The Exchange User Monitor Tool, Part II

Last week, I discussed an occasional need that most administrators face--finding out why a particular user's messaging operations are slow. In this context, slow might be a relative term; what matters is being able to find out exactly what's responsible for slowing things down. That can be a daunting task, but the newly released Exchange Server User Monitor (ExMon) tool makes it much simpler.

Microsoft originally developed ExMon for internal use. Profiling tools such as ExMon let developers monitor where their code is actually spending its time (and the executing servers' resources). By locating the most commonly executed code and optimizing it, developers can speed up the tasks users perform most often. ExMon turns that model sideways.

Instead of gathering data about the code components in Exchange, ExMon gathers data about resource use for individual Messaging API (MAPI) sessions. Because Exchange knows (and exposes) which users own which sessions, it becomes a relatively simple matter to see where your server's CPU, disk, and RAM resources are being used and who's using them.

ExMon doesn't collect data about Internet protocol clients, Outlook Web Access (OWA) users, mobile or wireless devices, or SMTP traffic. Its sole purpose is to help you monitor and aggregate user-specific performance information for Outlook users.

Installing ExMon is simple. The tool comes as a single Windows Installer file; you have to run a .reg file to add the two registry subkeys that are required for data collection. You can install ExMon on your Exchange server (Exchange Server 2003 Service Pack 1--SP1--and Exchange 2000 Server SP3 are the currently supported versions) to capture data at the time intervals you select. After the data is captured, you can view it from any Windows 2000 or later machine-- unless the data was collected from an Exchange server running Windows Server 2003, in which case you can view that data only from another Windows 2003 system.

ExMon is straightforward to use. When you launch it, it immediately begins gathering data at 1-minute intervals, updating its display every minute. You can stop and restart data gathering; you can also change the interval at which updates occur and save the data to a file for later processing. If you prefer, you can gather data by running a command-line version of ExMon. Microsoft recommends using this method in conjunction with Performance Monitor so that you can schedule when data collection takes place. ExMon presents its data by user. You'll see the amount of CPU time used, the number of packets, remote procedure call (RPC) operations, input and output bytes, and a count of database pages read and changed, plus some other interesting parameters (including the number of bytes generated in the transaction logs, the user's IP address, and the client version). If you'd rather, you can aggregate data for display by Outlook version. The most interesting view is probably the "by clientmon" view, which you can use only with Microsoft Office Outlook 2003 clients. This view summarizes the number of RPC processes and sessions that one user uses, as well as latency data that gives you an average of how long requests are taking.

Collecting the data is the easy part. Accurately interpreting that data is more difficult. The ExMon documentation provides an excellent guide to the meanings of individual data items, along with a reminder that gathering data at longer intervals (30 minutes or more) will give you more insight into overall performance. Short intervals might tell you what's happening for brief periods, but in most cases, longer baselines make sustained performance problems easier to spot.

The appropriate use of ExMon will give you a much richer view of what your servers are doing at a given point in time, making it easier to identify performance problems so that you can fix them. I commend the Exchange team for making this tool freely available (go to and run a keyword search for ExMon). I encourage you to check it out and see what it tells you about your environment.

Hide comments


  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.