The problem first appeared as an imbalance in the volume of email traffic that each Hub Transport server in one particular site were handling.

This was picked up in some routine performance monitoring. The daily email traffic for each of the five Hub Transport servers in this site for the last 30 days was calculated using message tracking log analysis, and the data used to generate this graph.

Traffic Load Pattern for Hub Transport Servers

The heavy days are week days (Monday to Friday) and the dips are the weekends.

That trend is not surprising, but what did catch my eye was the way SERVER4 is handling twice the traffic as any other server in that site. Each of the other four servers is handling roughly the same amount as each other, but SERVER4 stands out above them all.

How Exchange Hub Transport Servers Load Balance Traffic

This particular site is not internet-facing. In other words it is not responsible for email traffic going in and out of the Exchange organization.

Therefore, the Hub Transport servers in this site are primarily handling messages between mailboxes within that site, or messages to/from other sites (whether for mailboxes in the other sites, or to/from the internet via one of the internet-facing sites).

Hub Transport servers in this scenario do not need any special load balancing configuration applied. Within an Active Directory site, and for email traffic between sites, Exchange performs it’s own form of automatic load balancing.

In effect, the Exchange server will look at the list of available Hub Transport servers for the route an email message needs to take, randomize that list of servers, and then try each of them starting with the first in the list until it finds one that is able to accept the message. Unless there is a fault of some kind it will usually send to the first Hub Transport server in the randomized list.

So while it doesn’t perfectly load balance the traffic, it should do so within a pretty small degree of variation.

Checking for Hub Transport Load Spikes

One of my first thoughts was that perhaps SERVER4 is being hit with a spike of traffic at some period of the day that is causing it to record more email traffic each day. It is entirely possible that some rogue device or application has been hard-coded to directly address SERVER4 for it’s SMTP needs.

I once again used message tracking log analysis of the past 30 days to generate a graph of the average email traffic across each hour of the day.

• Calculate Hourly Email Traffic using Message Tracking Logs and Log Parser

The graph turned out to be unremarkable, no load spikes visible.

Daily email traffic load on the Hub Transport SERVER4

Checking for Top Senders

Since there is no apparent load spike, but the possibility remains that a particular host or application is sending a high volume of email throughout the day, the next angle of attack was to check the top senders (ie remote IP addresses) for email traffic through this server.

• Report Top Sender IP’s on Exchange Server 2010 using Log Parser

The results again were fairly unremarkable. But I also took a few extra moments to run the same message tracking log analysis on the other four Hub Transport servers in the site. This is where things took an interesting turn.

Where SERVER3-5 each showed an expected result for the top senders, SERVER1-2 showed interesting results. Those two servers had plenty of remote IP addresses logging hits on them, but a complete lack of any other Exchange servers in that list.

In other words, it began to appear that SERVER1 and SERVER2 were not handling any Exchange -> Exchange email traffic.

So what was all the email traffic they were logging?

SMTP Relay Traffic

Within this site we make available a DNS alias for applications and devices that need to use an SMTP service to send alerts or reports via email. This DNS alias is load balanced across both SERVER1 and SERVER2.

Now, considering that SERVER1 and SERVER2 should be processing their fair share of normal Exchange traffic, as well as the additional load of SMTP relay from applications and devices, you would expect their daily traffic graphs to be higher than the others in the site.

• Calculate Daily Email Traffic using Message Tracking Logs and Log Parser

Instead, this is what a single day’s email traffic amounts to on each Hub Transport server.

Total Email Traffic per Hub Transport Server

To confirm the suspicion that SERVER1 and SERVER2 were not processing any Exchange -> Exchange traffic at all I analysed the message tracking logs for hits from a sample of Hub Transport servers in other sites. When this data was collated the graph looked like this.

Intra-Org Traffic Per Hub Transport Server

Suspicion confirmed.

SERVER1 and SERVER2 are processing no intra-org email traffic coming in from other sites, and SERVER4 is having to pick up the slack. Although I was curious why the traffic still hadn’t evenly load balanced across the other three Hub Transport servers that was not the primary concern.

The real concern is why is this happening, and how do we fix it?

What is Causing the Intra-Org Email Traffic Imbalance?

The root cause comes back to the SMTP relay configuration that is in place. SERVER1 and SERVER2 each have an additional Receive Connector configured for SMTP relay.

At the time these were implemented the servers had no additional network interfaces available in them, so the new Receive Connectors are bound to the same interface as the Default Receive Connector.

While this is something you can get away with, it is generally recommended that you dedicate an interface to a relay connector like this for reasons that I’m about to demonstrate.

When two Receive Connectors share the same interface and IP address they use the list of remote IP addresses configured on the connectors to determine which one should handle a particular connection.

Receive Connector remote IP addresses

Generally speaking the most specific match will determine which connector accepts a connection.

The Default Receive Connector specifies a remote IP range that could be described as “everything”.

Remote IP address on Default Receive Connector

When sharing an IP address between the default connector and receive connector it is easy for the server to determine that a connection from a specific IP address that is explicitly listed in the remote IP list of the relay connector should be handled by the relay connector.

The trouble begins when administrators take a short cut and add entire subnets to the remote IP address list on the relay connector. If that subnet also contains other Exchange servers, connections from those Exchange servers will be processed by the relay connector, not by the default connector, because the subnet is considered more specific than the “everything” range that is on the default connector.

A receive connector configured for SMTP relay usage by non-Exchange systems does not have a configuration that Exchange likes when it comes to Exchange -> Exchange communications. So, the connection fails and the Exchange server will attempt to use a different Transport server.

In our case the connections to SERVER1 or SERVER2 were continually failing and SERVER4 was handling the extra load.

How to Fix the Transport Load Imbalance

With the root cause clearly identified the possible solutions were clear. We could either:

1. Configure dedicated IP addresses for the relay connectors so that there is no confusion as to which receive connector the server should use to handle Exchange traffic vs application relay traffic.
2. Remove all of the subnet entries from the remote IP address lists and replace them with only the specific IP addresses that should be permitted to relay.

Because the situation with available network interfaces had not changed we went with option 2, with a note to use dedicated interfaces for relay connectors in future designs.

The outcome is a more balanced load among the Hub Transport servers in the site, now completely in line with expectations and providing better performance and resiliency.

Balanced distribution of traffic across Hub Transport servers

Related posts:

• Report Top Sender IP’s on Exchange Server 2010 using Log Parser
• Generate SMTP Error Statistics using Log Parser and Exchange Server 2010 Protocol Logs
• Calculate Hourly Email Traffic using Message Tracking Logs and Log Parser
• Calculate Daily Email Traffic using Message Tracking Logs and Log Parser
• Reporting Exchange Server 2010 Message Tracking Event IDs with Log Parser

This article The Case of the Hub Transport Server Load Imbalance is © 2012 ExchangeServerPro.com

Get more Exchange Server tips at ExchangeServerPro.com

Well, as of right now, 2620 people have signed up to get access to more than 3 hours of free training videos.

Exchange 2010 Boot Camp video

I’m pleased that so many of you have found the training to be valuable. And amongst all of the positive feedback many of you are telling me the same thing – you want more.

More of the same quality, focussed, practical lessons on Exchange Server 2010 installation, configuration and administration.

So today I’m announcing the Exchange 2010 Boot Camp PLUS training program.

PLUS membership gets you more training modules, more advanced training scenarios, and extra access to download and watch videos offline on your computer or tablet.

Click Here to Find Out More

For a limited time I’m offering a special introductory price for those who want to sign up now before the first new training modules are released in a couple of weeks.

This introductory offer will end once the first new training modules are available, and the price will go up. But if you sign up now you’re locked in at the introductory price, and you won’t pay another dollar as new lessons are added to the training program.

I’m committed to providing quality training at an affordable price (especially in these tough economic times) so the regular price will not be super expensive, but this will be the only time this low introductory price will be offered.

Sign Up Here

By the way, there are some frequently asked questions on the page that may answer any concerns you have at this point, but if you have any other questions you can get in touch with me using this contact form.

Related posts:

• PowerShell Script to Generate Email Traffic in a Test Lab Environment
• Exchange 2010 Boot Camp Update
• Register Your Interest for the Exchange 2010 Boot Camp
• Exchange Server 2010 Training
• Free Exchange Server Technical Education Videos

This article Announcing Exchange 2010 Boot Camp PLUS is © 2012 ExchangeServerPro.com

Get more Exchange Server tips at ExchangeServerPro.com

Do you know if there is a way to stop accepted meeting room resource requests going into the meeting organiser’s calendar? This is because the PA’s request the meeting rooms on behalf of their bosses but they aren’t going to attend the meeting themselves.

The solution to this problem is in how the meeting request is created.

If the delegate opens a new meeting request for themselves and adds their manager and other attendees to it, then the delegate will also be include as the meeting organizer.

Meeting request sent by the delegate as the meeting organizer

Instead, if the delegate starts the new meeting request by first opening their manager’s calendar and selecting a block of time, the meeting request will be on behalf of the manager, and will not go into the delegate’s calendar.

Meeting request sent by delegate on behalf of their manager

Depending on the delegate settings the manager has configured the delegate can then receive all of the meeting responses from attendees and room mailboxes.

Related posts:

• Error: Outlook Was Unable to Recover Some or All of the Items in this Folder
• How to Block Non-Cached Mode Outlook Clients with Exchange 2010
• Outlook Error: The Delegates Settings Were Not Saved Correctly
• Update Rollup 3 for Exchange 2010 SP1 and Exchange 2007 SP3
• The Case of the Hub Transport Server Load Imbalance

This article How to Prevent Meeting Requests Appearing in Delegate’s Outlook Calendars is © 2012 ExchangeServerPro.com

Get more Exchange Server tips at ExchangeServerPro.com

I was wondering, is there anyway to make only a specific group being able to book a specific conference room? We have mailboxes set up and is working perfectly, but we want only one specific section/unit to be able to book that conference room, is that possible?

Yes, this can be configured on room mailboxes quite easily.

In the Properties of the room mailbox go to the Resource In-Policy Requests tab and configure selected recipients who are permitted to book the room.

When a person who is not a in that selected recipients list tries to book the room they will receive a “Declined” message similar to this.

Related posts:

• Show Full Free/Busy Details for Exchange Server 2010 Room and Resource Mailboxes
• How to Find Available Meeting Rooms
• Exchange Server 2010 Room Mailboxes Step by Step Guide
• The Case of the Hub Transport Server Load Imbalance
• Announcing Exchange 2010 Boot Camp PLUS

This article Restricting Room Mailbox Bookings to Specific Groups in Exchange Server 2010 is © 2012 ExchangeServerPro.com

Get more Exchange Server tips at ExchangeServerPro.com

This information is useful for scenarios such as checking whether your outbound mail may experiencing a high rate of failure, or discovering whether someone is continually trying to relay through your email server (in which case you could then look at the top sender IP addresses to investigate further).

Remember that protocol logging is not enabled by default on Exchange 2010, and must be enabled on a per-connector basis if you want to use it.

For SMTP error statistics we can use Log Parser to check the protocol logs for instances of SMTP status codes starting with “5″ (which are permanent failures). The Log Parser query for this is as follows:

SELECT data as [Status Code],
	Count(*) as Hits
FROM *.log
WHERE data LIKE '5%'
GROUP BY data
ORDER BY Hits DESC

When run from the folder containing the protocol logs it will be as follows:

"C:\Program Files (x86)\Log Parser 2.2\logparser.exe" "SELECT data as [Status Code],Count(*) as Hits FROM *.log WHERE data LIKE '5%' GROUP BY data ORDER BY Hits DESC" -i:CSV -nSkipLines:4 -rtp:-1

This will give you output similar to this:

Status Code                                       Hits
------------------------------------------------- ----
500 5.3.3 Unrecognized command                    3632
501 5.1.3 Invalid address                         1411
501 5.1.7 Invalid address                         200
554 5.4.6 Hop count exceeded - possible mail loop 100
503 5.5.2 Send hello first                        20
503 5.5.2 Sender already specified                4
501 5.5.4 Unrecognized parameter                  2
504 5.7.4 Unrecognized authentication type        1

Statistics:
-----------
Elements processed: 13113294
Elements output:    8
Execution time:     150.15 seconds (00:02:30.15)

You can also report on the number of SMTP errors occurring each day to get a baseline, which will help when you need to identify whether a sudden spike in SMTP errors has occurred. This Log Parser query will be as follows:

SELECT TO_LOCALTIME(TO_TIMESTAMP(EXTRACT_PREFIX(TO_STRING([#Fields: date-time]),0,'T'), 'yyyy-MM-dd')) AS Date,
	COUNT(*) AS Hits
FROM *.log
WHERE (data LIKE '5%')
GROUP BY Date
ORDER BY Date ASC

When run from the protocol log directory it will be as follows:

"C:\Program Files (x86)\Log Parser 2.2\logparser.exe" "SELECT TO_LOCALTIME(TO_TIMESTAMP(EXTRACT_PREFIX(TO_STRING([#Fields: date-time]),0,'T'), 'yyyy-MM-dd')) AS Date, COUNT(*) AS Hits from *.log where (data LIKE '5%') GROUP BY Date ORDER BY Date ASC" -i:CSV -nSkipLines:4 -rtp:-1

And of course, provided you have the Office Web Components installed, you can generate a graph of this same data.

"C:\Program Files (x86)\Log Parser 2.2\logparser.exe" "SELECT TO_LOCALTIME(TO_TIMESTAMP(EXTRACT_PREFIX(TO_STRING([#Fields: date-time]),0,'T'), 'yyyy-MM-dd')) AS Date, COUNT(*) AS [SMTP Errors] INTO DailySMTPErrors.gif from *.log where (data LIKE '5%') GROUP BY Date ORDER BY Date ASC" -i:CSV -nSkipLines:4 -chartType:Column3D

Which will give you a graph similar to this:

Related posts:

• The Case of the Hub Transport Server Load Imbalance
• Report Top Sender IP’s on Exchange Server 2010 using Log Parser
• Calculate Hourly Email Traffic using Message Tracking Logs and Log Parser
• Calculate Daily Email Traffic using Message Tracking Logs and Log Parser
• Reporting Exchange Server 2010 Message Tracking Event IDs with Log Parser

This article Generate SMTP Error Statistics using Log Parser and Exchange Server 2010 Protocol Logs is © 2012 ExchangeServerPro.com

Get more Exchange Server tips at ExchangeServerPro.com

There are two different log sets that you can use for this:

• Protocol logs
• Message Tracking logs

One of the best ways to describe the difference between these is that protocol logs will capture SMTP connections that may or may not make it all the way in to the Transport pipeline. For example a connection from a spammer that gets blocked by IP filtering will appear in the protocol logs but not the message tracking logs.

The detail captured in a protocol log will look a lot like what you would see if you were manually testing SMTP via telnet on a server.

Message tracking logs will capture messages that get processed through the Transport pipeline, and capture information such as message submission and delivery rather than the SMTP conversation that protocol logging reflects.

Message tracking is also turned on by default and is set per-server, whereas protocol logging is not turned on by default and is set per-connector.

For this demonstration I’ll be using my Edge Transport server simply because it has slightly more interesting data since it receives a lot of connections from the internet.

Get Top Sender IP’s from Protocol Logs with Log Parser

To get the top sender IP’s from the protocol logs we can use this Log Parser query.

SELECT EXTRACT_PREFIX(remote-endpoint,0,':') as IP,
	REVERSEDNS(EXTRACT_PREFIX(remote-endpoint,0,':')) as Name,
	Count(*) as Hits
FROM *.log
WHERE data LIKE '%EHLO%'
GROUP BY IP
ORDER BY Hits DESC

When run from the folder containing the protocol logs (in this case C:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs\ProtocolLog\SmtpReceive) it looks like this:

"C:\Program Files (x86)\Log Parser 2.2\logparser.exe" "SELECT EXTRACT_PREFIX(remote-endpoint,0,':') as IP,REVERSEDNS(EXTRACT_PREFIX(remote-endpoint,0,':')) as Name,Count(*) as Hits from *.log WHERE data LIKE '%EHLO%' GROUP BY IP ORDER BY Hits DESC" -i:CSV -nSkipLines:4 -rtp:-1

This will give you output similar to this:

IP              Name                                    Hits
--------------- --------------------------------------- ----
83.222.31.220   v8622.vps.masterhost.ru                 52
204.13.248.72   mho-02-ewr.mailhop.org                  12
50.78.250.97    dcmail.designercabinetry.com            9
10.1.1.21       ho-ex2010-mb1.exchangeserverpro.net     8
64.61.92.26     static-64-61-92-26.isp.broadviewnet.net 7
217.108.179.228 mailhost.el-internationale.com          7
69.60.118.117   mail1.ambr.com.br                       4
10.1.1.22       ho-ex2010-mb2.exchangeserverpro.net     4
95.154.196.147  95.154.196.147                          4
118.22.2.202    pc2.land-ho-unet.ocn.ne.jp              3
187.108.193.223 cloud.newmediahost.com.br               2
109.169.77.169  109.169.77.169                          2
59.106.64.208   ns1.uranaikan.info                      2
204.13.248.71   mho-01-ewr.mailhop.org                  2
78.129.222.16   78.129.222.16                           2
199.119.76.15   mail.seoauditions.com                   1

Statistics:
-----------
Elements processed: 3359
Elements output:    16
Execution time:     17.41 seconds

This part of the query string is important to note:

WHERE data LIKE '%EHLO%'

This means that only those log entries where the EHLO occurred will be counted in the stats that Log Parser outputs. If you leave it out you’ll see a “Hit” for every log entry a remote IP generated. Depending on how “chatty” that particular SMTP conversation was it may skew the results a little. However since we’re looking more for indicative numbers rather than precise numbers it doesn’t matter which way you choose to go (at least not to me).

Get Top Sender IP’s from Message Tracking Logs with Log Parser

For message tracking logs the syntax is a little different because the field names in the log files are different.

SELECT client-ip as IP,
	REVERSEDNS(client-ip) as Name,
	Count(*) as Hits
FROM *.log
WHERE (event-id='RECEIVE')
GROUP BY IP
ORDER BY Hits DESC

When run from the folder containing the message tracking logs (in this case C:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs\MessageTracking) it will look like this:

"C:\Program Files (x86)\Log Parser 2.2\logparser.exe" "SELECT client-ip as IP,REVERSEDNS(client-ip) as Name,Count(*) as Hits from *.log WHERE (event-id='RECEIVE') GROUP BY IP ORDER BY Hits DESC" -i:CSV -nSkipLines:4 -rtp:-1

If you get too much output you can limit it to the top X results by modifying the query slightly:

"C:\Program Files (x86)\Log Parser 2.2\logparser.exe" "SELECT TOP 20 client-ip as IP,REVERSEDNS(client-ip) as Name,Count(*) as Hits from *.log WHERE (event-id='RECEIVE') GROUP BY IP ORDER BY Hits DESC" -i:CSV -nSkipLines:4 -rtp:-1

This will give you output similar to this:

IP              Name                                 Hits
--------------- ------------------------------------ ----
204.93.210.179  mariajunco.com                       32
10.1.1.22       ho-ex2010-mb2.exchangeserverpro.net  23
216.151.172.180 hosted.airvm.net                     22
10.1.1.21       ho-ex2010-mb1.exchangeserverpro.net  22
83.142.48.139   83.142.48.139                        17
67.215.235.199  67.215.235.199.static.quadranet.com  13
109.169.76.124  109.169.76.124                       10
109.169.55.146  109.169.55.146                       10
109.169.62.15   109.169.62.15                        10
109.169.60.137  109.169.60.137                       9
173.254.208.113 173.254.208.113.static.quadranet.com 9
59.106.64.208   ns1.uranaikan.info                   8
72.11.150.131   72.11.150.131.static.quadranet.com   7
109.169.73.116  109.169.73.116                       7
109.169.55.135  109.169.55.135                       7
189.39.9.214    mail3.ibcbrasil.com.br               5
204.13.248.72   mho-02-ewr.mailhop.org               5
109.169.87.100  109.169.87.100                       4
109.169.84.105  109.169.84.105                       4
169.232.46.177  out-58.smtp.ucla.edu                 3

Statistics:
-----------
Elements processed: 1018
Elements output:    20
Execution time:     74.03 seconds (00:01:14.03)

You can use this information in a lot of situations such as when investigating load issues, or planning to decommission servers

Related posts:

• The Case of the Hub Transport Server Load Imbalance
• Generate SMTP Error Statistics using Log Parser and Exchange Server 2010 Protocol Logs
• Calculate Hourly Email Traffic using Message Tracking Logs and Log Parser
• Calculate Daily Email Traffic using Message Tracking Logs and Log Parser
• Reporting Exchange Server 2010 Message Tracking Event IDs with Log Parser

This article Report Top Sender IP’s on Exchange Server 2010 using Log Parser is © 2012 ExchangeServerPro.com

Get more Exchange Server tips at ExchangeServerPro.com

Consider the scenario where a room is booked, and perhaps another person wants to contact existing meeting organizers to ask if they can remove a booking to make room for a more important one, but the free/busy information (as seen in the Outlook Scheduling Assistant) doesn’t indicate who made the bookings.

This is caused by the default permissions on the mailbox’s calendar. These default permissions are set to show only the availability information (eg free, busy, tentative) but not any other details.

In the calendar permissions (if you were modifying them via Outlook) it would look like this.

If viewed in the shell it with Get-MailboxFolderPermission it would appear like this.

[PS] C:\>Get-MailboxFolderPermission homeetingroom1:\Calendar

RunspaceId   : 8706cde4-2cb5-4519-9a46-a46fcc0c450c
FolderName   : Calendar
User         : Default
AccessRights : {AvailabilityOnly}
Identity     : Default
IsValid      : True

If you modified the permissions using Outlook the new permission level of Reviewer would allow other users to see more details about existing meetings.

You can apply that same permission in the Exchange Management Shell using the Set-MailboxFolderPermission cmdlet (note: Set-MailboxFolderPermission modifies an existing entry, whereas Add-MailboxFolderPermission would be used to add a new entry to the permissions).

Set-MailboxFolderPermission homeetingroom1:\Calendar -User Default -AccessRights Reviewer

The results can be seen in the Get-MailboxFolderPermission output.

[PS] C:\>Get-MailboxFolderPermission homeetingroom1:\Calendar

RunspaceId   : 8706cde4-2cb5-4519-9a46-a46fcc0c450c
FolderName   : Calendar
User         : Default
AccessRights : {Reviewer}
Identity     : Default
IsValid      : True

RunspaceId   : 8706cde4-2cb5-4519-9a46-a46fcc0c450c
FolderName   : Calendar
User         : Anonymous
AccessRights : {None}
Identity     : Anonymous
IsValid      : True

When creating a new meeting request users are now able to see more details about the meeting organizer.

You can modify all the default permissions on Room mailboxes with the following commands in the Exchange Management Shell.

[PS] C:\>$rooms = Get-Mailbox -RecipientTypeDetails RoomMailbox
[PS] C:\>$rooms | %{Set-MailboxFolderPermission $_":\Calendar" -User Default -AccessRights Reviewer}

Related posts:

• How to Find Available Meeting Rooms
• Exchange Server 2010 Room Mailboxes Step by Step Guide
• Restricting Room Mailbox Bookings to Specific Groups in Exchange Server 2010
• Exchange 2007 Room Mailbox Not Automatically Accepting Bookings
• Exchange 2010 Shared Calendar Permissions and Nested Groups

This article Show Full Free/Busy Details for Exchange Server 2010 Room and Resource Mailboxes is © 2012 ExchangeServerPro.com

Get more Exchange Server tips at ExchangeServerPro.com

Consider a scenario where the mailbox database is active in a site with a single mailbox server, and has passive copies in a site with two mailbox servers. The two mailbox servers hosting passive copies need reseeding due to some fault that has occurred.

Exchange Server 2010 multi-site DAG

If the reseed was commenced for both servers it would effectively mean the data was replicated across the WAN twice, which may not be ideal depending on the available bandwidth.

Exchange 2010 database reseed from active copy

This is because by default the database copy update operation uses the active copy of the database as the source. This would be the case if you ran the Update-MailboxDatabaseCopy cmdlet with only the mandatory parameters.

However if you use the console wizard to perform the operation you’ll notice an option to choose the source for the reseed.

Choosing a database reseed source in Exchange 2010

This allows you to perform the reseed more efficiently in terms of network bandwidth by reseeding one server first, and then using that passive copy as the source for the second reseed operation.

Exchange 2010 DAG reseed from passive copy

This can also be performed using Update-MailboxDatabaseCopy with the -SourceServer parameter, for example:

Update-MailboxDatabaseCopy MB-HO-01\br-ex2010-mb -SourceServer ho-ex2010-mb2

An alternative would be to reseed one server first, then move the active mailbox database copy to that server before commencing the second database reseed in that site.

Related posts:

• How to Install Updates on Exchange Server 2010 Database Availability Groups
• Exchange 2010: Are Passive Database Copies Included in Backups of DAG Members?
• Exchange Recovery: Failed DAG Member in Exchange Server 2010
• How to Reseed a Failed Mailbox Database Copy in Exchange Server 2010
• Exchange Server 2010 Database Availability Group Installation Step by Step

This article Managing the Replication Source for Exchange Server 2010 Mailbox Database Reseed is © 2012 ExchangeServerPro.com

Get more Exchange Server tips at ExchangeServerPro.com

To be able to identify this type of problem you should first know what your normal email traffic patterns look like. You can find this information by using Log Parser to search through your Exchange server’s message tracking logs.

There are two ways to look at this traffic.

• As a total of the traffic per hour for all days combined
• As the traffic per hour for each separate day

Total Email Traffic Per Hour for All Days Combined

First let’s look at the Log Parser query to calculate the total email traffic per hour for all days combined.

SELECT QUANTIZE(TO_LOCALTIME(TO_TIMESTAMP(EXTRACT_PREFIX(TO_STRING(EXTRACT_SUFFIX([#Fields: date-time],0,'T')),0,'.'), 'hh:mm:ss')),3600) AS Hour,
	COUNT(*) AS Messages
FROM *.log
WHERE (event-id='RECEIVE')
GROUP BY Hour
ORDER BY Hour ASC

When run from the folder where the message tracking logs are located the full syntax is:

"C:\Program Files (x86)\Log Parser 2.2\logparser.exe" "SELECT QUANTIZE(TO_LOCALTIME(TO_TIMESTAMP(EXTRACT_PREFIX(TO_STRING(EXTRACT_SUFFIX([#Fields: date-time],0,'T')),0,'.'), 'hh:mm:ss')),3600) AS Hour, COUNT(*) AS Messages from *.log where (event-id='RECEIVE') GROUP BY Hour ORDER BY Hour ASC" -i:CSV -nSkipLines:4 -rtp:-1

This will return results similar to these:

Hour     Messages
-------- --------
00:00:00 408
01:00:00 415
02:00:00 363
03:00:00 347
04:00:00 273
05:00:00 327
06:00:00 403
07:00:00 450
08:00:00 590
09:00:00 574
10:00:00 637
11:00:00 810
12:00:00 612
13:00:00 597
14:00:00 700
15:00:00 789
16:00:00 821
17:00:00 448
18:00:00 396
19:00:00 527
20:00:00 346
21:00:00 476
22:00:00 348
23:00:00 448

Statistics:
-----------
Elements processed: 106823
Elements output:    24
Execution time:     0.58 seconds

You can also generate graphs straight from Log Parser (if you have the required Office Web Components installed) with slightly different syntax like this:

"C:\Program Files (x86)\Log Parser 2.2\logparser.exe" "SELECT QUANTIZE(TO_LOCALTIME(TO_TIMESTAMP(EXTRACT_PREFIX(TO_STRING(EXTRACT_SUFFIX([#Fields: date-time],0,'T')),0,'.'), 'hh:mm:ss')),3600) AS Hour, COUNT(*) AS [Messages per Hour] INTO HourlyTraffic.gif from *.log where (event-id='RECEIVE') GROUP BY Hour ORDER BY Hour ASC" -i:CSV -nSkipLines:4 -chartType:Column3D

That Log Parser query will generate a column graph for you similar to this.

Total Email Traffic Per Hour for Each Separate Day

If you’d rather see the hourly traffic for each separate day you can use the following Log Parser query that handles the timestamps slightly differently.

SELECT TO_LOCALTIME(QUANTIZE(TO_TIMESTAMP(TO_STRING(EXTRACT_PREFIX([#Fields: date-time],0,'.')), 'yyyy-MM-ddThh:mm:ss'),3600)) AS Hour,
	COUNT(*) AS Messages
FROM *.log
WHERE event-id='RECEIVE'
GROUP BY Hour
ORDER BY Hour ASC

The full Log Parser command when run from the folder containing the message tracking logs is as follows:

"C:\Program Files (x86)\Log Parser 2.2\logparser.exe" "SELECT TO_LOCALTIME(QUANTIZE(TO_TIMESTAMP(TO_STRING(EXTRACT_PREFIX([#Fields: date-time],0,'.')), 'yyyy-MM-ddThh:mm:ss'),3600)) AS Hour, COUNT(*) AS Messages from *.log where event-id='RECEIVE' GROUP BY Hour ORDER BY Hour ASC" -i:CSV -nSkipLines:4 -rtp:-1

This will generate a lot of output depending on the amount of log retention you have configured.

Hour                Messages
------------------- --------
2012-04-05 10:00:00 48
2012-04-05 11:00:00 77
2012-04-05 12:00:00 35
2012-04-05 13:00:00 74
2012-04-05 14:00:00 84
2012-04-05 15:00:00 86
2012-04-05 16:00:00 79
2012-04-05 17:00:00 35
2012-04-05 18:00:00 44
2012-04-05 19:00:00 24
2012-04-05 20:00:00 41
2012-04-05 21:00:00 19
2012-04-05 22:00:00 40
2012-04-05 23:00:00 59
2012-04-06 00:00:00 28
2012-04-06 01:00:00 42
2012-04-06 02:00:00 22
2012-04-06 03:00:00 31
2012-04-06 04:00:00 16
2012-04-06 05:00:00 31
2012-04-06 06:00:00 40
2012-04-06 07:00:00 22
2012-04-06 08:00:00 84
2012-04-06 09:00:00 77
2012-04-06 10:00:00 46
2012-04-06 11:00:00 84
....

As with other Log Parser results you can output this one to a graph as well (again, providing that you have the Office Web Components installed).

Because of the amount of data a line graph seems more appropriate than a column graph. The default size of a graph generated by Log Parser is 640×480, but you can use the -groupsize parameter to set a custom width x height that suits the amount of data being included.

"C:\Program Files (x86)\Log Parser 2.2\logparser.exe" "SELECT TO_LOCALTIME(QUANTIZE(TO_TIMESTAMP(TO_STRING(EXTRACT_PREFIX([#Fields: date-time],0,'.')), 'yyyy-MM-ddThh:mm:ss'),3600)) AS Hour, COUNT(*) AS Messages INTO DailyTrafficPerHour.gif from *.log where event-id='RECEIVE' GROUP BY Hour ORDER BY Hour ASC" -i:CSV -nSkipLines:4 -chartType:Line -groupsize:1024x480

Related posts:

• Calculate Daily Email Traffic using Message Tracking Logs and Log Parser
• Reporting Exchange Server 2010 Message Tracking Event IDs with Log Parser
• The Case of the Hub Transport Server Load Imbalance
• Generate SMTP Error Statistics using Log Parser and Exchange Server 2010 Protocol Logs
• Report Top Sender IP’s on Exchange Server 2010 using Log Parser

This article Calculate Hourly Email Traffic using Message Tracking Logs and Log Parser is © 2012 ExchangeServerPro.com

Get more Exchange Server tips at ExchangeServerPro.com

• Part 1 – How to Send SMTP Email Using PowerShell
• Part 2 - How to Add a Message Body to Emails Sent from Scripts
• Part 3 - How to Add a HTML Message Body to Emails Sent from Scripts
• Part 4 - How to Create Formatted HTML Output from Scripts

I also shared with you a script that can be used to check Exchange Server 2010 database backups and alert you to any that have not had a recent backup.

Now it’s time to bring all of that information together and demonstrate how you can set up an automated database backup alert email for your Exchange Server 2010 environment.

The two components of this are:

• The PowerShell script itself (we’ll use the one mentioned earlier but with some modifications to email-enable it)
• Task Scheduler for automatically running the script each day

Script for Exchange Server 2010 Database Backup Email Alerts

To email-enable the script I’ve made just a few modifications. The original script used this conditional logic to display the report in the PowerShell window.

#If alert flag is true output the report
if ($alertflag -eq $true )
{
	Write-Host "The following databases have not been backed up in" $threshold "hours."
	$alerts | ft -AutoSize
}
else
{
	Write-Host "No backup alerts required."
}

To change this to send an email alert we can use this code instead:

#If alert flag is true send the email alert
if ($alertflag -eq $true )
{
	#HTML styles for nice formatting
        $style = "<style>BODY{font-family: Arial; font-size: 10pt;}"
	$style = $style + "TABLE{border: 1px solid black; border-collapse: collapse;}"
	$style = $style + "TH{border: 1px solid black; background: #CC0000; padding: 5px; color: #FFFFFF;}"
	$style = $style + "TD{border: 1px solid black; padding: 5px; }"
	$style = $style + "</style>"

        #SMTP options for sending the report email
	$smtpServer = "ho-ex2010-caht1.exchangeserverpro.net"
	$smtpFrom = "reports@exchangeserverpro.net"
	$smtpTo = "administrator@exchangeserverpro.net"
	$messageSubject = "Exchange Backup Alerts"

        $intro = "The following databases have not been backed up in " + $threshold + " hours.<BR><BR>"
	$report = $alerts | ConvertTo-Html -Fragment

	#Get ready to send email message
	$message = New-Object System.Net.Mail.MailMessage $smtpfrom, $smtpto
	$message.Subject = $messageSubject
	$message.IsBodyHTML = $true
	$message.Body = ConvertTo-Html -Body "$intro $report" -Head $style

	#Send email message
	$smtp = New-Object Net.Mail.SmtpClient($smtpServer)
	$smtp.Send($message)

}

If any parts of that don’t make sense just refer to the previous tutorials on sending email with PowerShell.

Download the script file here: Get-DailyBackupAlerts.ps1 (downloaded 197 times so far)

If you’re using this script in your environment you will need to change the SMTP options to suit.

#SMTP options for sending the report email
$smtpServer = "ho-ex2010-caht1.exchangeserverpro.net"
$smtpFrom = "reports@exchangeserverpro.net"
$smtpTo = "administrator@exchangeserverpro.net"
$messageSubject = "Exchange Backup Alerts"

Save the script as Get-DailyBackupAlerts.ps1 in a folder called C:\Scripts on the server where you would like it to run each day. Note that the script depends on the Exchange Server 2010 management tools, so they will also need to be installed.

Using Task Scheduler to Run PowerShell Scripts

Now we need to configure the scheduled task in Task Scheduler. On a Windows Server 2008 server you’ll find this in the Administrative Tools. After you’ve launched Task Scheduler click on Create Task.

Give the task a meaningful name, set it to Run whether user is logged on or not, and also if necessary change the user account that it will run as (you may wish to create a special Exchange administrative account with a strong password for running these types of scripts).

On the Triggers tab click new and add a Weekly trigger for each of your normal business days that you want the script to run (eg Monday – Friday). Set the Start time to suit your normal backups finishing time and your own work schedule.

On the Actions tab click New and add an action of Start a program. Configure the program of powershell.exe and the arguments -command “c:\scripts\get-dailybackupalerts.ps1″

Click OK to finish creating the new task. You will be prompted to enter the credentials for the account that you configured the task to run as.

Now you can test the scheduled task by right-clicking on it in the Task Scheduler Library and choosing Run.

Assuming you have some databases that have not backed up recently you should receive an alert email shortly after running the scheduled task.

Note: if your backups are all up to date you can test the script by changing the $threshold variable to something very low such as 1.

Download the script file here: Get-DailyBackupAlerts.ps1 (downloaded 197 times so far)

Related posts:

• PowerShell Script: Check Exchange 2010 Database Backups
• PowerShell Script: Check Exchange Mailbox Database Last Backup Time
• Avoid Running Out of Transaction Log Disk Space on Exchange Servers
• Using Test-Mailflow with Exchange 2003 Servers
• How to Health Check an Exchange 2010 Mailbox Server

This article How to Set Up an Automated Exchange 2010 Database Backup Alert Email is © 2012 ExchangeServerPro.com

Get more Exchange Server tips at ExchangeServerPro.com