Exmon on Exchange Server 2007

The Exchange User Monitor was released in 2005 for Exchange Server 2003. This tool allows an administrator the capability to dive deeply into the guts of an Exchange Server and see what is going on with MAPI on that server. The tool regularly updates its display (by default, every 60 seconds), tracing the activity of each MAPI connection that is open to the Information Store. This includes connections that occur via Outlook Anywhere (RPC/HTTP).

Using ExMon it is possible to determine how much of the Information Store resource any specific user is consuming. It especially helps to determine any users that may be using too many system resources. And actually, if a user has multiple connections, each connection may be tracked separately. Resources that are tied to the information store include such things as: the number of RPC packets that are sent and received, the number of operations (like read, delete, move, etc.), how many bytes were sent and received between the server and client, how much CPU time it took to perform each one of the RPC operations, etc. There are also client specific sets of information that are displayed by ExMon, such as the client’s access token (i.e., their username), the version of the client connecting (i.e., the version of Outlook), and the IP address of the client computer.

You don’t have to look far to find an example of how ExMon can help. For example, the initial release of Google Desktop Search did not throttle its use of Exchange resources. It would open several MAPI connections to an Exchange server to download mailbox information and do so as fast as it could. Just a few copies of GDS running on a network against large mailboxes could bring an Exchange server to its knees due to performance issues. Because of this and other similar situations, ExMon acquired quite a following within the Customer Support and Services (CSS, which most people still call PSS) organization of Microsoft, as well as within various online communities. In fact, ExMon is part of the Exchange Performance Troubleshooter, which is part of the Exchange Management Console in Exchange 2007.

ExMon works by using a Windows technology known as ETW – Event Tracing for Windows. ETW was first introduced in Windows 2000 Server. ExMon requires two registry keys to be set, one of which enables RPC tracing within the Information Store and one of which enables WMI to return ETW information. A restart is not required for either key to take effect. Tracing is a technology originally developed to assist in low-level debugging of applications and the Windows operating system itself. Because of this, trace files are not compatible between applications. That is, ExMon for Exchange Server 2003 will not work with Exchange Server 2007.

When collecting samples, ExMon has very low impact on an Exchange server. However, depending on how busy a server is, or how many connections it has, the data analysis portion of each ExMon cycle can consume significant system resources. Also there are some situations that can cause ExMon’s trace files to become disconnected from the application itself. In this case, the trace files can grow to be very large (512 MB).

Because of these (and other) reasons, ExMon has not been released for Exchange Server 2007. If you run the Performance Troubleshooter, it will actually generate errors because ExMon is not available. In order to obtain ExMon, you will need to open a support case with CSS and request it. My contacts within Microsoft say that there is an ongoing dialog regarding the general release of ExMon, but so far, the decision has been “not to”.