Monitoring Exchange 🔗 link

Apparently, last night our Exchange server stopped receiving email until
it was rebooted this morning. Everyone is up in arms. Hobbit showed
nothing unusual. Does anyone have any way to monitor Exchange? 

Eric Jacobs
Infrastructure and Operations
Information Technology Group
Phone:XXX-XXX-XXXX
Email:user-2ad24e73f3d4@xymon.invalid

What function(s) do you wish to monitor other than Services running or not?

Perl has some modules for working with SMTP.

Ray

-----Original Message-----
From: Jacobs, Eric [mailto:user-2ad24e73f3d4@xymon.invalid]
Sent: Wednesday, October 14, 2009 4:26 PM
To: user-ae9b8668bcde@xymon.invalid
Subject: [hobbit] Monitoring Exchange

Apparently, last night our Exchange server stopped receiving email until
it was rebooted this morning. Everyone is up in arms. Hobbit showed
nothing unusual. Does anyone have any way to monitor Exchange?

Eric Jacobs
Infrastructure and Operations
Information Technology Group
Phone:XXX-XXX-XXXX
Email:user-2ad24e73f3d4@xymon.invalid

CONFIDENTIALITY NOTICE:  This email and any attachments are for the
exclusive and confidential use of the intended recipient.  If you are not
the intended recipient, please do not read, distribute or take action in
reliance upon this message. If you have received this in error, please
notify us immediately by return email and promptly delete this message
and its attachments from your computer system. We do not waive
attorney-client or work product privilege by the transmission of this
message.

What version of Exchange?  Did you determine the cause?  Currently there are monitors for Database size on Deadcat.net.  Not sure if there are any monitors for more specific Exchange items such as the queues, but you can monitor the services.

Dave Gilmore

-----Original Message-----
From: Jacobs, Eric [mailto:user-2ad24e73f3d4@xymon.invalid]
Sent: Wednesday, October 14, 2009 4:26 PM
To: user-ae9b8668bcde@xymon.invalid
Subject: [hobbit] Monitoring Exchange

Apparently, last night our Exchange server stopped receiving email until
it was rebooted this morning. Everyone is up in arms. Hobbit showed
nothing unusual. Does anyone have any way to monitor Exchange?

Eric Jacobs
Infrastructure and Operations
Information Technology Group
Phone:XXX-XXX-XXXX
Email:user-2ad24e73f3d4@xymon.invalid

This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail.

Re: Jacobs, Eric 2009-10-14 <user-02d1732f9915@xymon.invalid>

We've got some cronjob that sends mail to an Exchange account every 5
minutes and a simple perl script using Net::IMAP checking if the last
mail received is not older than some timeout. (Using Hobbit.pm from
the Debian package.)


#!/usr/bin/perl -w

use strict;
use Net::IMAP::Simple::SSL;
use Date::Parse;
use Hobbit;

my $bb = new Hobbit ({ hostname => 'smtp.xx.com', test => 'mailping'});

sub check_imap ($$$)
{
        my ($servername, $username, $password) = @_;
        my $server = new Net::IMAP::Simple::SSL ($servername);

        unless ($server->login ($username, $password)) {
                $bb->color_line ('red', "IMAP error: $servername: ". $server->errstr . "\n");
                return;
        }

        my $now = time ();
        my $max = 0;
        my $number_of_messages = $server->select ('INBOX');

        foreach my $msg ( 1..$number_of_messages ) {
                my $lines = join '', @{$server->get ($msg)};
                next unless $lines =~ /^Subject: ping (.*)/m;
                my $time = str2time ($1);
                $max = $time if $time > $max;
                if ($time < $now - 7200) {
                        $server-> delete ($msg);
                }
        }

        $server->quit();

        my $color;
        if ($max > $now - 400) {
                $color = 'green';
        } elsif ($max > $now - 700) {
                $color = 'yellow';
        } else {
                $color = 'red';
        }

        $bb->color_line ($color, "Last ping mail at $servername was received at ".scalar (localtime ($max)) ."\n");
}

check_imap ('imap.xx.com', 'hobbit', 'passwd');

$bb->send;


Christoph
-- 
user-92157dbc91bf@xymon.invalid | http://www.df7cb.de/

Generally you are at least going to see an error message come across in the MSGS column if something errors/hangs on an Exchange server. Unless you have created blanket ignore rules for the MSGS column or you don't monitor and alert off of the MSGS column, you should have seen something there for 99.9% of all Exchange issues.

There are also ways to test by sending a heartbeat email and checking it via POP3 or IMAP to insure that you receive it. There are ways to insure SMTP is up, specific services are running, etc. The important thing to remember is that monitoring looks at specific components of the system. Just like in your car, you have a gauge that tells you if you are overheated, have gas, etc. but your instrument panel may not give you any indication that there is a problem if you are wedged on top of a median without any wheels touching the ground. Same thing with monitoring. You can monitor specific aspects of the system based on your design, but there is no magic bullet that is going to catch every possible scenario - especially when it comes to the complexities of email routing, etc. 
Was this an issue with misconfiguration, bad patch/update, hardware failure, software crash?

-----Original Message-----
From: Jacobs, Eric [mailto:user-2ad24e73f3d4@xymon.invalid] Sent: Wednesday, October 14, 2009 4:26 PM
To: user-ae9b8668bcde@xymon.invalid
Subject: [hobbit] Monitoring Exchange

Apparently, last night our Exchange server stopped receiving email until
it was rebooted this morning. Everyone is up in arms. Hobbit showed
nothing unusual. Does anyone have any way to monitor Exchange? 
Eric Jacobs
Infrastructure and Operations
Information Technology Group
Phone:XXX-XXX-XXXX
Email:user-2ad24e73f3d4@xymon.invalid

Hi.

Is it possible to change the smtp test to go red on "Unexpected service response", instead of yellow?

/Johan

On Wednesday, 28 October 2009 10:38:30 Johan Sjöberg wrote:

Change the default  --checkresponse option to --checkresponse=red for bbtest-
net in the bbnet task in hobbitlaunch.cfg. See the man page for bbtest-net for 
more info.

Regards,
Buchan