SNMP Informant Knowledge-base

Article: 2004-002
Product: SNMP Informant - Exchange Application Plus Pack
Subject: Monitoring Exchange 2000/2003

This article is intended to help SNMP Informant users with the monitoring of Exchange Server 2000/2003.

First of all, it is important to note that Exchange 2000/2003 differs from Exchange 5.5 in a significant way.  First, it uses the SMTP service from the Host OS (Windows 2000/2003) to send.  So if you wanted to monitor messages sent and received, you should be looking there and NOT the MTA stacks as you would have done in Exchange 5.5.  Here is what MS has to say about the The SMTP service (also applies to Exchange 2000):

SMTP Transport Engine: This is the core transport subsystem of Exchange 2003. All messages must pass through the SMTP transport engine, whether they are sent to users on the Internet, to another server in the same Exchange 2003 organization, or to the sender's local server. Monitoring this service and its associated message queues, and reacting quickly to issues related to the SMTP service enables you to ensure that messages can reach their destinations with minimum delays.

As for MTA Stacks, MS says:

Message Transfer Agent (MTA): This service provides the necessary routing functions when communicating with Microsoft Exchange Server 5.5, with X.400 messaging systems, or with non-Exchange messaging systems through Connector for Lotus Notes or Connector for Novell GroupWise. You should monitor this service if you are responsible for a complex environment that includes a mixed Exchange 5.5 or a non-Exchange messaging system. It is recommended that Microsoft Exchange MTA Stacks service is running on every Exchange server.

Here are some suggested starting points for monitoring users in Exchange using SNMP Informant (1-n means multiple instances possible):

Metric Informant Agent OID
POP3/Total Connections Advanced .1.3.6.1.4.1.9600.1.2.62.9.0
NNTP/Current Connections Advanced .1.3.6.1.4.1.9600.1.2.54.1.19.(1 - n)
IMAP4 Current Connections Exchange APP .1.3.6.1.4.1.9600.1.5.13.1.23.(1 - n)
SMTP Current Inbound Connections Advanced .1.3.6.1.4.1.9600.1.2.76.1.79.(1 - n)
SMTP Current Outbound Connections Advanced .1.3.6.1.4.1.9600.1.2.76.1.105.(1 - n)
Exchange IS (Information Store) Active Users (last 10 mins) Exchange APP  .1.3.6.1.4.1.9600.1.5.14.8.0
     

OWA is a bit tricky, since it uses web inbound connections.  The users show up in the above (IS Active Users) and as an anonymous connection to the Exchange virtual directory in the default WebService instance, which should be .1.3.6.1.4.1.9600.1.2.86.1.9.16.68.101.102.97.117.108.116.32.87.101.98.32.83.105.116.101

There IS a webmail tree in the Exchange APP which lists authentications total, but it is possible for a user to be authenticated multiple times, so that number would skew the user count.  For your records, that OID is .1.3.6.1.4.1.9600.1.5.29.1.27.(1 - n)

MAPI connections will also show up as an Exchange IS connection.

Finally, if you would like to get some detailed information, including performance counters to watch, please read the following web page:

System Monitoring with Exchange 2003 Management Pack (for MOM 2005)

A good set of links for all resources Exchange (5.5/2000/2003):

Exchange 5.5 Technical Library:

Exchange 5.5 Resource Guide:

Exchange 2000 Technical Library:

Technical Resources for Exchange Server 2000:

Exchange 2003 Technical Library:

Monitoring Exchange 2003: