NT Eventlog Test

kemeel · Post by **kemeel** » Mon Mar 03, 2008 7:31 am

Hi,

I have a problem with a test which tests the Mailbox Store.

In the Eventlog (application log) I get the next message;

Source: MSExchangeIS Mailbox
Category: General
Event ID: 9688
Type: Warning

Description:
Exchange store 'First Storage Group\Mailbox Store (HRLIS02)': The logical size of this database (the logical size equals the physical size of the .edb file and the .stm file minus the logical free space in each) is 43 GB. This database size is approaching the size limit of 45 GB.

43 GB is no problem, I want that HOSTMONITOR sends me an warning if the size reaches 44 GB.

How can I do that?

Can someone help me?

KS-Soft Europe · Post by **KS-Soft Europe** » Mon Mar 03, 2008 7:47 am

Since version 7.0, string comparison operator 'in' is supported by "advanced actions" evaluator. So, you may use "advanced mode" action with the following expression:

Code: Select all

('%SimpleStatus%'=='DOWN') and (%Recurrences%==1) and ('is 44 GB' in '%Reply%')

Please, read the following article for details: http://www.ks-soft.net/hostmon.eng/mfra ... ncedaction

Regards,
Max

kemeel · Post by **kemeel** » Mon Mar 03, 2008 8:05 am

I am downloading the 7.10 version right now

kemeel · Post by **kemeel** » Mon Mar 03, 2008 8:20 am

Which Test do i need?

All other test are working, but my collegeaus and I, do not get out of this one.

Can you help me?

KS-Soft Europe · Post by **KS-Soft Europe** » Mon Mar 03, 2008 8:29 am

At first, you have to setup "NT Event log" test to catch Event ID: 9688. After that, you have to assign an alert profile with "Send email" action to this test. In "Action Properties" window for this "Send email" action, you have to select "advanced mode" from "Condition to start action" dropdown and paste the code into the appearred input box.

Please, read the following article for details: http://www.ks-soft.net/hostmon.eng/mfra ... ncedaction

Regards,
Max

kemeel · Post by **kemeel** » Mon Mar 03, 2008 8:56 am

I did set up a test to catch event ID: 9688

Like this:
First screen

Computer: HRLIS02
Log: Application
Event Source: MSExchangeIS Mailbox Store

Then I click Alert Condition.
I set this like:

Then I go to the Alerts Properties.

Condition to start action: Advanced mode
and then I fill in the sentence you gave me.

I think I am doing something wrong with that sentence.

Can you tell me what i have to fill in the the following window?
(and offcourse what I am doing wrong i other screens)

I read the document, (for the most), but I cannot find this.

Kind regards

KS-Soft Europe · Post by **KS-Soft Europe** » Mon Mar 03, 2008 9:23 am

kemeel wrote:I think I am doing something wrong with that sentence.

Everything looks corect, except thing that you have changed the value from 44 to 43.

kemeel wrote:Can you tell me what i have to fill in the the following window?

This window just helps you to compose the expression. I gave you "cooked" expression, so you do not need to invoke this window at all. You may find more information regarding "Expression editor" here: http://www.ks-soft.net/hostmon.eng/mfra ... predit.htm

kemeel wrote:(and offcourse what I am doing wrong i other screens)

So, as I understand, you are unable to get it to work, right? Please note: HostMonitor changes "Nt Event Log's" test status to "Bad" only when it has found NEW event(s) that satisfies all specified requirements. If, after the next probe, the monitor does not find a new "Bad" event, it changes the test status to "Ok". This means you have to force your Exchange server to generate this event again in order to test "Nt Event Log" test method.

Beside that, I see you have setup HostMonitor to check the event log on remote system. Please, ensure HostMonitor is able to retrieve correct event description from remote machine. I would suggest you to setup one more "Send Email" action in standard mode and use following expressions within the email body: http://www.ks-soft.net/hostmon.eng/mfra ... .htm#macro
==================================
the following variables have sense for "NT Event Log" test only, they represent parameters of the last "Bad" event detected:
%NTEventSource% Event source. Identifies the software that logged the event
%NTEventComp% Name of the computer where the event occurred
%NTEventTime% Time of the event
%NTEventType% Type of the event
%NTEventID% Event identifier
%NTEventText% Event description
%NTEventUser% Represents the user name if an event is attributed to a specific user
==================================

If you see "Message not found" instead of the event description, it means HostMonitor is unable to retrieve event description from remote host. In this case, please let me know. I provide you with an information how to fix this issue.

Regards,
Max

KS-Soft Europe · Post by **KS-Soft Europe** » Mon Mar 03, 2008 1:45 pm

On the other hand, I would suggest you to use "WMI" test method to monitor Exchange.
http://www.ks-soft.net/hostmon.eng/mfra ... ts.htm#wmi
In particular, for monitoring mailbox size, you may use query, like the following: Select Size From Exchange_Mailbox Where MailboxDisplayName='SomeMailBoxName'

To make it work, you should specify "root\\MicrosoftExchangeV2" into "Name space" box in "Test Properties" window.

Please, read the following article for details: http://www.microsoft.com/technet/script ... _wmi1.mspx

Regards,
Max

kemeel · Post by **kemeel** » Fri Mar 07, 2008 5:23 am

I am still looking for the sollution

The WMI features I am not known with....

I need the real size of the priv1.edb and priv1.stm file.

They are together 45 Gb. But the actual size of them is smaller. Who do I make a test for this?

KS-Soft Europe · Post by **KS-Soft Europe** » Fri Mar 07, 2008 5:32 am

kemeel wrote:The WMI features I am not known with....

You should not know much about WMI. You just should setup "WMI" test method with the following query against server, where Exchange is running:

Code: Select all

Select Size From Exchange_Mailbox Where MailboxDisplayName='SomeMailBoxName'

kemeel wrote:I need the real size of the priv1.edb and priv1.stm file.
They are together 45 Gb. But the actual size of them is smaller. Who do I make a test for this?

If you need to check size of the file , you may use "Folder/File Size" test method.
http://www.ks-soft.net/hostmon.eng/mfra ... tm#dirsize

Also please take a look at the following article. Probably, it helps you to solve the problem: http://www.ks-soft.net/cgi-bin/phpBB/vi ... php?t=3037

Regards,
Max

meppyman · Post by **meppyman** » Sun Sep 06, 2009 7:07 am

Actually I am pretty sure that WMI query will just let you get the size of a single mailbox at a time.

I think what you are asking for here (and what I need) is to know the free space of the store after online defragmentation. This information when used in conjunction with the physical size of the files can help you understand when the store might reach the maximum size and dismount.

It's a shame that MS don't have a WMI or a PerfMon value for this.

App Event log event id 1221 is what to look for. I just need to work out how to take that event description and parse it so that it finds the free space number and then does some logic check for the alert. I think there is some advanced method for this but this is only my first week of testing HM so I am yet to work that out.