TA-Exchange-Mailbox inputs

The TA-Exchange-Mailbox add-on collects performance and Windows host monitoring data from Windows hosts that run Exchange Server and hold the Mailbox Store role. See Configure TA-Exchange-Mailbox to learn how to configure the add-on for your version of Exchange Server prior to deploying it to Exchange Server hosts.

The add-on includes the following data inputs:

Common data inputs

[WinHostMon://Processes]
[WinHostMon://Services]
[perfmon://Total_Processor_Time]
[perfmon://Processor]
[perfmon://System]
[perfmon://Available_Memory]
[perfmon://Memory]
[perfmon://DotNET_CLR_Memory]
[perfmon://Network_Utilization]
[perfmon://TCPv4]
[perfmon://TCPv6]
[perfmon://MSExchange_Search_Indices]
[perfmon://MSExchange_Control_Panel]
[perfmon://Process_Microsoft.Exchange.Search.ExSearch]
[perfmon://Process_MSExchangeMailboxAssistants]
[perfmon://Process_msftesq]
[perfmon://MSExchange_Assistants_Per_Assistant]
[perfmon://MSExchange_Assistants_Per_DB]
[perfmon://MSExchange_Store_Interface_Total]
[perfmon://MSExchange_Store_Interface]
[perfmon://MSExchange_Mail_Submission]
[perfmon://MSExchange_ADAccess_Processes]
[perfmon://LogicalDisk]
[perfmon://MSExchangeIS]
[perfmon://MSExchange_Database_Edge_Transport]
[perfmon://MSExchange_Database_NoInstances]
[perfmon://MSExchange_Resourcebooking]
[perfmon://MSExchange_IS_Public]
[perfmon://MSExchange_Replication]
[perfmon://MSExchange_Calendarattendant]
[perfmon://MSExchange_IS_Mailbox]

Exchange Server 2010 data inputs (Not supported)

[perfmon://MSExchangeIS_Mailbox_2010]
[perfmon://MSExchange_Database_2010]
[perfmon://MSExchange_Database_Instances_2010]
[perfmon://MSExchangeIS_Client_2010]
[perfmon://MRM_Assistants_2010]
[perfmon://MSExchange_ADAccess_Caching_2010]
[perfmon://MRM_Counters_2010]
[perfmon://MSExchange_ADAccess_DC_2010]
[script://.\bin\exchangepowershell.cmd v14 get-publicfolderstats_2010.ps1]
[script://.\bin\exchangepowershell.cmd v14 get-databasestats_2010.ps1]
[script://.\bin\exchangepowershell.cmd v14 get-folderstats_2010.ps1]
[script://.\bin\exchangepowershell.cmd v14 get-distlists_2010_2013.ps1]
[script://.\bin\exchangepowershell.cmd v14 get-hoststats_2010_2013.ps1]
[script://.\bin\exchangepowershell.cmd v14 read-audit-logs_2010_2013.ps1]
[script://.\bin\exchangepowershell.cmd v14 read-mailbox-audit-logs_2010_2013.ps1]
[script://.\bin\exchangepowershell.cmd v14 get-mailboxstats_2010_2013.ps1]
[script://.\bin\exchangepowershell.cmd v14 get-inboxrules_2010_2013.ps1]

Exchange Server 2013, 2016, and 2019 data inputs

[perfmon://OWA]
[perfmon://ActiveSync]
[perfmon://MSExchangePop3]
[perfmon://MSExchangeImap4]
[perfmon://Disk]
[perfmon://MSExchangeIS_Store]
[perfmon://MSExchange_Queue_Lengths]
[perfmon://MSExchange_Transport_Dumpster]
[perfmon://MSExchange_Store_Driver]
[perfmon://MSExchange_SmtpReceive]
[perfmon://MSExchange_SmtpSend]
[perfmon://MSExchange_Extensibility_Agents]
[perfmon://MSExchangeIS_Client_2013]
[perfmon://MSExchange_ADAccess_Caching_2013]
[perfmon://MRM_Counters_2013]
[perfmon://MSExchange_Database_2013]
[perfmon://MSExchange_Database_Instances_2013]
[perfmon://MSExchange_ADAccess_DC_2013]
[perfmon://MRM_Assistants_2013]
[monitor://C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\MessageTracking]
[script://.\bin\exchangepowershell.cmd v15 get-databasestats_2013.ps1]
[script://.\bin\exchangepowershell.cmd v15 get-folderstats_2013.ps1]
[script://.\bin\exchangepowershell.cmd v15 get-distlists_2010_2013.ps1]
[script://.\bin\exchangepowershell.cmd v15 get-hoststats_2010_2013.ps1]
[script://.\bin\exchangepowershell.cmd v15 get-mailboxstats_2010_2013.ps1]
[script://.\bin\exchangepowershell.cmd v15 get-inboxrules_2010_2013.ps1]
[script://.\bin\exchangepowershell_mailbox2016.cmd v15 read-audit-logs_2016.ps1]
[script://.\bin\exchangepowershell_mailbox2016.cmd v15 read-mailbox-audit-logs_2016.ps1]

For the admin audit log data collection, the PowerShell script saves the checkpoint (date) when this data was previously collected. Saving this checkpoint creates and uses splunk-msexchange-auditfile.clixml and splunk-msexchange-mailboxauditlogs.clixml, which uses %TEMP% as a location and C:\Windows\Temp as a path for the user account that SplunkForwarder services is running.