Home | Site Map | Cisco How To |  Net How To | Wireless | Search | Forums | Services | Setup Guide | Careers | About Us | Contact Us|

Log Management 101 for Exchange 2010

As any systems admin will tell you, keeping an eye on system logs is a very important part of monitoring the overall health and wellbeing of both the operating system and the applications running on a server. As any systems admin will quietly admit (off the record and after hours) keeping an eye on system logs is simply something they don’t have time to do, and consulting the logs only happens during troubleshooting. Of course, that puts log checking in the reactive phase, after a problem has already occurred. We want to move this into a proactive phase, so that we can detect minor issues and resolve them before they become major headaches. In this post, we’re going to take a look at the kinds of events you want to watch for, and discuss some options for automating that process, which can save you time, money, and heartburn.

Exchange 2010 logs a ton of information in several places within the logs you can see in Event Viewer. In a smaller environment, simply parsing these logs from time to time might be enough for you to catch issues before they impact users, but if your environment is small enough for you to only need one or two servers, your staff is probably too small for you to have the time to do this regularly. Let’s look at three strategies for monitoring event logs to see which way can work best for your environment.

Manual checks

In a smaller shop with only one or two servers, you could simply check the logs each day for warnings and errors. The key here is consistency, which means you either need to do it first thing in the morning, right after you get back from lunch, or right before you leave for the day. Unless you get in before everyone else, you probably want to opt for the right-after-lunch approach, so that you can do this without being disturbed. Log on to each of your Exchange servers, and parse the logs for anything that indicates a problem. Check the system log for operating system events, and the following locations for Exchange specific issues; the application log, and the Windows->Exchange->High Availability, MailboxDatabaseFailureItem, and Troubleshooter logs. Watch out for errors, but take a look at warnings too. Situations like low disk space start out as warnings to give you time to increase space before they become errors that impact mail flow.

Pros: Easy, free
Cons: Not scalable, requires discipline to ensure it is done daily

Log forwarding

You can save a little time by forwarding event logs from each of your servers to a central collector computer. The steps to do this are covered in this TechNet article, and are fairly straightforward. This way, you need only consult the logs of a single machine, which could even be your desktop (as long as it stays powered on and connected to the network 24x7.) Beware however; there are several pitfalls to this approach. If a forwarding server stops forwarding for any reason, nothing will be logged in the collector. No news is definitely not good news here, but you have to notice that the server has not sent anything. Second, unless the collector has Exchange installed as well, the event descriptions will not contain useful information. You’ll need to work on memorizing event IDs that are important.

Pros: Easy, free, slightly scalable
Cons: Failures could be missed and forwarded events may not contain all the data you need to understand the problem.

Central log monitoring

Several companies sell event log monitoring applications that make the process of log management automated and easy. You install the software on a central server, and can either configure the software to pull logs from other systems, or install an agent on each system you want to push to the central server. The application can aggregate and summarize the logs, and provide summaries and alerts through email. Some are flexible enough to give you daily or weekly summaries of less critical events, while emailing you instantly for events that require immediate attention. Better apps can filter out the noise and take actions (such as firing scripts) based on rules you create, automating some of your more common tasks.

Pros: Fully scalable, centralized log management, reporting, and archiving, can automate repetitive tasks
Cons: Costs money, though typically less than the labor costs of manually performing log management

I definitely recommend the central log monitoring approach. If you consider the time it would take you daily to review the logs and add up the cost of that time over a year, you definitely are spending more on manual approaches. When you consider the cost of an outage, anything that proactively alerts you to a problem before it impacts users gives you an immediate ROI. Most log management applications are able to handle far more than just Exchange, giving you a tool that can help you with your entire infrastructure.

If you have to go with the manual for forwarding approach, here’s a table that lists some of the most important Exchange events:

This guest post was provided by Ed Fisher on behalf of GFI Software Ltd. GFI is a leading software developer that provides a single source for network administrators to address their network security, content security and messaging needs. More information: Event log management.

All product and company names herein may be trademarks of their respective owners.

Post your questions, comments, feedbacks and suggestions

Contact a consultant

Related Topics

Bob Lin Photography services

Real Estate Photography services