Documenti di Didattica
Documenti di Professioni
Documenti di Cultura
Abstract
The Microsoft Exchange Server 2010 Management Pack includes a complete health model,
extensive protocol synthetic transaction coverage, and a full complement of diagnostics-based
alerts and service-oriented reporting, including mail flow statistics.
Alerts are classified by impact and recovery action, and are now processed by a new component
called the Correlation Engine. The Correlation Engine suppresses duplicate alerts whenever
possible to help front-line monitoring technicians monitor Exchange more efficiently.
Most of the diagnostic information used in the Exchange 2010 Management Pack, including
events and performance counters, is specifically engineered for monitoring. Very little tuning is
required to monitor your Exchange organization. The Exchange 2010 Management Pack will
scale with your environment.
The Exchange 2010 Management Pack is engineered for organizations that include servers
running Exchange 2010. It is not based on the Exchange 2007 Management Pack. Therefore,
you will notice some differences in the way you deploy and configure the Exchange 2010
Management Pack if you have previously used the Exchange 2007 Management Pack.
This guide was written based on version 14.02.0247.005 of the Exchange Server 2010
Management Pack.
Legal Notice
This document is provided as-is. Information and views expressed in this document, including
URL and other Internet Web site references, may change without notice. You bear the risk of
using it.
Some examples depicted herein are provided for illustration only and are fictitious. No real
association or connection is intended or should be inferred.
This document does not provide you with any legal rights to any intellectual property in any
Microsoft product. You may copy and use this document for your internal, reference purposes.
2010 Microsoft Corporation. All rights reserved.
Microsoft, and MS-DOS, Windows, Windows Server, and Active Directory are trademarks of the
Microsoft group of companies.
All other trademarks are property of their respective owners.
Contents
Exchange 2010 Management Pack Guide......................................................................................5
Introduction to the Exchange 2010 Management Pack...............................................................7
Getting Started with the Exchange 2010 Management Pack....................................................10
Before You Import the Exchange 2010 Management Pack....................................................11
How to Import the Exchange 2010 Management Pack..........................................................13
Creating a New Management Pack for Customizations.........................................................14
Optional Configurations............................................................................................................. 14
Security Considerations............................................................................................................. 19
Understanding Management Pack Operations..........................................................................19
Understanding Classes.......................................................................................................... 19
Understanding Alert Correlation............................................................................................. 20
Understanding the Exchange Management Pack Health State Model...................................25
Troubleshooting the Exchange 2010 Management Pack..........................................................41
Appendix: Reports..................................................................................................................... 42
Appendix: Synthetic Transactions..............................................................................................44
Appendix: Scripts....................................................................................................................... 46
Appendix: Objects the Exchange 2010 Management Pack Discovers......................................48
Appendix: Class Hierarchy........................................................................................................ 61
Client Access Class Hierarchy...............................................................................................62
Hub Transport Class Hierarchy.............................................................................................. 64
Edge Transport Class Hierarchy............................................................................................ 65
Unified Messaging Class Hierarchy.......................................................................................65
Mailbox Class Hierarchy........................................................................................................ 66
Mailbox - High Availability and Mailbox Services Class Hierarchy.........................................67
Common Classes Class Hierarchy......................................................................................... 68
Roles Class Hierarchy............................................................................................................ 70
Groups Class Hierarchy......................................................................................................... 71
Appendix: Alert Correlation Relationships.................................................................................72
Client Access - On Server Alert Correlation Relationships.....................................................72
Client Access - Server to Site Alert Correlation Relationships................................................73
Edge Transport Alert Correlation Relationships......................................................................75
Hub Transport Alert Correlation Relationships.......................................................................76
Mailbox - High Availability Alert Correlation Relationships......................................................76
Mailbox - Information Store Alert Correlation Relationships...................................................77
Performance, Disks, and Public Folders Alert Correlation Relationships...............................78
Unified Messaging Alert Correlation Relationships.................................................................79
Exchange 2010 Management Pack Guide
The Microsoft Exchange Server 2010 Management Pack includes a complete health model,
extensive protocol synthetic transaction coverage, and a full complement of diagnostics-based
alerts and service-oriented reporting, including mail flow statistics.
Alerts are classified by impact and recovery action, and are now processed by a new component
called the Correlation Engine. The Correlation Engine suppresses duplicate alerts whenever
possible to help front-line monitoring technicians monitor Exchange more efficiently.
Most diagnostic information used in the Exchange 2010 Management Pack, including events and
performance counters, is specifically engineered for monitoring. Very little tuning is required to
monitor your Exchange organization. The Exchange 2010 Management Pack will scale with your
environment.
The Exchange 2010 Management Pack is engineered for organizations that include servers
running Exchange 2010. It isn't based on the Exchange 2007 Management Pack. Therefore,
you'll notice some differences in the way you deploy and configure the Exchange 2010
Management Pack if you used the Exchange 2007 Management Pack in the past.
Important:
Running the Exchange 2010 Management Pack installation program installs a new
Windows service component named the Correlation Engine service. For more
information, see Before You Import the Exchange 2010 Management Pack.
Document Version
This guide was written based on version 14.3.210.2/ 14.03.0038.004 of the
Exchange 2010 Management Pack.
Revision History
6
Release date Changes
7
The new MSI (Exchange2010PowershellFix.MSI) that has been included in this release enables
Exchange 2010 MP to work on servers that have Powershell 2.0 installed side by side with
Powershell 3.0+. This new MSI should be used only if your existing Exchange 2010 MP isnt able
to monitor your Exchange 2010 server that has Powershell 2.0 and Powershell 3.0+ installed side
by side. This will NOT work if the server has only Powershell 3.0 or higher installed.
8
Changes included in the Service Pack 1 Update
The Exchange 2010 SP1 version of the Exchange 2010 Management Pack includes significant
improvements beyond those included in the RTM version of the Exchange 2010 Management
Pack. The following list includes some of the new features and updates:
Capacity planning and performance reports New reports dig deep into the performance
of individual servers and provide detailed information about how much capacity is used in
each site.
SMTP and remote PowerShell availability report The management pack now includes
two new availability reports for SMTP client connections and management end points.
New Test-SMTPConnectivity synthetic transaction In addition to the inbound mail
connectivity tasks for protocols such as Outlook Web App, Outlook, IMAP, POP,
and Exchange ActiveSync, the Management Pack now includes SMTP-connectivity
monitoring for outbound mail from IMAP and POP clients. For information about how to
enable this feature, see Optional Configurations.
New Test-ECPConnectivity view Views for the Exchange Control Panel test task are now
included in the monitoring tree.
Cross-premises mail flow monitoring and reporting The Management Pack includes
new mail flow monitoring and reporting capabilities for customers who use our hosted service.
Improved Content Indexing and Mailbox Disk Space monitoring New scripts have been
created to better monitor context indexing and mailbox disk space. These new scripts enable
automatic repair of indexes and more accurately report of disk space issues.
The ability to disable Automatic Alert Resolution in environments that include OpsMgr
connectors When you disable Automatic Alert Resolution, the Correlation Engine won't
automatically resolve alerts. This lets you use your support ticketing system to manage your
environment. For information about how to disable this feature, see Optional Configurations.
Several other updates and improvements were also added to this version of the Management
Pack, including the following.
Suppression of alerts when the alerts only occur occasionally was added to many monitors.
Most of the event monitors in the Exchange 2010 Management Pack are automatically reset
by the Correlation Engine. Automatic reset was added to those event monitors so that issues
aren't missed the next time they occur. For a list of the event monitors that are not reset
automatically, see Understanding Alert Correlation.
Monitoring was added for processes that crash repeatedly.
Additional performance monitoring was added for Outlook Web App.
Monitoring of Active Directory access was improved.
Monitoring of anonymous calendar sharing was added.
Reliability of database offline alerts was improved.
Monitoring for the database engine (ESE) was added.
Supported Configurations
9
The following table shows the supported configurations for the Exchange 2010 Management
Pack and the Correlation Engine component.
Configuration Support
10
Consider the supported configurations for the Exchange 2010 Management Pack. For more
information about the supported configurations, see Introduction to the Exchange 2010
Management Pack.
Ensure that all Exchange 2010 computers that are managed by the Operations Manager
use LocalSystem as the Agent Action Account.
If you are monitoring Exchange 2010 database availability groups (DAGs), ensure that all
DAG members are monitored by Operations Manager 2007.
Ensure that all agents on Exchange 2010 computers have Agent Proxy enabled.
Install the update specified in Microsoft Knowledge Base article 971541, Description of
System Center Operations Manager 2007 Service Pack 1 Update
(http://go.microsoft.com/fwlink/?linkid=3052&kbid=971541) if you're running Operations
Manager 2007 SP1. Install the update specified in Microsoft Knowledge Base article 974144,
System Center Operations Manager 2007 R2 Cumulative Update 1 Release Notes
(http://go.microsoft.com/fwlink/?linkid=3052&kbid=974144) if you're running Operations
Manager 2007 R2. These updates resolve several critical issues that are more likely to occur
when you're running the Exchange 2010 Management Pack.
Important:
For the Exchange 2010 Management Pack to function correctly, you must install the
referenced Operations Manager updates. These updates enable the monitors that
the Exchange 2010 Management Pack uses to correctly set the health state and
generate alerts. These updates also allow the Exchange 2010 Management Pack to
accurately monitor whether the Exchange databases are mounted. Also, if you don't
install the updates on your root management server and all agent
computers, availability reporting will be inaccurate.
The Exchange 2010 Management Pack includes a Windows service called the Correlation
Engine. The Correlation Engine is installed when you install the Exchange 2010 Management
Pack. It determines the best alert to raise by examining the Exchange 2010 health model
using the Operations Manager Software Development Kit (SDK) service.
To correctly install the Correlation Engine, consider the following when you install the
Exchange 2010 Management Pack:
Determine which server will host the Correlation Engine. While not strictly required, it's
strongly recommended that the Correlation Engine be installed on the root management
server.
Make sure that you download and install the Exchange 2010 Management Pack that
matches the operating system for the selected server. You can install the 32-bit or 64-bit
version.
Make sure that you run the Microsoft Installer (.msi) package on the server where you
want the Exchange 2010 Management Pack and the Correlation Engine to be installed
and complete the installation.
After the installation is complete, the Correlation Engine service will have been installed
on the server, and the Management Pack files will have been copied to the System
11
Center Management Packs folder. By default, the installation directory is C:\Program
Files\System Center Management Pack.
For more information about the Correlation Engine, see Understanding Alert Correlation.
Files to Download
The Exchange 2010 Management Pack installation package includes the following files:
Microsoft.Exchange.2010.mp
Microsoft.Exchange.2010.Reports.mp
The installation package also includes the files required by the Correlation Engine in addition to
the Exchange 2010 Management Pack license agreement.
Other Requirements
The Correlation Engine requires the following:
It must be installed on a computer running Windows Server 2003, or either the 32-bit or 64-bit
version of Windows Server 2008 or Windows Server 2008 R2.
The computer running the Correlation Engine must have network connectivity to the root
management server.
The System Center Operations Manager 2007 console must be installed on the computer
that's running the Correlation Engine.
Administrators should not disable discovery as this will cause critical pieces of the
Management Pack to not function correctly.
As mentioned previously, the discovery interval has been increased to 24 hours to decrease
the impact on a Management Group. Administrators should exercise caution should they
decide to decrease this value.
12
Note:
When you run the Operations console on a computer that is not a management
server, the Connect to Server dialog box displays. In the Server name text box,
type the name of the management server to which you want to connect.
3. Right-click the Management Packs node, and then click Import Management Packs.
4. The Import Management Packs wizard opens. Click Add, and then click Add from disk.
5. If prompted to connect to the online catalog, click No.
6. The Select Management Packs to import dialog box appears. Go to the directory where
your management pack file is located. By default, the location is C:\Program Files\System
Center Management Packs.
7. Select both management pack files to import from that directory, and then click Open.
8. On the Select Management Packs page, the management packs that you selected for
import are listed. An icon next to each management pack in the list indicates the status of the
selection, as follows:
a. A green check mark indicates that the management pack can be imported. A blue
exclamation point indicates that an older version of the management pack is installed.
When all of the management packs in the list display one of these icons, click Import.
b. A red error icon indicates that the management pack is dependent on one or more
management packs that are not in the Import list and are not available in the catalog. To
view the missing management packs, click Error in the Status column. To remove the
management pack with the error from the Import list, right-click the management pack,
and then click Remove.
Note:
When you click Import, any management packs in the Import list that display the
Error icon are not imported.
9. You will receive a prompt indicating that the management pack presents a security risk. This
is due to the management pack's use of agent proxying. Click Yes to allow the import.
10. The Import Management Packs page appears and shows the progress for each
management pack. Each management pack is downloaded to a temporary directory,
imported to Operations Manager, and then deleted from the temporary directory. If there is a
problem at any stage of the import process, select the management pack in the list to view
the status details. Click Close.
Discovery
Each discovery in the management pack is discovered by default. No additional configuration
should be necessary in most customer environments. See Appendix: Objects the Exchange 2010
Management Pack Discovers later in this guide for a table of discoveries and the classes that
they discover.
13
Creating a New Management Pack for Customizations
Most vendor management packs are sealed so that you cannot change any of the original
settings in the management pack file. However, you can create customizations, such as overrides
or new monitoring objects, and save them to a different management pack. By default, System
Center Operations Manager 2007 saves all customizations to the Default Management Pack. As
a best practice, you should instead create a new management pack for each sealed management
pack you want to customize.
Creating a new management pack for storing overrides has the following advantages:
It simplifies the process of exporting customizations that were created in your test and pre-
production environments to your production environment. For example, instead of exporting
the Default Management Pack that contains customizations from multiple management
packs, you can export just the management pack that contains customizations of a single
management pack.
You can delete the original management pack without first needing to delete the Default
Management Pack. A management pack that contains customizations is dependent on the
original management pack. This dependency requires you to delete the management pack
with customizations before you can delete the original management pack. If all of your
customizations are saved to the Default Management Pack, you must delete the Default
Management Pack before you can delete an original management pack.
It is easier to track and update customizations to individual management packs.
For more information about sealed and unsealed management packs, see Management Pack
Formats (http://go.microsoft.com/fwlink/?LinkId=108355). For more information about
management pack customizations and the Default Management Pack, see About Management
Packs in Operations Manager 2007 (http://go.microsoft.com/fwlink/?LinkId=108356).
Optional Configurations
The Microsoft Exchange Server 2010 Management Pack has been deployed at Microsoft for
more than two years in a wide range of environments. These deployments have helped us to
make significant improvements to the Management Pack. They've also helped us improve the
overall monitoring capability of Exchange Server 2010.
The Management Pack works effectively in most Exchange configurations using the default
configuration. Although some fine-tuning may be required for certain environments, the
Exchange 2010 Management Pack discovery process generally loads the correct monitors on the
various servers in an Exchange organization. For example, performance threshold rules are
based on scalable calculations and not fixed-digit thresholds.
In the Exchange 2010 Management Pack, youll find a number of rate and percentile counters
that are designed to allow the Management Pack to scale from small deployments to large
datacenter environments.
14
Create Test Mailboxes for Synthetic Transaction Tests
The Exchange 2010 Management Pack can run synthetic transactions to help you measure the
performance of monitored objects in your Exchange organization. The Exchange 2010
Management Pack uses the Test-OwaConnectivity, Test-ActiveSyncConnectivity, and Test-
WebServicesConnectivity cmdlets to test Microsoft Office Outlook Web App,
Exchange ActiveSync, and Exchange Web Services connectivity from Client Access servers to
Mailbox servers. These cmdlets require that a test mailbox be created in each Active Directory
site that you want to test. For more information about synthetic transactions, see Monitoring by
Using Synthetic Transactions in the System Center Operations Manager 2007 R2 documentation.
Caution:
If you don't create a test mailbox on one or more Mailbox servers, the Management Pack
will return the following warning: The test mailbox was not initialized. Run new-
TestCasConnectivityUser.ps1 to ensure that the test mailbox is created.
Perform the following steps to create a test mailbox for Outlook Web App, Exchange ActiveSync,
and Exchange Web Services connectivity monitoring.
In this procedure you create test mailboxes for Outlook Web App, Exchange ActiveSync, and
Exchange Web Services to monitor connectivity by using PowerShell to run the New-
TestCasConnectivityUser.ps1 script.
1. Open the Exchange Management Shell.
2. In the Shell, change directory to the C:\ Program Files\Microsoft\Exchange
Server\V14\Scripts folder by running the following command:
Set-Location C:\Program Files\Microsoft\Exchange Server\V14\Scripts
3. Run the test-user script using the following command:
New-TestCasConnectivityUser.ps1
4. Follow the on-screen installation instructions in the Shell to create the test mailbox. You'll be
prompted to enter a temporary secure password for creating test users. You'll also be
prompted to specify the Mailbox server where you want the test user created.
5. Repeat this process on an Exchange 2010 Mailbox server in each Active Directory site that
you want to test.
15
If you're using a connector with Operations Manager 2007. A connector is a custom service or
program that allows Operations Manager to communicate with external systems. For
example, you may want to disable this feature if you're using a connector that allows an
external application to track Exchange 2010 Management Pack alerts.
To disable Automatic Alert Resolution, perform the following steps:
1. Log on to the server that's hosting the Microsoft Exchange Monitoring Correlation Engine
service.
2. Locate the Correlation Engine configuration file named
Microsoft.Exchange.Monitoring.CorrelationEngine.exe.config. By default, the file is located in
C:\Program Files\Microsoft\Exchange Server\V14\Bin\, where C:\ is the Exchange installation
directory.
3. Open Microsoft.Exchange.Monitoring.CorrelationEngine.exe.config in a text editor such as
Notepad.
4. Locate the following line in the configuration file:
<add key="AutoResolveAlerts" value="true" />
5. Change <add key="AutoResolveAlerts" value="true" /> to <add
key="AutoResolveAlerts" value="false" />
6. Restart the Microsoft Exchange Monitoring Correlation Engine service.
Caution:
When you enable these collection rules, make sure you have sufficient disk space to
accommodate the additional data. Each task creates from 4 to 12 event messages every
time it runs. By default, each test runs every five minutes.
To enable the event collection rules for synthetic transaction output:
1. In System Center Operations Manager 2007, click Authoring.
2. In the Authoring pane, expand Management Pack Objects, and then click Rules.
3. In the Rules pane, click Change Scope.
4. In the Scope Management Pack Target(s) by object dialog box, in the Look for box, type
"Exchange Server 2010."
5. Click View all targets.
16
6. Click Select All if its not disabled (it is only disabled when all rows are already selected).
7. Click OK to close the dialog box.
8. After the rules have loaded, type "Script event collection" in the Look for box near the top of
the console.
9. For each test task that you would like to enable, perform the following steps:
a. Right-click the rule and select Overrides > Override the Rule > For all objects of
class:<class name>.
b. Select the Override check box.
c. Set the override value to True.
d. Click OK.
It will take some time for the overrides to be picked up by the agents and for events to appear
in the built-in views.
17
task need to be updated. This monitor must be enabled for the specific Client Access server
computer that's running the scheduled task.
To enable this monitor, use the following steps:
1. In System Center Operations Manager 2007, click Authoring.
2. In the Authoring pane, expand Management Pack Objects, and then click Monitors.
3. On the toolbar, click Scope.
4. In the Scope Management Pack Target(s) by object dialog box, in the Look for box, type
"Outlook Service Availability."
5. Click View all targets.
6. Click Select All if its not disabled (it's only disabled when all rows are already selected).
7. Click OK to close the dialog box.
8. After the rules have loaded, click Outlook Service Availability > Entity Health >
Availability.
9. Under Availability, right-click the rule Kerberos Authentication for CAS array - shared
alternate service account credential password for Kerberos authentication has not
been updated in 28 days and may be stale, and then click Overrides > Override the
Monitor > For a specific objects of type: Outlook Service Availability.
10. In the Select Object dialog box, select the instance of the rule that includes the server on
which you're running the RollAlternateServiceAccountPassword.ps1 script, and then click
OK.
11. In the Override Properties dialog box, select the Override check box.
12. Set the override value to True.
13. Click OK.
It will take some time for the overrides to be picked up by the agents and for events to appear in
the built-in views.
Security Considerations
Due to the security model under which Microsoft Exchange Server 2010 has been tested, running
the agent as anything other than LocalSystem has not been tested.
Caution:
If you run the agent as anything other than LocalSystem, then the synthetic transactions
fail to run. You may also experience other issues.
18
Understanding Alert Correlation
Understanding the Exchange Management Pack Health State Model
Understanding Classes
The Microsoft Exchange Server 2010 includes an extensive class model. Diagrams showing the
class model are provided in the Appendix: Class Hierarchy later in this guide. Consider the
following information about Client Access server classes and site-wide aggregated classes.
Client Access Protocol and Client Access Service Classes
The Client Access server role is strongly associated with Active Directory site boundaries. The
class model for client access reflects this association. For most protocol classes hosted on the
Exchange/agent computer, there is a class hosted on the Root Management Server (RMS) that
represents the health of that protocol for the site. State rolls up from that protocol on each server
to the site-wide instance.
Site-Wide Aggregated Classes
The site-wide aggregated classes use an aggregation on their dependency monitors so that the
state changes only when all of the Client Access servers detect a protocol failure for a given
protocol. This is intended to model the corrective actions taken by load balancing technologies to
divert the load to functional servers as protocols/servers fail. In the Appendix: Class Hierarchy in
this guide, these classes have the suffix "Service." These classes are represented in the "Service
State" view.
For more details about how these site-wide aggregated classes impact availability reporting, see
"Appendix: Reports" later in this guide.
Architecture
The Correlation Engine is a stand-alone Windows service that uses the Operations Manager SDK
interface to first retrieve the health model (or instance space) and then process state change
events. By maintaining the health model in memory, and processing state change events, the
Correlation Engine is able to determine when to raise an alert based on the state of the system.
19
In the diagram above, you can see that, in response to a problem, several monitors change state,
and the corresponding state change events are forwarded by the agent to the Root Management
Server (RMS). Once received by the RMS, they are processed by the Correlation Engine, which
may raise an alert via the RMSs Software Development Kit (SDK) interface. This alert is then
visible on the Operations Manager Console.
Alert Classification
Exchange Server 2010 Management Pack alerts are classified into one of three categories. Use
the following guidelines to understand these alert classifications.
Key Health Indicator (KHI) KHIs are issues that affect the health of the service. Most alerts
fall into this category (for example, "A mailbox database is dismounted.")
Non-Service Impacting (NSI) NSI monitors detect problems that may affect some users,
but not every user of the system. A good example of an NSI situation is two users with the
same proxy address mail to this address will be returned as non-deliverable, but the overall
transport system is not otherwise impaired.
Forensic Forensic monitors are used to record information that may be relevant while
troubleshooting an issue, but isnt necessarily indicative of an eminent or existing system
failure. "CPU activity >90% for 5 minutes" is an example of a forensic issue there may be a
process inappropriately consuming CPU cycles, or the server may have been rebooted and is
catching up on normal system activity. These monitors are visible in the Alert Context field of
the alert properties and in Health Explorer. Alerts are not raised for Forensic monitors.
Note:
State is not updated when a single forensic monitor alert is raised. However, state may
be updated based on the aggregation of current forensic monitor alerts for each
component.
Alert Severity
Exchange Server 2010 Management Pack alerts are also classified by the severity of the
alerts. Use the following guidelines to understand alert severity.
Error alerts Error alerts are alerts that require human intervention to restore the service to
proper operation.
20
Warning alerts Warning alerts provide an early warning that the system may fail (which
would then raise an Error, if appropriate).
Informational alerts Informational alerts are not raised by the Exchange 2010 Management
Pack.
Correlation Factors
The actions taken by the Correlation Engine is determined based on the several factors.
Monitor state change events Monitors, which watch for the specific diagnostics from
Exchange such as event log messages, performance counter thresholds, and PowerShell task
output events, register state change events when they detect that a problem has occurred or
cleared (red to green or green to red), or as agents become unavailable or are placed in
maintenance mode (and subsequently made available, and/or removed from maintenance mode).
Typically, alert rules are configured to fire when green to red state changes occur. In the
Exchange Server 2010 Management Pack, youll find that this is not the case. Specifically, alerts
are not automatically raised by monitor state changes. The Correlation Engine may determine the
best alert to raise.
Health Model The class hierarchy imported into Operations Manager by the
Exchange Server 2010 Management Pack is extensive. The class hierarchy includes class
relationships that define component dependencies throughout the system. By defining these
component dependencies in the object representation of the product, the Exchange Server 2010
Management Pack is able to better understand the health of the Exchange organization. For
example, if the Exchange Server 2010 Management Pack identifies Active Directory as offline, it
will also report that Exchange messaging is not fully functional.
Timing The Correlation Engine works in 90-second intervals. When state change events for
multiple monitors come in at the same time, it waits to see whether anything else potentially
related to the failure is detected so that it can make the most effective determination of the root
cause.
Correlation Algorithm
Overview of the Correlation Engine process
1. First, it connects to the Operations Manager SDK service to download the Health Model
hierarchy and instance state (on service startup only, or as needed if errors require it).
2. Next, it queries Operations Manager for the latest state change events related to entities in
the Exchange Management Pack.
3. If new NSI state changes are detected, then it raises alerts for them.
4. KHI monitors are then evaluated, and "chains" of red KHI monitors are isolated. These
"chains" indicate issues where a dependency has failed and is impacting dependent
processes. Recognizing these relationships is the key step.
5. Alerts are raised for the root cause monitor in the KHI chain.
6. It then waits 90 seconds, and then starts over at step 2 above.
Additional points of interest regarding the correlation engine process
21
If the "chain" of KHIs includes both error and warning monitors, then the alert is raised as an
error, regardless of the class of the root cause monitor. For example, if a top-level process
defines an error monitor to catch failure cases, and if it is correlated to a warning monitor in a
dependency, then the alert will be raised against the dependency, but it will be marked as an
error instead of a warning.
Not every class relationship is used for alert correlation. See the Appendix: Class Hierarchy
later in this guide for the specific relationships used by the Correlation Engine.
The KHI chain, including any forensic monitors, is included in the Alert Context field
available in the properties of the final alert. This allows inspection of the monitors correlated
to the given alert and, in the case of alerts firing from dependency monitors, is required to
determine the specific failure referenced by the alert.
Monitors in maintenance mode are simply skipped when evaluating the health model.
What is and is not Affected by Alert Correlation
A key point to understand about the Exchange Server 2010 Management Pack, and the
Correlation Engine in particular, is what the Correlation Engine affects, and what it doesnt affect.
The following items are different due to the Correlation Engine:
Monitors are configured not to alert automatically on state change events. This allows the
Correlation Engine to determine the best alert to raise (as described above).
The Exchange Server 2010 Management Pack doesn't raise Exchange alerts that correspond
to the health of your environment when the Correlation Engine is stopped. If the Correlation
Engine is stopped, a general alert is raised to notify you that the Correlation Engine is not
running.
The following items are not different due to the presence of the Correlation Engine:
Overrides still work as expected; you can change certain values or disable monitors just as
you do today.
Monitors/objects in maintenance mode are skipped by the Correlation Engine. No special
consideration is required since the monitors dont raise state change events for consumption
by the Correlation Engine.
Per-monitor alert rules were added to the Exchange Server 2010 Management Pack. Per-
monitor alert rules allow monitoring personnel to enter company-specific notes for a given
alert into the Company Knowledge field, even when the alert rules arent used to raise alerts
for their corresponding monitors.
Other management packs are not affected by the presence of the Correlation Engine.
In summary, keep in mind that its just the "monitor state change to alert" step that is enhanced by
correlation.
Operational Notes
Since the Correlation Engine needs to maintain the instance space of the management group in
memory to determine related monitors/alerts, its memory footprint is relative to the number of
instances in the management group. In plain terms, the more Exchange servers and databases
you have, the more memory it will require.
22
In observing environments at Microsoft, the Correlation Engine scales roughly at about 5
megabytes per monitored Exchange server. There are factors that can drive this number up or
down, but its a good starting point toward understanding the resource impact on the server
hosting the service.
As stated above, the preferred location for the service is on the RMS role given the close SDK
interaction and core functionality of raising alerts.
Monitor Name
ExBPA Warning.
ExBPA Error.
23
Monitor Name
24
Monitor Name
25
Availability - MAPI Service SiteA
Availability - OWA Service SiteA
Availability - IMAP4 Service SiteB
Availability - POP3 Service SiteB
Availability - MAPI Service SiteB
Availability - OWA Service SiteB
OWA Service Site B
Availability OWA Server
[OWA Monitors]
Containment Relationships
The following table lists the containment relationships that the Exchange 2010 Management Pack
uses to calculate health. Consider the following as you review the table:
The class Root contains Organization, the class Organization contains Service, and so on.
All the classes whose names end with Service are site-level entities. Their health is rolled
up to the servers in the same site.
For clarity, the prefix Microsoft.Exchange.2010. for class names has been omitted from the
classes listed in the following table. For example, the classes Microsoft.Exchange.2010.Root,
26
Microsoft.Exchange.2010.Organization, and Microsoft.Exchange.2010.Server are identified
as Root, Organization, and Server in the table.
Root Organization
Organization Service
Server ServerRole
ClientAccessActiveSyncService ClientAccessActiveSync
ClientAccessOutlookWebAccessService ClientAccessOutlookWebAccess
ClientAccessExchangeControlPanelServic ClientAccessExchangeControlPanel
e
ClientAccessWebServicesService ClientAccessWebServices
ClientAccessAvailabilityServicesService ClientAccessAvailabilityService
ClientAccessAnonymousCalendarSharingS ClientAccessAnonymousCalendarSharing
ervice
ClientAccessOfflineAddressBookService ClientAccessOfflineAddressBook
ClientAccessImap4Service ClientAccessImap4
ClientAccessPop3Service ClientAccessPop3
EdgeTransportService EdgeTransportComponent
HubTransportService HubTransportComponent
MailboxMapiService Mailbox.MailboxMonitoring
UnifiedMessagingService ClientAccessUnifiedMessaging
CommonRemotePowerShellService CommonRemotePowerShell
ClientAccessOutlookService ClientAccessOutlook
ClientAccessOutlookServerService ClientAccessOutlookLocalServer
ClientAccessOutlookPerformanceService ClientAccessOutlookDirectory
ClientAccessOutlookPerformanceService ClientAccessOutlookRpcProxy
ClientAccessMailboxReplicationServicesSe ClientAccessMailboxReplicationService
rvice
DomainControllerFunctionalityService DomainControllerFunctionalityServer
CommonRemotePowerShell CommonConfigurationAuthorization
CommonConfigurationAuthorization CommonActiveDirectoryAccess
27
Source class Target class
CommonTransportThrottlingClient MailboxTransportThrottlingServer
ClientAccessActiveSync ClientAccessServiceMonitoring
ClientAccessActiveSync CommonActiveDirectoryAccess
ClientAccessActiveSync CommonAllServerRoles
ClientAccessActiveSync CommonBestPracticeAnalyzer
ClientAccessActiveSync CommonProblemAnalysis
ClientAccessActiveSync CommonServer
ClientAccessAutoDiscovery ClientAccessServiceMonitoring
ClientAccessAutoDiscovery CommonActiveDirectoryAccess
ClientAccessAutoDiscovery CommonAllServerRoles
ClientAccessAutoDiscovery CommonBestPracticeAnalyzer
ClientAccessAutoDiscovery CommonProblemAnalysis
ClientAccessAutoDiscovery CommonServer
ClientAccessFileDistributionService ClientAccessServiceMonitoring
ClientAccessFileDistributionService CommonActiveDirectoryAccess
ClientAccessFileDistributionService CommonAllServerRoles
ClientAccessFileDistributionService CommonBestPracticeAnalyzer
ClientAccessFileDistributionService CommonFileDistributionService
ClientAccessFileDistributionService CommonProblemAnalysis
ClientAccessFileDistributionService CommonServer
ClientAccessImap4 ClientAccessServiceMonitoring
ClientAccessImap4 CommonActiveDirectoryAccess
ClientAccessImap4 CommonAllServerRoles
ClientAccessImap4 CommonBestPracticeAnalyzer
ClientAccessImap4 CommonProblemAnalysis
ClientAccessImap4 CommonServer
ClientAccessInformationWorker ClientAccessServiceMonitoring
ClientAccessInformationWorker CommonActiveDirectoryAccess
ClientAccessInformationWorker CommonAllServerRoles
28
Source class Target class
ClientAccessInformationWorker CommonBestPracticeAnalyzer
ClientAccessInformationWorker CommonProblemAnalysis
ClientAccessInformationWorker CommonServer
ClientAccessOutlookWebAccess ClientAccessServiceMonitoring
ClientAccessOutlookWebAccess CommonActiveDirectoryAccess
ClientAccessOutlookWebAccess CommonAllServerRoles
ClientAccessOutlookWebAccess CommonBestPracticeAnalyzer
ClientAccessOutlookWebAccess CommonProblemAnalysis
ClientAccessOutlookWebAccess CommonServer
ClientAccessExchangeControlPanel ClientAccessServiceMonitoring
ClientAccessExchangeControlPanel CommonActiveDirectoryAccess
ClientAccessExchangeControlPanel CommonAllServerRoles
ClientAccessExchangeControlPanel CommonBestPracticeAnalyzer
ClientAccessExchangeControlPanel CommonProblemAnalysis
ClientAccessExchangeControlPanel CommonServer
ClientAccessPop3 ClientAccessServiceMonitoring
ClientAccessPop3 CommonActiveDirectoryAccess
ClientAccessPop3 CommonAllServerRoles
ClientAccessPop3 CommonBestPracticeAnalyzer
ClientAccessPop3 CommonProblemAnalysis
ClientAccessPop3 CommonServer
ClientAccessWebServices ClientAccessServiceMonitoring
ClientAccessWebServices CommonActiveDirectoryAccess
ClientAccessWebServices CommonAllServerRoles
ClientAccessWebServices CommonBestPracticeAnalyzer
ClientAccessWebServices CommonProblemAnalysis
ClientAccessWebServices CommonServer
ClientAccessAvailabilityService ClientAccessWebServices
ClientAccessAvailabilityService ClientAccessAutoDiscovery
29
Source class Target class
ClientAccessAvailabilityService ClientAccessServiceMonitoring
ClientAccessAvailabilityService CommonAllServerRoles
ClientAccessAvailabilityService CommonBestPracticeAnalyzer
ClientAccessAvailabilityService CommonProblemAnalysis
ClientAccessAvailabilityService CommonServer
ClientAccessAnonymousCalendarSharing CommonAllServerRoles
ClientAccessAnonymousCalendarSharing CommonBestPracticeAnalyzer
ClientAccessAnonymousCalendarSharing CommonProblemAnalysis
ClientAccessAnonymousCalendarSharing CommonServer
ClientAccessOfflineAddressBook ClientAccessServiceMonitoring
ClientAccessOfflineAddressBook CommonAllServerRoles
ClientAccessOfflineAddressBook CommonBestPracticeAnalyzer
ClientAccessOfflineAddressBook CommonProblemAnalysis
ClientAccessOfflineAddressBook CommonServer
ClientAccessOutlook ClientAccessServiceMonitoring
ClientAccessOutlook ClientAccessAutoDiscovery
ClientAccessOutlook CommonAllServerRoles
ClientAccessOutlook CommonBestPracticeAnalyzer
ClientAccessOutlook CommonProblemAnalysis
ClientAccessOutlook CommonServer
ClientAccessUnifiedMessaging ClientAccessServiceMonitoring
ClientAccessUnifiedMessaging CommonAllServerRoles
ClientAccessUnifiedMessaging CommonBestPracticeAnalyzer
ClientAccessUnifiedMessaging CommonProblemAnalysis
ClientAccessUnifiedMessaging CommonServer
ClientAccessTestConfig ClientAccessServiceMonitoring
ClientAccessTestConfig CommonActiveDirectoryAccess
ClientAccessTestConfig CommonAllServerRoles
ClientAccessTestConfig CommonServer
30
Source class Target class
ClientAccessTestConfig ClientAccessActiveSync
ClientAccessTestConfig ClientAccessImap4
ClientAccessTestConfig ClientAccessOutlookWebAccess
ClientAccessTestConfig ClientAccessExchangeControlPanel
ClientAccessTestConfig ClientAccessPop3
ClientAccessTestConfig ClientAccessWebServices
ClientAccessMailboxReplicationService CommonActiveDirectoryAccess
ClientAccessMailboxReplicationService CommonAllServerRoles
ClientAccessMailboxReplicationService CommonBestPracticeAnalyzer
ClientAccessMailboxReplicationService CommonProblemAnalysis
ClientAccessMailboxReplicationService CommonServer
EdgeTransportAgentsAddressRewrite EdgeTransportServiceMonitoring
EdgeTransportAgentsAddressRewrite CommonActiveDirectoryAccess
EdgeTransportAgentsAddressRewrite CommonAllServerRoles
EdgeTransportAgentsAddressRewrite CommonBestPracticeAnalyzer
EdgeTransportAgentsAddressRewrite CommonProblemAnalysis
EdgeTransportAgentsAddressRewrite CommonTransport
EdgeTransportAgentsAddressRewrite CommonTransportAgents
EdgeTransportAgentsAddressRewrite CommonTransportLogSearch
EdgeTransportAgentsAddressRewrite CommonServer
EdgeTransportAgentsAttachmentFilter EdgeTransportServiceMonitoring
EdgeTransportAgentsAttachmentFilter CommonActiveDirectoryAccess
EdgeTransportAgentsAttachmentFilter CommonAllServerRoles
EdgeTransportAgentsAttachmentFilter CommonBestPracticeAnalyzer
EdgeTransportAgentsAttachmentFilter CommonProblemAnalysis
EdgeTransportAgentsAttachmentFilter CommonTransport
EdgeTransportAgentsAttachmentFilter CommonTransportAgents
EdgeTransportAgentsAttachmentFilter CommonTransportLogSearch
EdgeTransportAgentsAttachmentFilter CommonServer
31
Source class Target class
EdgeTransportAgentsConnectionFilter EdgeTransportServiceMonitoring
EdgeTransportAgentsConnectionFilter CommonActiveDirectoryAccess
EdgeTransportAgentsConnectionFilter CommonAllServerRoles
EdgeTransportAgentsConnectionFilter CommonBestPracticeAnalyzer
EdgeTransportAgentsConnectionFilter CommonProblemAnalysis
EdgeTransportAgentsConnectionFilter CommonTransport
EdgeTransportAgentsConnectionFilter CommonTransportAgents
EdgeTransportAgentsConnectionFilter CommonTransportLogSearch
EdgeTransportAgentsConnectionFilter CommonServer
EdgeTransportAgentsContentFilter EdgeTransportServiceMonitoring
EdgeTransportAgentsContentFilter CommonActiveDirectoryAccess
EdgeTransportAgentsContentFilter CommonAllServerRoles
EdgeTransportAgentsContentFilter CommonBestPracticeAnalyzer
EdgeTransportAgentsContentFilter CommonProblemAnalysis
EdgeTransportAgentsContentFilter CommonTransport
EdgeTransportAgentsContentFilter CommonTransportAgents
EdgeTransportAgentsContentFilter CommonTransportLogSearch
EdgeTransportAgentsContentFilter CommonServer
EdgeTransportAgentsProtocolAnalysis EdgeTransportServiceMonitoring
EdgeTransportAgentsProtocolAnalysis CommonActiveDirectoryAccess
EdgeTransportAgentsProtocolAnalysis CommonAllServerRoles
EdgeTransportAgentsProtocolAnalysis CommonBestPracticeAnalyzer
EdgeTransportAgentsProtocolAnalysis CommonProblemAnalysis
EdgeTransportAgentsProtocolAnalysis CommonTransport
EdgeTransportAgentsProtocolAnalysis CommonTransportAgents
EdgeTransportAgentsProtocolAnalysis CommonTransportLogSearch
EdgeTransportAgentsProtocolAnalysis CommonServer
EdgeTransportAgentsRecipientFilter EdgeTransportServiceMonitoring
EdgeTransportAgentsRecipientFilter CommonActiveDirectoryAccess
32
Source class Target class
EdgeTransportAgentsRecipientFilter CommonAllServerRoles
EdgeTransportAgentsRecipientFilter CommonBestPracticeAnalyzer
EdgeTransportAgentsRecipientFilter CommonProblemAnalysis
EdgeTransportAgentsRecipientFilter CommonTransport
EdgeTransportAgentsRecipientFilter CommonTransportAgents
EdgeTransportAgentsRecipientFilter CommonTransportLogSearch
EdgeTransportAgentsRecipientFilter CommonServer
EdgeTransportAgentsSenderFilter EdgeTransportServiceMonitoring
EdgeTransportAgentsSenderFilter CommonActiveDirectoryAccess
EdgeTransportAgentsSenderFilter CommonAllServerRoles
EdgeTransportAgentsSenderFilter CommonBestPracticeAnalyzer
EdgeTransportAgentsSenderFilter CommonProblemAnalysis
EdgeTransportAgentsSenderFilter CommonTransport
EdgeTransportAgentsSenderFilter CommonTransportAgents
EdgeTransportAgentsSenderFilter CommonTransportLogSearch
EdgeTransportAgentsSenderFilter CommonServer
EdgeTransportAgentsSenderId EdgeTransportServiceMonitoring
EdgeTransportAgentsSenderId CommonActiveDirectoryAccess
EdgeTransportAgentsSenderId CommonAllServerRoles
EdgeTransportAgentsSenderId CommonBestPracticeAnalyzer
EdgeTransportAgentsSenderId CommonProblemAnalysis
EdgeTransportAgentsSenderId CommonTransport
EdgeTransportAgentsSenderId CommonTransportAgents
EdgeTransportAgentsSenderId CommonTransportLogSearch
EdgeTransportAgentsSenderId CommonServer
EdgeTransportDsn EdgeTransportServiceMonitoring
EdgeTransportDsn CommonActiveDirectoryAccess
EdgeTransportDsn CommonAllServerRoles
EdgeTransportDsn CommonBestPracticeAnalyzer
33
Source class Target class
EdgeTransportDsn CommonProblemAnalysis
EdgeTransportDsn CommonTransport
EdgeTransportDsn CommonTransportLogSearch
EdgeTransportDsn CommonServer
EdgeTransportMessageSecurity EdgeTransportServiceMonitoring
EdgeTransportMessageSecurity CommonActiveDirectoryAccess
EdgeTransportMessageSecurity CommonAllServerRoles
EdgeTransportMessageSecurity CommonBestPracticeAnalyzer
EdgeTransportMessageSecurity CommonProblemAnalysis
EdgeTransportMessageSecurity CommonTransport
EdgeTransportMessageSecurity CommonTransportLogSearch
EdgeTransportMessageSecurity CommonServer
EdgeTransportQueues EdgeTransportServiceMonitoring
EdgeTransportQueues CommonActiveDirectoryAccess
EdgeTransportQueues CommonAllServerRoles
EdgeTransportQueues CommonBestPracticeAnalyzer
EdgeTransportQueues CommonProblemAnalysis
EdgeTransportQueues CommonTransport
EdgeTransportQueues CommonTransportLogSearch
EdgeTransportQueues CommonServer
HubTransportAgentsConnectionFilter HubTransportServiceMonitoring
HubTransportAgentsConnectionFilter CommonActiveDirectoryAccess
HubTransportAgentsConnectionFilter CommonAllServerRoles
HubTransportAgentsConnectionFilter CommonBestPracticeAnalyzer
HubTransportAgentsConnectionFilter CommonProblemAnalysis
HubTransportAgentsConnectionFilter CommonTransport
HubTransportAgentsConnectionFilter CommonTransportAgents
HubTransportAgentsConnectionFilter CommonTransportLogSearch
HubTransportAgentsConnectionFilter CommonServer
34
Source class Target class
HubTransportAgentsContentFilter HubTransportServiceMonitoring
HubTransportAgentsContentFilter CommonActiveDirectoryAccess
HubTransportAgentsContentFilter CommonAllServerRoles
HubTransportAgentsContentFilter CommonBestPracticeAnalyzer
HubTransportAgentsContentFilter CommonProblemAnalysis
HubTransportAgentsContentFilter CommonTransport
HubTransportAgentsContentFilter CommonTransportAgents
HubTransportAgentsContentFilter CommonTransportLogSearch
HubTransportAgentsContentFilter CommonServer
HubTransportAgentsMessagingPolicies HubTransportServiceMonitoring
HubTransportAgentsMessagingPolicies CommonActiveDirectoryAccess
HubTransportAgentsMessagingPolicies CommonAllServerRoles
HubTransportAgentsMessagingPolicies CommonBestPracticeAnalyzer
HubTransportAgentsMessagingPolicies CommonProblemAnalysis
HubTransportAgentsMessagingPolicies CommonTransport
HubTransportAgentsMessagingPolicies CommonTransportAgents
HubTransportAgentsMessagingPolicies CommonTransportLogSearch
HubTransportAgentsMessagingPolicies CommonServer
HubTransportAgentsProtocolAnalysis HubTransportServiceMonitoring
HubTransportAgentsProtocolAnalysis CommonActiveDirectoryAccess
HubTransportAgentsProtocolAnalysis CommonAllServerRoles
HubTransportAgentsProtocolAnalysis CommonBestPracticeAnalyzer
HubTransportAgentsProtocolAnalysis CommonProblemAnalysis
HubTransportAgentsProtocolAnalysis CommonTransport
HubTransportAgentsProtocolAnalysis CommonTransportAgents
HubTransportAgentsProtocolAnalysis CommonTransportLogSearch
HubTransportAgentsProtocolAnalysis CommonServer
HubTransportAgentsRecipientFilter HubTransportServiceMonitoring
HubTransportAgentsRecipientFilter CommonActiveDirectoryAccess
35
Source class Target class
HubTransportAgentsRecipientFilter CommonAllServerRoles
HubTransportAgentsRecipientFilter CommonBestPracticeAnalyzer
HubTransportAgentsRecipientFilter CommonProblemAnalysis
HubTransportAgentsRecipientFilter CommonTransport
HubTransportAgentsRecipientFilter CommonTransportAgents
HubTransportAgentsRecipientFilter CommonTransportLogSearch
HubTransportAgentsRecipientFilter CommonServer
HubTransportAgentsSenderFilter HubTransportServiceMonitoring
HubTransportAgentsSenderFilter CommonActiveDirectoryAccess
HubTransportAgentsSenderFilter CommonAllServerRoles
HubTransportAgentsSenderFilter CommonBestPracticeAnalyzer
HubTransportAgentsSenderFilter CommonProblemAnalysis
HubTransportAgentsSenderFilter CommonTransport
HubTransportAgentsSenderFilter CommonTransportAgents
HubTransportAgentsSenderFilter CommonTransportLogSearch
HubTransportAgentsSenderFilter CommonServer
HubTransportAgentsSenderId HubTransportServiceMonitoring
HubTransportAgentsSenderId CommonActiveDirectoryAccess
HubTransportAgentsSenderId CommonAllServerRoles
HubTransportAgentsSenderId CommonBestPracticeAnalyzer
HubTransportAgentsSenderId CommonProblemAnalysis
HubTransportAgentsSenderId CommonTransport
HubTransportAgentsSenderId CommonTransportAgents
HubTransportAgentsSenderId CommonTransportLogSearch
HubTransportAgentsSenderId CommonServer
HubTransportAgentsSMS HubTransportServiceMonitoring
HubTransportAgentsSMS CommonActiveDirectoryAccess
HubTransportAgentsSMS CommonAllServerRoles
HubTransportAgentsSMS CommonBestPracticeAnalyzer
36
Source class Target class
HubTransportAgentsSMS CommonProblemAnalysis
HubTransportAgentsSMS CommonTransport
HubTransportAgentsSMS CommonTransportAgents
HubTransportAgentsSMS CommonTransportLogSearch
HubTransportAgentsSMS CommonServer
HubTransportDsn HubTransportServiceMonitoring
HubTransportDsn CommonActiveDirectoryAccess
HubTransportDsn CommonAllServerRoles
HubTransportDsn CommonBestPracticeAnalyzer
HubTransportDsn CommonProblemAnalysis
HubTransportDsn CommonTransport
HubTransportDsn CommonTransportLogSearch
HubTransportDsn CommonServer
HubTransportEdgeSync HubTransportServiceMonitoring
HubTransportEdgeSync CommonActiveDirectoryAccess
HubTransportEdgeSync CommonAllServerRoles
HubTransportEdgeSync CommonBestPracticeAnalyzer
HubTransportEdgeSync CommonProblemAnalysis
HubTransportEdgeSync CommonTransport
HubTransportEdgeSync CommonTransportLogSearch
HubTransportEdgeSync CommonServer
HubTransportQueues HubTransportServiceMonitoring
HubTransportQueues CommonActiveDirectoryAccess
HubTransportQueues CommonAllServerRoles
HubTransportQueues CommonBestPracticeAnalyzer
HubTransportQueues CommonProblemAnalysis
HubTransportQueues CommonTransport
HubTransportQueues CommonTransportLogSearch
HubTransportQueues CommonServer
37
Source class Target class
HubTransportDsn HubTransportStoreDriver
HubTransportQueues HubTransportStoreDriver
MailboxSystemAttendant Mailbox.ServiceMonitoring
MailboxSystemAttendant CommonActiveDirectoryAccess
MailboxSystemAttendant CommonAllServerRoles
MailboxSystemAttendant CommonBestPracticeAnalyzer
MailboxSystemAttendant CommonProblemAnalysis
MailboxSystemAttendant CommonServer
MailboxTestConfig CommonActiveDirectoryAccess
MailboxTestConfig CommonAllServerRoles
MailboxTestConfig CommonServer
Mailbox.AllDatabaseServices Mailbox.DatabaseService
Mailbox.DatabaseCopyMounted Mailbox.InformationStore
Mailbox.DatabaseCopyMounted Mailbox.ClusterService
Mailbox.DatabaseCopySearchable Mailbox.ContentIndexingService
Mailbox.ContentIndexingService Mailbox.InformationStorePerformance
Mailbox.DatabaseRedundancy Mailbox.ClusterService
Mailbox.DatabaseRedundancy Mailbox.DatabaseCopy
Mailbox.DatabaseCopy Mailbox.DatabaseCopyCorruption
Mailbox.DatabaseCopy Mailbox.DatabaseCopyIntegritySuppression
Mailbox.DatabaseCopy Mailbox.ReplayService
Mailbox.DatabaseCopy Mailbox.DatabaseCopySubmission
Mailbox.DatabaseCopy Mailbox.DatabaseCopyReplication
Mailbox.DatabaseCopy Mailbox.DatabaseCopyReplay
Mailbox.DatabaseCopy Mailbox.DatabaseCopyEdbLogicalDiskSpace
Mailbox.DatabaseCopy Mailbox.DatabaseCopyLogLogicalDiskSpace
Mailbox.DatabaseCopyPerformance Mailbox.InformationStorePerformance
Mailbox.DatabaseCopyPerformance Mailbox.DatabaseCopyLogLogicalDiskPerformance
Mailbox.DatabaseCopyPerformance Mailbox.DatabaseCopyEdbLogicalDiskPerformance
38
Source class Target class
Mailbox.InformationStorePerformance Mailbox.InformationStore
Mailbox.ReplayService Mailbox.InformationStore
Mailbox.Assistants Mailbox.InformationStore
Mailbox.MailSubmission Mailbox.InformationStore
Mailbox.DatabaseSearchCopy Mailbox.DatabaseCopyCorruption
Mailbox.DatabaseSearchCopy Mailbox.DatabaseCopyIntegritySuppression
Mailbox.DatabaseSearchCopy Mailbox.ContentIndexingService
Mailbox.VirusScan Mailbox.InformationStore
Mailbox.PublicFolderDatabase Mailbox.InformationStore
Mailbox.PublicFolderDatabasePerformance Mailbox.InformationStorePerformance
Mailbox.PublicFolderDatabasePerformance Mailbox.PublicFolderDatabase
Mailbox.PublicFolderDatabase Mailbox.PublicFolderDatabaseEdbLogicalDiskSpac
e
Mailbox.PublicFolderDatabase Mailbox.PublicFolderDatabaseLogLogicalDiskSpace
Mailbox.PublicFolderDatabasePerformance Mailbox.PublicFolderDatabaseEdbLogicalDiskPerfor
mance
Mailbox.PublicFolderDatabasePerformance Mailbox.PublicFolderDatabaseLogLogicalDiskPerfor
mance
Mailbox.MailboxOnDatabase Mailbox.DatabaseService
Mailbox.MailboxOnDbCopy Mailbox.DatabaseCopyMounted
Mailbox.AllAcrossClusters Mailbox.DatabaseAvailabilityGroup
Mailbox.AllAcrossClusters Mailbox.ClusterService
Mailbox.InformationStore CommonActiveDirectoryAccess
Mailbox.MailboxMonitoring CommonProblemAnalysis
Mailbox.ReplayService CommonActiveDirectoryAccess
UnifiedMessagingComponent CommonActiveDirectoryAccess
UnifiedMessaging.Component.Pipeline UnifiedMessaging.GeneralSensor.MailboxFailures
UnifiedMessaging.Component.Pipeline CommonTransport
UnifiedMessaging.Telephony.Outbound UnifiedMessaging.Availability.Gateway
UnifiedMessagingService UnifiedMessaging.Availability.Service
39
Source class Target class
UnifiedMessaging UnifiedMessagingServiceMonitoring
UnifiedMessaging CommonActiveDirectoryAccess
UnifiedMessaging CommonAllServerRoles
UnifiedMessaging CommonBestPracticeAnalyzer
UnifiedMessaging CommonProblemAnalysis
UnifiedMessaging CommonServer
ClientAccessOutlook CommonActiveDirectoryAccess
ClientAccessOutlookDirectory CommonActiveDirectoryAccess
Account Lockout
Some customers who have enabled account lockout policies in their environment have reported
issues with the test user being locked out. If you experience lockout problems in your
environment, see Microsoft Knowledge Base article 2022687, Exchange Test CAS Connectivity
user gets locked out when using Exchange 2010 MP (http://go.microsoft.com/fwlink/?
linkid=3052&kbid=2022687).
40
The Windows Event Log Provider is still unable to open the MSExchange
Management event log on computer 'server'. The Provider has been unable
to open the MSExchange Management event log for 565200 seconds.
Most recent error details: The specified channel could not be found.
Check channel configuration.
Appendix: Reports
The following reports are included in the Microsoft Exchange Server 2010 Management Pack.
Allow up to 30 minutes for reports from a new management pack to appear in the Reporting
console.
Client Access Availability Provides availability data for each Custom aggregation based on
client access protocol running on a daily OpsMgr state
Client Access server. For each aggregation.
protocol, the report provides
availability data at the server, site,
and datacenter (management
group) level.
Unified Messaging Provides availability data for the Custom aggregation based on
Availability Local Voice Unified Messaging daily OpsMgr state
task. aggregation.
41
Report Description Data Source
problems.
Daily Mailflow Statistics Provides statistics from message Custom dataset based on
tracking logs to provide message tracking log
information about mail flow summaries collected from
latency, by the day. Hub servers.
Hourly Mailflow Statistics Provides statistics from message Custom dataset based on
tracking logs to provide message tracking log
information about mail flow summaries collected from
latency, by the hour. Hub servers.
Distribution Group Usage Provides usage data for Custom dataset based on
distribution groups. message tracking log
summaries collected from
Hub servers.
Top Users Provides usage data for the clients Custom dataset based on
that send the most messages, message tracking log
receive the most messages, and summaries collected from
experience the most failures. Hub servers.
Cross-Premises Mailflow Provides mail flow reporting data Mailflow output specific to the
Monitoring for organizations that use both on- cross-premises scenario.
premises and hosted versions of
Microsoft Exchange.
42
Outlook Web AppDaily Availability Both the server-level and site-level
Outlook Web App states are reported by Operations Manager monitors. The
Outlook Web App Service class is considered to be available when at least one
Outlook Web App server is available.
OutlookDaily Availability Both the server-level and site-level Outlook states are reported
by Operations Manager monitors. The Outlook Service class is considered available when at
least one Outlook server is available.
Calculated Availabilities
Site Mailbox DatabaseDaily Availability A sites mailbox database availability is an
average of the availability of all mailboxes.
SiteDaily Availability A sites availability is the availability of its Mailbox database minus
the average length of time that the Outlook Web App Service class and Outlook Service class
are unavailable.
DatacenterDaily Availability A datacenters availability is the average availability for all of
the sites in the datacenter.
Monthly Availability The monthly availability of an entity is the sum of its daily availabilities
divided by the number of days in the month.
Raw Uptime vs. Availability
Raw Uptime = 1 Downtime
Availability = Raw Uptime + Planned Maintenance
Maintenance Mode
When an entity in Operations Manager is in maintenance mode, its monitors are in either the
unplanned maintenance state or the planned maintenance state. This maintenance state is
recorded instead of the monitors green, yellow, or red state. Since the monitors are unloaded
while in maintenance mode, the actual availability of the component cannot be measured. As a
result, Operations Manager planned maintenance is counted as uptime in the availability
calculation, and unplanned maintenance is counted as downtime.
Availability Database Tables
The availability data is stored in the Operations Manager data warehouse database
(OperationsManagerDW). The Service Level Agreement (SLA) report uses data from the
Exchange2010.vAvailabilityObjListV14 and Exchange2010.vAvailabilityOnObjectDailyV14 tables:
Exchange2010.vAvailabilityObjListV14 is a list of objects that have measured availabilities.
These objects are mailbox databases, Outlook Web App and Outlook servers, and the
Outlook Web App and Outlook service objects (one per site). The name of each object's site
is stored in this table.
Exchange2010.vAvailabilityOnObjectDailyV14 contains daily availabilities as percentages for
each object in Exchange2010.vAvailabilityObjListV14.
43
Task Command Frequenc
y
CasConnectivityTestCredenti Set-CasConnectivityTestCredentials 15
als minutes
EdgeSynchronization Test-EdgeSynchronization 15
minutes
EdgeSyncMServ Test-EdgeSyncMserv 15
minutes
ExchangeSearch Test-ExchangeSearch 20
minutes
MRSHealth Test-MRSHealth 3
minutes
44
Task Command Frequenc
y
ReplicationHealth Test-ReplicationHealth 5
-TransientEventSuppressionWindow 3 minutes
SmtpConnectivity Test-SmtpConnectivity 5
minutes
Test-OutlookWebServices Test-OutlookWebServices 3
minutes
WebServicesConnectivity Test-WebServicesConnectivity 12
Internal -TrustAnySSLCertificate:$true -LightMode:$true minutes
Appendix: Scripts
The following scripts are included in the Microsoft Exchange Server 2010 Management Pack.
Script Purpose
45
Script Purpose
46
Script Purpose
Discovery Objects
ClientAccessRole.DiscoveryRule Server
ClientAccessRole.DiscoveryRule ClientAccessRole
ClientAccessRole.DiscoveryRule CommonRole
EdgeTransportRole.DiscoveryRule Server
EdgeTransportRole.DiscoveryRule EdgeTransportRole
EdgeTransportRole.DiscoveryRule CommonRole
HubTransportRole.DiscoveryRule Server
HubTransportRole.DiscoveryRule HubTransportRole
HubTransportRole.DiscoveryRule CommonRole
MailboxRole.DiscoveryRule Server
MailboxRole.DiscoveryRule MailboxRole
MailboxRole.DiscoveryRule CommonRole
UnifiedMessagingRole.DiscoveryRule Server
UnifiedMessagingRole.DiscoveryRule UnifiedMessagingRole
UnifiedMessagingRole.DiscoveryRule CommonRole
DomainControllerRole.DiscoveryRule DomainControllerRole
DomainControllerRole.DiscoveryRule DomainControllerFunctionalityServer
47
DomainControllerRole.DiscoveryRule DomainControllerFunctionalityService
Organization.DiscoveryRule Organization
Organization.DiscoveryRule ClientAccessActiveSyncService
Organization.DiscoveryRule ClientAccessOutlookWebAccessService
Organization.DiscoveryRule ClientAccessExchangeControlPanelService
Organization.DiscoveryRule ClientAccessWebServicesService
Organization.DiscoveryRule ClientAccessAvailabilityServicesService
Organization.DiscoveryRule ClientAccessOfflineAddressBookService
Organization.DiscoveryRule ClientAccessImap4Service
Organization.DiscoveryRule ClientAccessPop3Service
Organization.DiscoveryRule ClientAccessTestConfigService
Organization.DiscoveryRule EdgeTransportService
Organization.DiscoveryRule HubTransportService
Organization.DiscoveryRule MailboxMapiService
Organization.DiscoveryRule ClientAccessMailboxReplicationServicesService
Organization.DiscoveryRule UnifiedMessagingService
Organization.DiscoveryRule CommonRemotePowerShellService
Organization.DiscoveryRule ClientAccessAnonymousCalendarSharingService
ClientAccessComponent.DiscoveryRule ClientAccessActiveSync
ClientAccessComponent.DiscoveryRule ClientAccessAutoDiscovery
ClientAccessComponent.DiscoveryRule ClientAccessFileDistributionService
ClientAccessComponent.DiscoveryRule ClientAccessImap4
ClientAccessComponent.DiscoveryRule ClientAccessInformationWorker
ClientAccessComponent.DiscoveryRule ClientAccessOutlookWebAccess
ClientAccessComponent.DiscoveryRule ClientAccessExchangeControlPanel
ClientAccessComponent.DiscoveryRule ClientAccessPop3
ClientAccessComponent.DiscoveryRule ClientAccessServiceMonitoring
ClientAccessComponent.DiscoveryRule ClientAccessWebServices
ClientAccessComponent.DiscoveryRule ClientAccessAvailabilityService
ClientAccessComponent.DiscoveryRule ClientAccessOfflineAddressBook
48
ClientAccessComponent.DiscoveryRule ClientAccessUnifiedMessaging
ClientAccessComponent.DiscoveryRule ClientAccessTestConfig
ClientAccessComponent.DiscoveryRule ClientAccessMailboxReplicationService
ClientAccessComponent.DiscoveryRule ClientAccessAnonymousCalendarSharing
ClientAccessComponent.DiscoveryRule CommonAllServerRoles
ClientAccessComponent.DiscoveryRule CommonBestPracticeAnalyzer
ClientAccessComponent.DiscoveryRule CommonFileDistributionService
ClientAccessComponent.DiscoveryRule CommonProblemAnalysis
ClientAccessComponent.DiscoveryRule CommonServer
ClientAccessComponent.DiscoveryRule CommonServiceMonitoring
ClientAccessComponent.DiscoveryRule CommonMSExchangeRPCServiceMonitoring
ClientAccessComponent.DiscoveryRule CommonInternalRoleServices
ClientAccessComponent.DiscoveryRule CommonRemotePowerShell
ClientAccessComponent.DiscoveryRule CommonConfigurationAuthorization
ClientAccessComponent.DiscoveryRule CommonProvisioningBroker
ClientAccessComponent.DiscoveryRule ClientAccessOutlookService
ClientAccessComponent.DiscoveryRule ClientAccessOutlook
ClientAccessComponent.DiscoveryRule ClientAccessOutlookServerService
ClientAccessComponent.DiscoveryRule ClientAccessOutlookLocalServer
ClientAccessComponent.DiscoveryRule ClientAccessOutlookPerformanceService
ClientAccessComponent.DiscoveryRule ClientAccessOutlookInstancePerformance
ClientAccessComponent.DiscoveryRule ClientAccessOutlookDirectory
ClientAccessComponent.DiscoveryRule ClientAccessOutlookRpcProxy
ClientAccessComponent.DiscoveryRule CommonTransportThrottlingClient
EdgeTransportComponent.DiscoveryRule EdgeTransportAgentsAddressRewrite
EdgeTransportComponent.DiscoveryRule EdgeTransportAgentsAttachmentFilter
EdgeTransportComponent.DiscoveryRule EdgeTransportAgentsConnectionFilter
EdgeTransportComponent.DiscoveryRule EdgeTransportAgentsContentFilter
EdgeTransportComponent.DiscoveryRule EdgeTransportAgentsProtocolAnalysis
EdgeTransportComponent.DiscoveryRule EdgeTransportAgentsRecipientFilter
49
EdgeTransportComponent.DiscoveryRule EdgeTransportAgentsSenderFilter
EdgeTransportComponent.DiscoveryRule EdgeTransportAgentsSenderId
EdgeTransportComponent.DiscoveryRule EdgeTransportDsn
EdgeTransportComponent.DiscoveryRule EdgeTransportMessageSecurity
EdgeTransportComponent.DiscoveryRule EdgeTransportQueues
EdgeTransportComponent.DiscoveryRule EdgeTransportServiceMonitoring
EdgeTransportComponent.DiscoveryRule CommonAllServerRoles
EdgeTransportComponent.DiscoveryRule CommonBestPracticeAnalyzer
EdgeTransportComponent.DiscoveryRule CommonExtensibleStorageEngine
EdgeTransportComponent.DiscoveryRule CommonProblemAnalysis
EdgeTransportComponent.DiscoveryRule CommonTransport
EdgeTransportComponent.DiscoveryRule CommonTransportAgents
EdgeTransportComponent.DiscoveryRule CommonTransportLogSearch
EdgeTransportComponent.DiscoveryRule CommonServer
EdgeTransportComponent.DiscoveryRule CommonServiceMonitoring
CommonDomainController.DiscoveryRule CommonActiveDirectoryAccessService
CommonDomainController.DiscoveryRule CommonADAccessDomainControllerService
CommonDomainController.DiscoveryRule CommonActiveDirectoryAccess
CommonDomainController.DiscoveryRule CommonDomainController
HubTransportComponent.DiscoveryRule HubTransportAgentsConnectionFilter
HubTransportComponent.DiscoveryRule HubTransportAgentsContentFilter
HubTransportComponent.DiscoveryRule HubTransportAgentsMessagingPolicies
HubTransportComponent.DiscoveryRule HubTransportAgentsProtocolAnalysis
HubTransportComponent.DiscoveryRule HubTransportAgentsRecipientFilter
HubTransportComponent.DiscoveryRule HubTransportAgentsSenderFilter
HubTransportComponent.DiscoveryRule HubTransportAgentsSenderId
HubTransportComponent.DiscoveryRule HubTransportAgentsSMS
HubTransportComponent.DiscoveryRule HubTransportDsn
HubTransportComponent.DiscoveryRule HubTransportEdgeSync
HubTransportComponent.DiscoveryRule HubTransportQueues
50
HubTransportComponent.DiscoveryRule HubTransportServiceMonitoring
HubTransportComponent.DiscoveryRule HubTransportStoreDriver
HubTransportComponent.DiscoveryRule CommonInternalRoleServices
HubTransportComponent.DiscoveryRule CommonAllServerRoles
HubTransportComponent.DiscoveryRule CommonBestPracticeAnalyzer
HubTransportComponent.DiscoveryRule CommonExtensibleStorageEngine
HubTransportComponent.DiscoveryRule CommonProblemAnalysis
HubTransportComponent.DiscoveryRule CommonTransport
HubTransportComponent.DiscoveryRule CommonTransportAgents
HubTransportComponent.DiscoveryRule CommonTransportLogSearch
HubTransportComponent.DiscoveryRule CommonServer
HubTransportComponent.DiscoveryRule CommonServiceMonitoring
HubTransportComponent.DiscoveryRule CommonRemotePowerShell
HubTransportComponent.DiscoveryRule CommonConfigurationAuthorization
HubTransportComponent.DiscoveryRule CommonProvisioningBroker
HubTransportComponent.DiscoveryRule CommonTransportThrottlingClient
MailboxComponent.DiscoveryRule Mailbox.ServiceMonitoring
MailboxComponent.DiscoveryRule MailboxSystemAttendant
MailboxComponent.DiscoveryRule MailboxUnifiedMessaging
MailboxComponent.DiscoveryRule CommonAllServerRoles
MailboxComponent.DiscoveryRule CommonBestPracticeAnalyzer
MailboxComponent.DiscoveryRule CommonExtensibleStorageEngine
MailboxComponent.DiscoveryRule CommonProblemAnalysis
MailboxComponent.DiscoveryRule CommonServer
MailboxComponent.DiscoveryRule CommonServiceMonitoring
MailboxComponent.DiscoveryRule CommonInternalRoleServices
MailboxComponent.DiscoveryRule CommonMSExchangeRPCServiceMonitoring
MailboxComponent.DiscoveryRule CommonRemotePowerShell
MailboxComponent.DiscoveryRule CommonConfigurationAuthorization
MailboxComponent.DiscoveryRule CommonProvisioningBroker
51
MailboxComponent.DiscoveryRule MailboxTransportThrottlingServer
MailboxComponent.DiscoveryRule CommonTransportLogSearch
MailboxComponent.DiscoveryRule UnifiedMessaging.WithoutCorrelation
CrossPremisesMailflowMonitoring.Discovery Mailbox.CrossPremisesMailflowMonitoring
Rule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseService
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopyMounted
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopy
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopyPerformance
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopiesPerformance
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopyCorruption
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopiesCorruption
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopyIntegritySuppression
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopiesIntegritySuppression
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopySubmission
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopiesSubmission
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopyReplication
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopiesReplication
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopyReplay
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopiesReplay
eryRule
52
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.ReplayService
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseRedundancy
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseSearchCopy
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.ContentIndexingService
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.ClusterService
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseAvailabilityGroup
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.MailSubmission
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.InformationStore
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.InformationStorePerformance
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.Assistants
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.Network
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.AllDatabaseServices
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.ManyDatabaseServices
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.ClusterQuorumGroup
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.ClusterFsw
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.AllClusterQuorumGroups
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.AllClusterFsws
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.AcrossCluster
eryRule
53
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.AllAcrossClusters
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.AllNetworks
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopiesFailed
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.MailboxMonitoring
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseSearchService
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopySearchable
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopyEdbLogicalDisk
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopyLogLogicalDisk
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.PublicFolderDatabase
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.PublicFolderDatabasePerformance
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.PublicFolderDatabaseEdbLogicalDisk
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.PublicFolderDatabaseLogLogicalDisk
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopyLogLogicalDiskPerforman
eryRule ce
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopyEdbLogicalDiskPerforman
eryRule ce
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopyLogLogicalDiskSpace
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.DatabaseCopyEdbLogicalDiskSpace
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.MailboxOnDbCopy
eryRule
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.PublicFolderDatabaseEdbLogicalDiskSp
eryRule ace
54
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.PublicFolderDatabaseLogLogicalDiskSpa
eryRule ce
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.PublicFolderDatabaseEdbLogicalDiskPer
eryRule formance
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.PublicFolderDatabaseLogLogicalDiskPerf
eryRule ormance
Mailbox.MdbOwningServerLocalEntityDiscov Mailbox.VirusScan
eryRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseService
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopyMounted
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopy
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopyPerformance
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopiesPerformance
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopyCorruption
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopiesCorruption
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopyIntegritySuppression
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopiesIntegritySuppression
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopySubmission
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopiesSubmission
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopyReplication
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopiesReplication
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopyReplay
overyRule
55
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopiesReplay
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.ReplayService
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseRedundancy
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseSearchCopy
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.ContentIndexingService
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.ClusterService
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseAvailabilityGroup
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.MailSubmission
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.InformationStore
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.InformationStorePerformance
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.Assistants
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.Network
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.AllDatabaseServices
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.ManyDatabaseServices
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.ClusterQuorumGroup
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.ClusterFsw
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.AllClusterQuorumGroups
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.AllClusterFsws
overyRule
56
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.AcrossCluster
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.AllAcrossClusters
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.AllNetworks
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopiesFailed
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.MailboxMonitoring
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseSearchService
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopySearchable
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopyEdbLogicalDisk
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopyLogLogicalDisk
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.PublicFolderDatabase
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.PublicFolderDatabasePerformance
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.PublicFolderDatabaseEdbLogicalDisk
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.PublicFolderDatabaseLogLogicalDisk
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopyLogLogicalDiskPerforman
overyRule ce
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopyEdbLogicalDiskPerforman
overyRule ce
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopyLogLogicalDiskSpace
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.DatabaseCopyEdbLogicalDiskSpace
overyRule
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.MailboxOnDbCopy
overyRule
57
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.PublicFolderDatabaseEdbLogicalDiskSp
overyRule ace
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.PublicFolderDatabaseLogLogicalDiskSpa
overyRule ce
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.PublicFolderDatabaseEdbLogicalDiskPer
overyRule formance
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.PublicFolderDatabaseLogLogicalDiskPerf
overyRule ormance
Mailbox.MdbOwningServerRemoteEntityDisc Mailbox.VirusScan
overyRule
UnifiedMessagingComponent.DiscoveryRule UnifiedMessaging
UnifiedMessagingComponent.DiscoveryRule UnifiedMessagingPerformanceReporting
UnifiedMessagingComponent.DiscoveryRule UnifiedMessagingServiceMonitoring
UnifiedMessagingComponent.DiscoveryRule UnifiedMessaging.Availability.Service
UnifiedMessagingComponent.DiscoveryRule UnifiedMessaging.Availability.Gateway
UnifiedMessagingComponent.DiscoveryRule UnifiedMessaging.GeneralSensor.TransportFailur
es
UnifiedMessagingComponent.DiscoveryRule UnifiedMessaging.SubComponent.PartnerTranscr
iptionFailures
UnifiedMessagingComponent.DiscoveryRule UnifiedMessaging.GeneralSensor.MailboxFailures
UnifiedMessagingComponent.DiscoveryRule UnifiedMessaging.SubComponent.Pipeline
UnifiedMessagingComponent.DiscoveryRule UnifiedMessaging.SubComponent.ProtectedVoice
Message
UnifiedMessagingComponent.DiscoveryRule UnifiedMessaging.WithoutCorrelation
UnifiedMessagingComponent.DiscoveryRule CommonAllServerRoles
UnifiedMessagingComponent.DiscoveryRule CommonBestPracticeAnalyzer
UnifiedMessagingComponent.DiscoveryRule CommonFileDistributionService
UnifiedMessagingComponent.DiscoveryRule CommonProblemAnalysis
UnifiedMessagingComponent.DiscoveryRule CommonServer
UnifiedMessagingComponent.DiscoveryRule CommonServiceMonitoring
UnifiedMessagingComponent.DiscoveryRule CommonInternalRoleServices
UnifiedMessagingComponent.DiscoveryRule CommonRemotePowerShell
UnifiedMessagingComponent.DiscoveryRule CommonConfigurationAuthorization
58
UnifiedMessagingComponent.DiscoveryRule CommonProvisioningBroker
UnifiedMessagingComponent.DiscoveryRule CommonTransportThrottlingClient
UnifiedMessagingComponent.DiscoveryRule UnifiedMessagingService
UnifiedMessagingComponent.DiscoveryRule CommonRemotePowerShellService
CorrelationEngineRole.DiscoveryRule CorrelationEngineRole
MonitoringCorrelationEngine.DiscoveryRule MonitoringCorrelationEngine
ClientAccessRole.DiscoveryRule Server
ClientAccessRole.DiscoveryRule ClientAccessRole
ClientAccessRole.DiscoveryRule CommonRole
EdgeTransportRole.DiscoveryRule Server
EdgeTransportRole.DiscoveryRule EdgeTransportRole
EdgeTransportRole.DiscoveryRule CommonRole
HubTransportRole.DiscoveryRule Server
HubTransportRole.DiscoveryRule HubTransportRole
HubTransportRole.DiscoveryRule CommonRole
MailboxRole.DiscoveryRule Server
MailboxRole.DiscoveryRule MailboxRole
MailboxRole.DiscoveryRule CommonRole
UnifiedMessagingRole.DiscoveryRule Server
UnifiedMessagingRole.DiscoveryRule UnifiedMessagingRole
UnifiedMessagingRole.DiscoveryRule CommonRole
DomainControllerRole.DiscoveryRule DomainControllerRole
DomainControllerRole.DiscoveryRule DomainControllerFunctionalityServer
DomainControllerRole.DiscoveryRule DomainControllerFunctionalityService
Organization.DiscoveryRule Organization
Organization.DiscoveryRulee ClientAccessActiveSyncService
Organization.DiscoveryRule ClientAccessOutlookWebAccessService
Organization.DiscoveryRule ClientAccessExchangeControlPanelService
Organization.DiscoveryRule ClientAccessWebServicesService
Organization.DiscoveryRule ClientAccessAvailabilityServicesService
59
Organization.DiscoveryRule ClientAccessOfflineAddressBookService
Organization.DiscoveryRule ClientAccessImap4Service
Organization.DiscoveryRule ClientAccessPop3Service
Organization.DiscoveryRule ClientAccessTestConfigService
Organization.DiscoveryRule EdgeTransportService
Organization.DiscoveryRule HubTransportService
Organization.DiscoveryRule MailboxMapiService
Organization.DiscoveryRule ClientAccessMailboxReplicationServicesService
60
61
Hub Transport Class Hierarchy
62
Edge Transport Class Hierarchy
63
Mailbox Class Hierarchy
In this figure, the color red is used to show class hierarchy relationships that are new in this
version of the Exchange 2010 Management Pack, released with Exchange 2010 Service Pack 1
(SP1). Shaded areas indicate class hierarchy relationships that existed in the RTM version of the
Exchange 2010 Management Pack. Not every class relationship is used for alert correlation. For
the specific relationships used by the Correlation Engine, see Appendix: Class Hierarchy.
64
Mailbox - High Availability and Mailbox Services Class Hierarchy
In this figure, the color red is used to show class hierarchy relationships that are new in this
version of the Exchange 2010 Management Pack, released with Exchange 2010 Service Pack 1
(SP1). Shaded areas indicate class hierarchy relationships that existed in the RTM version of the
Exchange 2010 Management Pack. Not every class relationship is used for alert correlation. For
the specific relationships used by the Correlation Engine, see Appendix: Class Hierarchy.
65
Common Classes Class Hierarchy
In this figure, the color red is used to show class hierarchy relationships that are new in this
version of the Exchange 2010 Management Pack, released with Exchange 2010 Service Pack 1
(SP1). Shaded areas indicate class hierarchy relationships that existed in the RTM version of the
66
Exchange 2010 Management Pack. Not every class relationship is used for alert correlation. For
the specific relationships used by the Correlation Engine, see Appendix: Class Hierarchy.
67
Roles Class Hierarchy
In this figure, the color red is used to show class hierarchy relationships that are new in this
version of the Exchange 2010 Management Pack, released with Exchange 2010 Service Pack 1
(SP1). Shaded areas indicate class hierarchy relationships that existed in the RTM version of the
Exchange 2010 Management Pack. Not every class relationship is used for alert correlation. For
the specific relationships used by the Correlation Engine, see Appendix: Class Hierarchy.
68
Groups Class Hierarchy
69
Appendix: Alert Correlation Relationships
The Microsoft Exchange Server 2010 Management Pack provides a correlation engine to
significantly reduce the number of alerts that may not require an action by the administrator. This
reduction in the number of alerts is made possible by the processing of alerts by the Correlation
Engine service. For more information about alert correlation, see Understanding Alert Correlation
earlier in this guide.
Use the following diagrams to better understand alert correlation:
Client Access - On Server Alert Correlation Relationships
Client Access - Server to Site Alert Correlation Relationships
Edge Transport Alert Correlation Relationships
Hub Transport Alert Correlation Relationships
Mailbox - High Availability Alert Correlation Relationships
Mailbox - Information Store Alert Correlation Relationships
Performance, Disks, and Public Folders Alert Correlation Relationships
Unified Messaging Alert Correlation Relationships
70
Client Access - Server to Site Alert Correlation Relationships
In this figure, the color red is used to show alert correlation relationships that are new in this
version of the Exchange 2010 Management Pack, released with Exchange 2010 Service Pack 1
(SP1). Shaded areas indicate alert correlation relationships that existed in the RTM version of the
Exchange 2010 Management Pack. For information about alert correlation, see Understanding
Alert Correlation.
71
72
Edge Transport Alert Correlation Relationships
73
Hub Transport Alert Correlation Relationships
74
Mailbox - Information Store Alert Correlation Relationships
In this figure, the color red is used to show alert correlation relationships that are new in this
version of the Exchange 2010 Management Pack, released with Exchange 2010 Service Pack 1
(SP1). Shaded areas indicate alert correlation relationships that existed in the RTM version of the
75
Exchange 2010 Management Pack. For information about alert correlation, see Understanding
Alert Correlation.
76
Unified Messaging Alert Correlation Relationships
In this figure, the color red is used to show alert correlation relationships that are new in this
version of the Exchange 2010 Management Pack, released with Exchange 2010 Service Pack 1
(SP1). Shaded areas indicate alert correlation relationships that existed in the RTM version of the
Exchange 2010 Management Pack. For information about alert correlation, see Understanding
Alert Correlation.
77
78