
Computer: <cleared>
Description: The resource pressure increased from Normal to Medium.

The following resources are under pressure:
Version buckets = 128 [Medium] [Normal=80 Medium=120 High=200]

The following components are disabled due to back pressure:
Inbound mail submission from the Internet
Mail submission from Pickup directory
Mail submission from Replay directory
Mail delivery to remote domains
Content aggregation
Mail resubmission from the Message Resubmission component.
Mail resubmission from the Shadow Redundancy Component

The following resources are in normal state:
Queue database and disk space ("D:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\data\Queue\mail.que") = 71% [Normal] [Normal=95% Medium=97% High=99%]
Queue database logging disk space ("D:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\data\Queue\") = 72% [Normal] [Normal=94% Medium=96% High=98%]
Private bytes = 4% [Normal] [Normal=71% Medium=73% High=75%]
Physical memory load = 67% [limit is 94% to start dehydrating messages.]
Submission Queue = 0 [Normal] [Normal=2000 Medium=4000 High=10000]
Temporary Storage disk space ("D:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\data\Temp") = 72% [Normal] [Normal=95% Medium=97% High=99%]

These generate Warning tickets but in man cases they are followed up by Event ID 15005  which is a decrease in the utilization.  What I am looking for is the best way to monitor Exchange servers so if Exchange resources are in high use for x amount of time we get an alert.

Thank you for your assistance.

All Replies
  • KEvents - Exchange Back Pressure.zip

    Exchange Back pressure can be measured with the following 3 states;

    • Normal – all is well and the server is performing its role as intended (assuming you haven’t modified the back pressure settings to mask a genuine problem)
    • Medium – a resource is moderately over-utilized and the server begins limiting some connection types. Typically internal email flow remains functional while email from external or non-Exchange sources will be rejected.
    • High – a resource is severely over-utilized. The server ceases to accept any new connections.


    Most endusers won’t know when external mail stops working until they don’t receive an email that they were expecting so the Medium back pressure state would be able to proactively notify us that the Exchange server is having a back pressure issue.


    Microsoft Exchange can already generate the following events for this;

    • Event ID 15004: Increase in the utilization level for any resource (eg from Normal to Medium)
    • Event ID 15005: Decrease in the utilization level for any resource (eg from High to Medium)
    • Event ID 15006: High utilization for disk space (ie critically low free disk space)
    • Event ID 15007: High utilization for memory (ie critically low available memory)


    I would group both the two Medium events and the two High events together and all  need to decide on is what action you want to take when the Medium events are triggered and what action to take when the High events are triggered.

    I attached the 2 eventlog monitor sets I made for this (see zip file) which will need to be applied against the Application Eventlog for Warning and Error type events.


    [edited by: HardKnoX at 3:01 PM (GMT -7) on May 7, 2015]
  • I posted a reply but the auto moderating monster ate my post, will have to wait until moderators release it.

    [edited by: HardKnoX at 1:59 PM (GMT -7) on May 7, 2015]
  • Thank you for the information.  I will see about going over this with my supervisor to see if this is what he would like to implement.

  • I can see how the logs are monitored, but is there a way this can be monitored via resource counters?  My supervisor wants to see if we can be alerted with the high resource backpressure lasts for x amount of time, not that it occurred and then recovered.

  • @Salvatore DiPietro

    This links will help you create the Performance counter;



    thwack.solarwinds.com/.../DOC-171452  (look for the Database: Version buckets allocated part)