TA-Exchange-Mailbox inputs
The TA-Exchange-Mailbox add-on collects performance and Windows host monitoring data from Windows hosts that run Exchange Server and hold the Mailbox Store role. See Configure TA-Exchange-Mailbox to learn how to configure the add-on for your version of Exchange Server prior to deploying it to Exchange Server hosts.
The add-on includes the following data inputs:
Common data inputs
[WinHostMon://Processes] [WinHostMon://Services] [perfmon://Total_Processor_Time] [perfmon://Processor] [perfmon://System] [perfmon://Available_Memory] [perfmon://Memory] [perfmon://DotNET_CLR_Memory] [perfmon://Network_Utilization] [perfmon://TCPv4] [perfmon://TCPv6] [perfmon://MSExchange_Search_Indices] [perfmon://MSExchange_Control_Panel] [perfmon://Process_Microsoft.Exchange.Search.ExSearch] [perfmon://Process_MSExchangeMailboxAssistants] [perfmon://Process_msftesq] [perfmon://MSExchange_Assistants_Per_Assistant] [perfmon://MSExchange_Assistants_Per_DB] [perfmon://MSExchange_Store_Interface_Total] [perfmon://MSExchange_Store_Interface] [perfmon://MSExchange_Mail_Submission] [perfmon://MSExchange_ADAccess_Processes] [perfmon://LogicalDisk] [perfmon://MSExchangeIS] [perfmon://MSExchange_Database_Edge_Transport] [perfmon://MSExchange_Database_NoInstances] [perfmon://MSExchange_Resourcebooking] [perfmon://MSExchange_IS_Public] [perfmon://MSExchange_Replication] [perfmon://MSExchange_Calendarattendant] [perfmon://MSExchange_IS_Mailbox]
Exchange Server 2010 data inputs (Not supported)
[perfmon://MSExchangeIS_Mailbox_2010] [perfmon://MSExchange_Database_2010] [perfmon://MSExchange_Database_Instances_2010] [perfmon://MSExchangeIS_Client_2010] [perfmon://MRM_Assistants_2010] [perfmon://MSExchange_ADAccess_Caching_2010] [perfmon://MRM_Counters_2010] [perfmon://MSExchange_ADAccess_DC_2010] [script://.\bin\exchangepowershell.cmd v14 get-publicfolderstats_2010.ps1] [script://.\bin\exchangepowershell.cmd v14 get-databasestats_2010.ps1] [script://.\bin\exchangepowershell.cmd v14 get-folderstats_2010.ps1] [script://.\bin\exchangepowershell.cmd v14 get-distlists_2010_2013.ps1] [script://.\bin\exchangepowershell.cmd v14 get-hoststats_2010_2013.ps1] [script://.\bin\exchangepowershell.cmd v14 read-audit-logs_2010_2013.ps1] [script://.\bin\exchangepowershell.cmd v14 read-mailbox-audit-logs_2010_2013.ps1] [script://.\bin\exchangepowershell.cmd v14 get-mailboxstats_2010_2013.ps1] [script://.\bin\exchangepowershell.cmd v14 get-inboxrules_2010_2013.ps1]
Exchange Server 2013, 2016, and 2019 data inputs
[perfmon://OWA] [perfmon://ActiveSync] [perfmon://MSExchangePop3] [perfmon://MSExchangeImap4] [perfmon://Disk] [perfmon://MSExchangeIS_Store] [perfmon://MSExchange_Queue_Lengths] [perfmon://MSExchange_Transport_Dumpster] [perfmon://MSExchange_Store_Driver] [perfmon://MSExchange_SmtpReceive] [perfmon://MSExchange_SmtpSend] [perfmon://MSExchange_Extensibility_Agents] [perfmon://MSExchangeIS_Client_2013] [perfmon://MSExchange_ADAccess_Caching_2013] [perfmon://MRM_Counters_2013] [perfmon://MSExchange_Database_2013] [perfmon://MSExchange_Database_Instances_2013] [perfmon://MSExchange_ADAccess_DC_2013] [perfmon://MRM_Assistants_2013] [monitor://C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\MessageTracking] [script://.\bin\exchangepowershell.cmd v15 get-databasestats_2013.ps1] [script://.\bin\exchangepowershell.cmd v15 get-folderstats_2013.ps1] [script://.\bin\exchangepowershell.cmd v15 get-distlists_2010_2013.ps1] [script://.\bin\exchangepowershell.cmd v15 get-hoststats_2010_2013.ps1] [script://.\bin\exchangepowershell.cmd v15 get-mailboxstats_2010_2013.ps1] [script://.\bin\exchangepowershell.cmd v15 get-inboxrules_2010_2013.ps1] [script://.\bin\exchangepowershell_mailbox2016.cmd v15 read-audit-logs_2016.ps1] [script://.\bin\exchangepowershell_mailbox2016.cmd v15 read-mailbox-audit-logs_2016.ps1]
For the admin audit log data collection, the PowerShell script saves the checkpoint (date) when this data was previously collected. Saving this checkpoint creates and uses splunk-msexchange-auditfile.clixml and splunk-msexchange-mailboxauditlogs.clixml, which uses %TEMP% as a location and C:\Windows\Temp as a path for the user account that SplunkForwarder services is running.
Overview of TA-Exchange-Mailbox | Configure TA-Exchange-Mailbox |
This documentation applies to the following versions of Splunk® Supported Add-ons: released
Feedback submitted, thanks!