I recently blogged about using PAL to analyse an existing performance monitor log file.  That is great if you have an existing log, but what if this is not the case?  How can we easily capture the correct counters in the log file?  Again PAL can come to the rescue!

Let's assume that PAL is installed as detailed in the previous blog post, if not hit that post and get the tool running.  I’ll wait for you   - you’re back – good!  Now that the tool is installed and running, go to the Threshold File tab as shown in the below picture. 

Select the threshold file that you are interested in, in this case let’s choose “Microsoft Exchange 2010”.  This is shown in the capture above.  Then click the "Export to Perfmon template file button, and save the file somewhere safe.  This is an XML file which can be viewed in IE or another XML editing tool. 

This saved XML file can then be copied to the Exchange server where it can be used as the template for a Perfmon (Performance Monitor) Data Collector Set.  The Data Collector Set contains one or more Data Collectors which are the actual elements containing the Perfmon counters to capture.  The Data Collector Set is responsible for the scheduling of the individual Data Collectors. 

Under Administrative tools open up the Performance Monitor MMC, then navigate down the to   Data Collector Sets\User Defined.  On a newly installed server it will look like this, i.e. empty.

Right click on User Defined and go New –> Data Collector Set.  This will bring up the wizard to create the Data Collector. 

Ensure the “Create from a Template” option is selected then click next.

 Click browse to local the PAL XML file that you previously copied to the server. 

At this point you can hit Finish and take the default collection location and account to run the collector. 

Selecting Next from the screen above (instead of Finish) will allow the location of the Data Collector to be changed. By default this will be saved to the root of the system drive, i.e. C:\PerfLogs\...

Again this screen can be bypassed if Finish was chosen on one of the previous stages.  If skipped then Perfmon will assume the Data Collector is to run under the default user context, though we can  modify this in addition to either starting the Data Collector Set immediately or opening up the properties and setting a schedule. 

Now you will have something resembling the below, which is the Data Collector that contains the Exchange 2010 PAL counters. 

Right click the Data Collector entry in the right hand pane, and select properties to review the list of PerfMon counters.

Note that the sample interval, log file location and log file type (.blg, CSV, TAB,SQL) can be set here.  

In the main Performance Monitor console, right clicking on the Data Collector Set and selecting properties allows the start & stop conditions to be set.  This allows for automated data collection, where you can start the collector at specific times of given days of the week.    Of course the Collector Set can be started and stopped manually, the choice as they say is all yours ! 

Now that the Data Collector Set is created, you can use it to capture performance data to help troubleshoot issues. 

So we have the ability to use PAL to help with creating Performance Monitor logs by using it to create a template file that allows for easy Data Collector Set creation.  Once the log has been captured, PAL can then be used to analyse it as described in the previous blog. 

Cheers,

Rhoderick

Have you used Windows 2008 and Windows 2008 R2 Hyper-V; created a snapshot, deleted it and then wondered why the snapshot files are still hanging around?    Like to know what to expect and the EventIDs that are associated with snapshot removal? 

Likely you will be familiar with .vhd files which are the disk storage files in currently released versions of Hyper-V.  It is also possible for other organisations to leverage the .vhd format.  Snapshot information is saved in a .avhd & .xml configuration file so that they contain the difference in activity in relation to the linked .vhd file.  This is why they are called differencing disks too.   

Ben Armstrong has posted several times on the underlying mechanics behind deleting snapshots and what goes on in the plumbing.  If you don't currently subscribe to Ben’s blog I would highly recommend that you do so via the RSS feed here.  If you search for snapshot information on his blog you will find:

 http://blogs.msdn.com/b/virtual_pc_guy/archive/2009/04/15/what-happens-when-i-delete-a-snapshot-hyper-v.aspx 

That will tell you what you expect in terms of the underlying mechanics of how snapshots are removed etc.  What EventIDs should you then look for in the event logs?  TechNet has most of this covered off in the Virtual Machine Snapshot Operation section.

Feedback is also provided via the Hyper-V interface, as shown in the image below.  This will track progress as a percentage.  Note that this is not shown via the SCVMM summary pane, and to monitor snapshot deletion you can monitor for the associated event IDs. 

Monitoring for completion of the merge is the critical aspect here.  If the VM is powered on before the merge has completed in Windows 2008 and Windows 2008 R2 the merge is then aborted and the process of merging the differencing disk is stopped.  The net result of this is that the .avhd file persists on disk and continues to consume disk space. 

This is one of the reasons that snapshots are to be used judiciously in production environments.  Another reason is that different vendors or product groups may or may not support Hypervisor based snapshots when their application is installed.  Exchange is an example that does NOT support Hypervisor based snapshots.  You will see this sort of wording around the product support requirements “

Some hypervisors include features for taking snapshots of virtual machines. Virtual machine snapshots capture the state of a virtual machine while it's running. This feature enables you to take multiple snapshots of a virtual machine and then revert the virtual machine to any of the previous states by applying a snapshot to the virtual machine. However, virtual machine snapshots aren't application aware, and using them can have unintended and unexpected consequences for a server application that maintains state data, such as Exchange. As a result, making virtual machine snapshots of an Exchange guest virtual machine isn't supported.” 

The Hyper-V merge events are located under:

Applications and Services Logs\Windows\ Hyper-V-VMMS\Admin

Deleting a snapshot results in EventID 19070 when the merge process starts and EventID 19080 when the merge has completed. 

'E2K3-DC' background disk merge has been started. (Virtual machine ID D1205407-384D-4A0B-8028-765611B07537)

'E2K3-DC' background disk merge has been finished successfully. (Virtual machine ID D1205407-384D-4A0B-8028-765611B07537)

If the merge is interrupted this will result in EventID 19091 which has the following event text:

Background disk merge has been interrupted. (Virtual machine ID %2)

In case you are interested in events for other Hyper-V aspects, the Hierarchy of Managed Entities contains the EventIDs associated with the various components.

Windows Server 2012 Hyper-V will support live snapshot merge so having to power off VMs to merge .avhd files should minor issue in the future!

Cheers,

Rhoderick

The Microsoft Log Parser is a trusted and venerable tool to have when you are analysing log files. 

One issue that does come up when analysing larger Performance Monitor files is that of the default buffer setting in Log Parser.  Typically you will see an error message saying  “log row too Long”. 

When running the ExRAP toolset this will be shown in the console:

Error parsing query: Log row too long
LogFile "C:\ExRAP\Public\Output\PerfCollector\perfcollector.servername_01_2012.04.02_09.28.42.csv", Row number 1 [Unknown Error]

Log Parser has a default buffer allocated to it and analysing Exchange PerfMon Logs during an large ExRAP we typically run into this issue.  To fix this, all we have to do is to increase the allocated buffer size.  The exact key that you will use will depend upon if you are running log Parser on an x86 or x64 OS.

After doing this a few times I’m bored of typing it hence the reg.exe to add the necessary values.  Note that the command may wrap, and it is used at your own risk.  It will also need to be run from an elevated command prompt.

x86

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Log Parser

REG_DWORD  CSVInMaxRowSize  393216 decimal

To automate adding on x86 machines:

REG.exe ADD "HKLM\Software\Microsoft\Log Parser" /v CSVInMaxRowSize  /t REG_DWORD /d 393216
 

x64

HKLM\Software\Wow6432Node\Microsoft\Log Parser

REG_DWORD  CSVInMaxRowSize  393216 decimal

To automate adding on x64 machines:

REG.exe ADD "HKLM\Software\Wow6432Node\Microsoft\Log Parser" /v CSVInMaxRowSize  /t REG_DWORD /d 393216

Log Parser 2.2 now has a new companion – Log Parser Studio.  I’ll cover it in a later blog.  Check it out it really is an amazing tool!  Documentation can be found on the Exchange Team Blog. 

Cheers,

Rhoderick

Update: Since Exchange 2013 has now been released the preview forums has been retired, and the RTM forums can now be found here.

Since the Exchange 2013 Preview is now available it is a great chance to see how the next version of Exchange is shaping up!  If you are running to issues then head on over to the TechNet forum for Exchange 2013 Preview and see if the community can help out.

In addition the Exchange 2013 Preview help files are also available for download.  That way you don’t have to watch movies on those long haul flights, now you can read chum files  

Cheers,

Rhoderick

In the previous articles in this series we looked at the basic aspects of PowerShell and then the underlying mechanisms that are used to connect both Exchange 2007 and Exchange 2010 management tools to Exchange.  These articles can be found as follows:   

• How To Maximize Exchange Administrator Productivity With PowerShell - Part 1

• How To Maximize Exchange Administrator Productivity With PowerShell - Part 2

Now that the basics and plumbing are out of the way what are some of the more interesting things that we can do?

Let’s take the most ubiquitous cmdlet, Get-Mailbox and expand upon it.

Limited View Of Mailboxes

The biggest issue I hear from customers is that they do not see all mailboxes by default, and this happens in a couple of scenarios.  Firstly, Exchange will return a maximum of 1,000 mailboxes by default.  This behaviour can be altered by specifying the following option.

-ResultSize Unlimited

Secondly, Exchange will only show you mailboxes from the current domain by default.  Should you want to see mailboxes for all domains in the forest you will need to change the following:

Exchange 2007

$ADAdminSessionSettings –ViewEntireForest $TRUE

Exchange2010

Set-ADServerSettings –ViewEntireForest $TRUE

Alternatively specify the IgnoreDefaultScope parameter which tells PowerShell to ignore the default scope for the session and to use the entire forest as the scope.

Positional Parameter

You will recall that get-Mailbox can be used for something as simple as:

Get-Mailbox <user>

The <user> is a positional parameter that lets you specify the parameter's value without specifying the parameter's name.  A parameter is a positional parameter if the Parameter Position attribute is an integer. This integer indicates the position on the command line where the cmdlet can find the parameter's value. For more information about the various attributes that make up a parameter, see the Parameter Details section in Exchange Help.

Wildcard Searches

Get-Mailbox will also support wildcard searches so that you can return mailboxes that being with the phrase “User”

Get-Mailbox User*

All mailboxes beginning with the letter A:

or Get-Mailbox A*

Mailboxes By Database

To show all mailboxes that are in a given database:

Get-Mailbox –Database

Mailboxes By Organisational Unit

To show all mailboxes in a given Organisational Unit (OU) in Active Directory:

Get-Mailbox –OrganizationalUnit  Montreal-Staff-OU

Integrated Sort

The Get-Mailbox cmdlet also has the SortBy option so that you can sort the mailboxes without having to pipe to Sort-Object.  Note that you can sort by only one attribute at a time. You can sort by the following attributes:

• Alias
• Display name
• Name

The results are sorted in ascending order.

Mailbox Type

To see only a particular type of mailbox the RecipientTypeDetails parameter can be used.  Can then choose to show only mailboxes in the following classes:

• RoomMailbox
• EquipmentMailbox
• LegacyMailbox
• LinkedMailbox
• UserMailbox
• DiscoveryMailbox   (Only applicable to Exchange 2010)
• SharedMailbox

Return Archive Information

To see information about an archive enabled mailbox on Exchange 2010, simple add the Archive parameter:

Get-Mailbox user1  -Archive

If the archive should be located in Exchange Online, then use the –RemoteArchive parameter instead.

Filter Information

Perhaps the most interesting capability is Filter, which allows the administrator to specify an OPATH filter string to filter the returned mailboxes.  It is well worth learning this capability as it is used in the following cmdlets:

• Get-CASMailbox
• Get-Contact
• Get-DistributionGroup
• Get-DynamicDistributionGroup
• Get-Group
• Get-Mailbox
• Get-MailContact
• Get-MailPublicFolder
• Get-MailUser
• Get-Recipient
• Get-UMMailbox
• Get-User

The full list of allowed parameters are documented on TechNet. 

For example, we can pull back only mailboxes that are of type UserMailbox.  This is more efficient that retrieving every mailbox and then stuffing it down the pipeline to a Where-Object clause. 

Get-Mailbox –Server Server1  -ResultSize Unlimited -Filter {RecipientTypeDetails -eq 'UserMailbox'}

Another example of a filter, would be the following applied to a Dynamic DistributionGroup:

All mailboxes that are on Server1 and user in the Dallas office:

Set-DynamicDistributionGroup AllServer1-Dallas –RecipientFilter { ServerName –eq 'Server1' –and Office –eq 'Dallas'

The other important aspect of the filter parameter is that it has the ability to greatly improve the performance of one’s command.  If a small number of records are retrieved prior to passing them down the pipeline then the entire process will complete in a far more efficient manner than returning unneeded records and then passing them down the pipeline.

For part one please click here.

For part two please click here.

Cheers,

Rhoderick

Hold up!  The Exchange product group today announced the availability of the next version of Exchange.   This was previously referred to as E15, but we can now call it Exchange 2013. 

The bits can be downloaded from TechNet here:

While you are at it, the Office 2013 preview can be found here:

Cheers,

Rhoderick

Just in case evaluating the Exchange 2013 preview was not keeping you busy, Channel 9 has recordings on Lync from TechEd 2012.

Enjoy!

Cheers,

Rhoderick

To make a change from the way that a Monday typically starts, Rajesh Jha (Corporate Vice President, Exchange) posted a great overview on Exchange 2013’s features. 

This is published on the Exchange team blog.

Here are some of the great benefits you get with the next release of Exchange: