Splunk® Content Packs for ITSI and IT Essentials Work

Splunk Content Packs for ITSI and IT Essentials Work

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

KPI reference for the Content Pack for Microsoft Exchange

The following tables list the Key Performance Indicators (KPIs) used to monitor the health of your Exchange servers in the Content Pack for Microsoft Exchange. All parent and child services report up to the overall MSExchange service at the highest level.

Mailbox

The following services belong to the MSExchange_Mailbox parent service.

Mailbox Availability

The mailbox server role hosts both mailbox and public folder databases and also provides email message storage. Refer to the following table for KPI name, description, and search schedule and lookback time:


KPI Description KPI search schedule and lookback time
AD Topology Service Provides Active Directory topology information to Exchange services. If this service is stopped, most Exchange services can't start. 5 min/5 min lookback
Backup Extension Enables Windows Server Backup users to back up and recover application data for Microsoft Exchange Server. 5 min/5 min lookback
Exchange Service Host Provides a host for several Microsoft Exchange services. 5 min/5 min lookback
Exchange Submission Service This service runs on the Mailbox servers. This service receives Submit events, processes messages by converting them from MAPI to MIME, and then hands them over to the Transport service on a Mailbox server. 5 min/5 min lookback
Fast Search Indexer Drives indexing and querying of data for Exchange. 5 min/5 min lookback
IIS Service Provides web connectivity and administration through the Internet Information Services Manager. 5 min/5 min lookback
Information Store Manages the Microsoft Exchange Information Store, which includes mailbox databases, and public folder databases. If this service is stopped, mailbox databases and public folder databases on this computer are unavailable. If this service is disabled, any services that explicitly depend on it fail to start. 5 min/5 min lookback
Mailbox Assistants Performs background processing of mailboxes in the Exchange store. 5 min/5 min lookback
Replication Service The Microsoft Exchange Replication service provides replication functionality for mailbox databases on Mailbox servers in a database availability group. 5 min/5 min lookback
Search Service Drives indexing of mailbox content, which improves the performance of content search. 5 min/5 min lookback
Throttling Service Limits the rate of user operations. 5 min/5 min lookback
Transport Log Search Service Microsoft Exchange Transport Log Search service 5 min/5 min lookback
Transport Service Microsoft Exchange Transport service 5 min/5 min lookback

Calendar Attendant

This service monitors the activities of the Calendar Attendant on the Microsoft Exchange Server:

KPI Description KPI search schedule and lookback time
Avg. Calendar Attendant Processing time The average time to process an event in the Calendar Attendant. 5 min/5 min lookback
Meeting Requests Failed The total number of failures that occurred while the Calendar Attendant was processing events. 5 min/5 min lookback

Mailbox Attendant

This service monitors the activities of the Mailbox Attendant on the Microsoft Exchange Server:

KPI Description KPI search schedule and lookback time
Assistant Events Polled/sec The number of events polled per second. Determines current load statistics for this counter. 5 min/5 min lookback
Assistants Event Processing Time (per Database) The average processing time of the events chosen. 5 min/5 min lookback
Assistants In Queue (per Database) The number of events in the in-memory queue waiting to be processed by the assistants. 5 min/5 min lookback
Mailboxes Processed by Assistants/sec The rate of mailboxes processed by time-based assistants per second. Determines current load statistics for this counter. 5 min/5 min lookback

Mailbox Assistant

This service monitors the activity of Microsoft Exchange Server Assistants:

KPI Description KPI search schedule and lookback time
Assistant Events Polled/sec The number of events polled per second. Determines current load statistics for this counter. 5 min/5 min lookback
Assistants Event Processing Time (per database) The average processing time of the events chosen. 5 min/5 min lookback
Assistants In Queue (per database) The number of events in the in-memory queue waiting to be processed by the assistants. 5 min/5 min lookback
Mailboxes Processed by Assistants/sec The rate of mailboxes processed by time-based assistants per second. Determines current load statistics for this counter. 5 min/5 min lookback

Database

A mailbox database is a unit of granularity where mailboxes are created and stored. This service monitors the activity of the following database activities:

KPI Description KPI search schedule and lookback time
DB Cache Hit % The percentage of database file page requests fulfilled by the database cache without causing a file operation. If this percentage is too low, the database cache size may be too small. 5 min/5 min lookback
DB Cache Size The amount of system memory, in megabytes (MB), used by the database cache manager to hold commonly used information from the database files to prevent file operations. 5 min/5 min lookback
DB I/O Avg. Read Latency The average length of time, in milliseconds (ms), per database read operation. 5 min/5 min lookback
DB I/O Avg. Read Latency (Attached) Indicates the average time, in milliseconds (ms), to read from the database file. 5 min/5 min lookback
DB I/O Avg. Read Latency (Recovery) Indicates the average time, in milliseconds (ms), to read from the database file. 5 min/5 min lookback
DB I/O Avg. Write Latency The average length of time, in milliseconds (ms), per database write operation. 5 min/5 min lookback
DB I/O Avg. Write Latency (Attached) Indicates the average time, in milliseconds (ms), to write to the database file. This counter isn't a good indicator for client latency because database writes are asynchronous. 5 min/5 min lookback
DB I/O Avg. Write Latency (Recovery) Indicates the average time, in milliseconds (ms), to write to the database file. 5 min/5 min lookback
DB Log Generation Checkpoint Depth Represents the amount of work in the log file count that needs to be redone or undone to the database files if the process fails. 5 min/5 min lookback
DB Log I/O Avg. Read Latency Indicates the average time, in milliseconds (ms), to read data from a log file. Specific to log replay and database recovery operations. 5 min/5 min lookback
DB Log I/O Avg. Write Latency Indicates the average time, in milliseconds (ms), to write a log buffer to the active log file. 5 min/5 min lookback
DB Log Record Stalls/sec The number of log records that can't be added to the log buffers per second because the log buffers are full. If this counter is nonzero for a long period of time, the log buffer size may be a bottleneck. 5 min/5 min lookback
DB Log Threads Waiting The number of threads waiting for their data to be written to the log to complete an update of the database. If this number is too high, the log may be a bottleneck. 5 min/5 min lookback
DB Log Write Bytes/sec The rate of bytes written to the log. 5 min/5 min lookback
DB Page Fault Stalls/sec The rate that database file page requests require of the database cache manager to allocate a new page from the database cache. 5 min/5 min lookback
DB Version Buckets Allocated The total number of version buckets allocated. 5 min/5 min lookback

Resource Booking

This service monitors the following Resource Booking related activities:

KPI Description KPI search schedule and lookback time
Avg. Resource Booking Processing Time The average time to process an event in the Resource Booking Attendant. 5 min/5 min lookback
Resource Requests Failed The total number of failures that occurred while the Resource Booking Attendant was processing events. 5 min/5 min lookback

Search Indices

This service monitors the following search related activities:

KPI Description KPI search schedule and lookback time
Avg. Resource Booking Processing Time The average time to process an event in the Resource Booking Attendant. 5 min/5 min lookback
Search Full Crawl Mode Status This counter is used to determine if a full crawl is occurring for any specified database. 5 min/5 min lookback
Search RPC Avg. Latency The average latency, in milliseconds (ms), of the most recent remote procedure calls (RPC) to the Information Store service. These RPCs are used to get content for the filter daemon for the specified database. 5 min/5 min lookback

Information Store

The following services belong to the MSExchange_Information_Store parent service.

IS Client

This service provides Microsoft Exchange Information Store (IS) Client statistics:

KPI Description KPI search schedule and lookback time
Client Directory LDAP Reads/sec The current rate that LDAP reads occur while processing requests for the client. Used to determine the current LDAP read rate per protocol. 5 min/5 min lookback
Client Directory LDAP Searches/sec The current rate that LDAP searches occur while processing requests for the client. Used to determine the current LDAP search rate per protocol. 5 min/5 min lookback
Client RPC Average Latency RPC Average Latency is a server RPC latency, in ms, averaged for the past 1,024 packets. 5 min/5 min lookback
Client RPC Operations/sec Shows what client protocol is performing an excessive amount of RPC Operations/sec. 5 min/5 min lookback

IS Client Type

This service provides Microsoft Exchange Information Store (IS) Client Type statistics:

KPI Description KPI search schedule and lookback time
Client Type JET Log Records/sec The rate that database log records are generated while processing requests for the client. Used to determine current load. 5 min/5 min lookback
Client Type JET Pages Read/sec The rate that database pages are read from disk while processing requests for the client. Used to determine current load. 5 min/5 min lookback
Client Type RPC Avg. Latency Shows a server RPC latency, in milliseconds (ms)), averaged for the past 1,024 packets for a particular client protocol. 5 min/5 min lookback
Client Type RPC Operations/sec The number of RPC operations per second for each client type connection. 5 min/5 min lookback

IS Client Mailbox

This service provides details about the Microsoft Exchange IS Mailbox Store:

KPI Description KPI search schedule and lookback time
Mailbox Messages Delivered/sec The rate that messages are delivered to all recipients. Indicates current message delivery rate to the store. 5 min/5 min lookback
Mailbox Messages Sent/sec The rate that messages are submitted by clients. Used to determine the current rate that messages are being submitted by clients. 5 min/5 min lookback
Mailbox Messages Submitted/sec The rate that messages are submitted by clients. Used to determine current rate that messages are being submitted by clients. 5 min/5 min lookback
Mailbox RPC Avg. Latency The RPC latency, in milliseconds (ms), averaged for all operations in the last 1,024 packets. 5 min/5 min lookback
Messages Queued for Submission The current number of submitted messages not yet processed by the transport layer. 5 min/5 min lookback
Search Tasks/sec The number of search tasks created per second. 5 min/5 min lookback
Slow Findrows/sec The rate at which the slower FindRow needs to be used in the mailbox store. 5 min/5 min lookback

IS Public

This service represents the Microsoft Exchange Information Store (IS) Public activity:

KPI Description KPI search schedule and lookback time
Public Folder Messages Queued for Submission The current number of submitted messages not yet processed by the transport layer. 5 min/5 min lookback
Public Folders Replication Receive Queue Size The number of replication messages waiting to be processed. 5 min/5 min lookback

IS

This service manages the mailbox databases on the Information Store (IS) server:

KPI Description KPI search schedule and lookback time
Client RPC Backoffs/sec Indicates the rate at which client backoffs are occurring. Higher values may indicate that the server may be incurring a higher load resulting in an increase in overall averaged RPC latencies, causing client throttling to occur. This can also occur when certain client user actions are being performed. Depending on what the client is doing and the rate at which RPC operations are occurring, it may be normal to see backoffs occurring. 5 min/5 min lookback
Client RPCs Operations Failed/sec The client-reported rate of failed RPCs since the store was started. 5 min/5 min lookback
Mailbox User Count The number of users connected to the information store. Used to determine current user load. 5 min/5 min lookback
RPC Operations/sec The current number of RPC operations occurring per second. 5 min/5 min lookback
Slow Queue Proc. Threads The number of query processor threads currently running queries that aren't optimized. 5 min/5 min lookback
Slow Search Threads The number of search threads currently running queries that aren't optimized. 5 min/5 min lookback
Store RPC Avg. Latency The RPC latency, in milliseconds (ms), averaged for all operations in the last 1,024 packets. 5 min/5 min lookback
Store RPC Requests The overall RPC requests currently executing within the information store process. 5 min/5 min lookback

Store Client Request

The following services belong to the MSExchange_Store_Client_Request parent service.

Mail Submission

This service submits messages from the Mailbox server to Hub Transport servers:

KPI Description KPI search schedule and lookback time
Failed Submissions/sec Shows the number of failed submissions per second. 5 min/5 min lookback
Hub Servers in Retry The number of Hub Transport servers in retry mode. 5 min/5 min lookback
Successful Submissions/sec Determines current mail submission rate. 5 min/5 min lookback
Temporary Submission Failures/sec The number of temporary submission failures per second. 5 min/5 min lookback

Replication

This service provides replication functionality for mailbox databases in a database availability group (DAG):

KPI Description KPI search schedule and lookback time
Replication Copy Queue Length The number of transaction log files waiting to be copied to the passive copy log file folder. A copy isn't considered complete until it has been checked for corruption. 5 min/5 min lookback
Replication Replay Queue Length The number of transaction log files waiting to be replayed into the passive copy. 5 min/5 min lookback

Store Interface

This service monitors the interface between the Exchange Information Store service on the Mailbox Server and the Hub Transport servers:

KPI Description KPI search schedule and lookback time
Store ROP Requests Outstanding The total number of outstanding remote operations requests. Used for determining current load. 5 min/5 min lookback
Store RPC Avg. Latency The average latency, in milliseconds (ms), of RPC requests. The average is calculated over all RPCs since exrpc32 was loaded. 5 min/5 min lookback
Store RPC Requests Failed (%) The percentage of failed requests in the total number of RPC requests. Failed means the sum of failed with error code plus failed with exception. 5 min/5 min lookback
Store RPC Requests Outstanding The total number of outstanding RPC requests. Used for determining current load. 5 min/5 min lookback
Store RPC Requests Sent/sec The current rate of initiated RPC requests per second. Used for determining current load. 5 min/5 min lookback
Store RPC Slow Requests (%) The percentage of slow RPC requests among all RPC requests. A slow RPC request is one that has taken more than 500 ms. 5 min/5 min lookback
Store RPC Slow Requests Avg. Latency The average latency, in milliseconds (ms), of slow requests. Used for determining the average latencies of RPC slow requests. 5 min/5 min lookback

Client Access

The following services belong to the MSExchange_ClientAccess parent service.

Client Access Availability

Client Access services on Mailbox servers provide authentication and proxy services for internal and external client connections. This service provides the following Client Access Availability statistics:

KPI Description KPI search schedule and lookback time
AD Topology Service Provides Active Directory topology information to Exchange services. If this service is stopped, most Exchange services are unable to start. 5 min/5 min lookback
Address Book Service Microsoft Exchange Address Book service 5 min/5 min lookback
Exchange Service Host Provides a host for several Microsoft Exchange services. 5 min/5 min lookback
FDS Service Microsoft Exchange File Distribution service 5 min/5 min lookback
Forms-Based Authentication Service Exchange Active Directory Provider 5 min/5 min lookback
IIS Service Provides Web connectivity and administration through the Internet Information Services Manager. 5 min/5 min lookback
Monitoring Service This service allows applications to call the Exchange diagnostic cmdlets. 5 min/5 min lookback
Protected Service Host Microsoft Exchange Protected Service Host service 5 min/5 min lookback
RPC Client Access Service Manages client RPC connections for Exchange. 5 min/5 min lookback
System Attendant Service Exchange System Attendant Service 5 min/5 min lookback

Active Sync

Exchange ActiveSync is an Exchange synchronization protocol that's optimized to work together with high-latency and low-bandwidth networks. The protocol, based on HTTP and XML, lets mobile phones access an organization's information on a server that's running Microsoft Exchange.

This service provides the following ActiveSync statistics:

KPI Description KPI search schedule and lookback time
ActiveSync Avg. Request Time Provides the average time that elapsed, in milliseconds (ms), waiting for a request to complete. 5 min/5 min lookback
ActiveSync Current Requests Shows the number of HTTP requests waiting to be assigned to a thread. 5 min/5 min lookback
ActiveSync Ping Commands Pending Shows the number of ping commands currently pending on the server. 5 min/5 min lookback
ActiveSync Requests/sec Shows the number of HTTP requests received from the client via ASP.NET per second. Determines the current Exchange ActiveSync request rate. Used only to determine current user load. 5 min/5 min lookback
ActiveSync Sync Commands Pending Shows the number of sync commands currently pending on the server. 5 min/5 min lookback
ActiveSync Sync Commands/sec Shows the number of sync commands processed per second. Clients use this command to synchronize items within a folder. 5 min/5 min lookback

Autodiscover

This service minimizes user configuration and deployment steps by providing clients access to the following Exchange features:

KPI Description KPI search schedule and lookback time
Autodiscover Requests/sec Shows the number of Autodiscover service requests processed each second. Determines current user load. 5 min/5 min lookback
OAB Downloads Completed Shows the number of OAB download tasks completed since the File Distribution service started. The default value is every 480 minutes or 8 hours. 5 min/5 min lookback
OAB Downloads Queued Shows the number of OAB download tasks queued since the File Distribution service started. 5 min/5 min lookback

Management

This service pertains to Exchange deployment-wide management through PowerShell and the Exchange control panel. This service provides the following Management statistics:

KPI Description KPI search schedule and lookback time
Ctrl. Panel ASP.NET Request Failures/sec Shows the number of failures per second detected by ASP.NET in the Exchange Control Panel. 5 min/5 min lookback
Ctrl. Panel Explicit Sign-On Inbound Proxy Requests/sec Shows the number of explicit sign-on requests received from a primary Client Access server per second. 5 min/5 min lookback
Ctrl. Panel Explicit Sign-On Inbound Proxy Sessions/sec Shows the number of explicit sign-on inbound proxy sessions loaded per second in the Exchange Control Panel. 5 min/5 min lookback
Ctrl. Panel Explicit Sign-On Outbound Proxy Requests/sec Shows the number of explicit sign-on requests sent to a secondary Client Access server per second. 5 min/5 min lookback
Ctrl. Panel Explicit Sign-On Outbound Session Requests/sec Shows the number of explicit sign-on outbound proxy sessions loaded per second in the Exchange Control Panel. 5 min/5 min lookback
Ctrl. Panel Explicit Sign-On Standard RBAC Requests/sec Shows the number of requests received per second by an explicit sign-on standard RBAC session. 5 min/5 min lookback
Ctrl. Panel Explicit Sign-On Standard RBAC Sessions/sec Shows the number of explicit sign-on standard RBAC sessions loaded per second in the Exchange Control Panel. 5 min/5 min lookback
Ctrl. Panel Inbound Proxy Requests/sec Shows the number of requests received from a primary Client Access server per second. 5 min/5 min lookback
Ctrl. Panel Inbound Proxy Sessions/sec Shows the number of inbound proxy sessions loaded per second in the Exchange Control Panel. 5 min/5 min lookback
Ctrl. Panel Outbound Avg. Proxy Request Response Time Shows the average time (in ms) that requests sent to a secondary Client Access server took to complete during the sampling period. 5 min/5 min lookback
Ctrl. Panel Outbound Proxy Requests/sec Shows the number of requests sent to a secondary Client Access server per second. 5 min/5 min lookback
Ctrl. Panel Outbound Proxy Sessions/sec Shows the number of outbound proxy sessions loaded per second in the Exchange Control Panel. 5 min/5 min lookback
Ctrl. Panel PowerShell Runspace Activations/sec Shows the number of Windows PowerShell runspaces activated per second in the Exchange Control Panel. 5 min/5 min lookback
Ctrl. Panel PowerShell Runspace Avg. Active Time Shows the average time (in seconds) that a Windows PowerShell runspace stays active while executing cmdlets in the Exchange Control Panel during the sampling period. 5 min/5 min lookback
Ctrl. Panel PowerShell Runspaces/sec Shows the number of Windows PowerShell runspaces created per second in the Exchange Control Panel. 5 min/5 min lookback
Ctrl. Panel RBAC Sessions/sec Shows the number of RBAC sessions loaded per second in the Exchange Control Panel. 5 min/5 min lookback
Ctrl. Panel Request Activations/sec Shows the number of requests activated per second in the Exchange Control Panel. 5 min/5 min lookback
Ctrl. Panel Requests - Avg. Response Time Shows the average time in milliseconds (ms) the Exchange Control Panel took to respond to a request during the sampling period. 5 min/5 min lookback

Outlook Anywhere

Outlook Anywhere, formerly known as RPC over HTTP, lets clients who use Microsoft Outlook 2013, Outlook 2010, or Outlook 2007 connect to their Exchange servers from outside the corporate network or over the Internet using the RPC over HTTP Windows networking component.

This service provides the following Outlook Anywhere statistics:

KPI Description KPI search schedule and lookback time
EWS Connection Attempts/sec Shows the rate that connections to the Web service are being attempted. Determines current user load. 5 min/5 min lookback
EWS Current Connections Shows the current number of connections established with the Web service. Determines current user load. 5 min/5 min lookback
EWS Requests/sec Shows the number of requests processed each second. Determines current user load. 5 min/5 min lookback
Free/Busy Request Processing Time Shows the average time to process a free/busy request in seconds. One request may contain multiple mailboxes. Free/busy responses don't have meeting suggestions. 5 min/5 min lookback

Outlook Web Access

Outlook Web Access, also known as Microsoft Outlook Web App, lets users access their Exchange mailbox from almost any Web browser. This service provides the following Outlook Web Access statistics:

KPI Description KPI search schedule and lookback time
OWA Avg. Response Time The average time in milliseconds (ms) between the beginning and the end of an OEH or an ASPX request. 5 min/5 min lookback
OWA Avg. Search Time Shows the average time that elapsed while waiting for a search to complete. 5 min/5 min lookback
OWA Current Users Shows the number of unique users currently logged on to Outlook Web App. This value monitors the number of unique active user sessions, so that users are only removed from this counter after they log off or their session times out. Determines current user load. 5 min/5 min lookback
OWA Requests/sec Shows the number of requests handled by Outlook Web App per second. Determines current user load. 5 min/5 min lookback

RPC Client Access

This service manages client RPC connections for Exchange. This service provides the following RPC Client Access statistics:


KPI Description KPI search schedule and lookback time
Client Access RPC Avg. Latency Shows the latency, in milliseconds (ms), averaged for the past 1,024 packets. 5 min/5 min lookback
Client Access RPC Operations/sec Shows the rate at which RPC operations occur, per second. 5 min/5 min lookback
Client Access RPC User Count Shows the number of users connected to the service. 5 min/5 min lookback
Client RPC Active User Count Shows the number of unique users that have shown some activity in the last 2 minutes. 5 min/5 min lookback
Client RPC Connection Count Shows the total number of client connections maintained. 5 min/5 min lookback
Client RPC Requests Shows the number of client requests currently being processed by the RPC Client Access service. 5 min/5 min lookback

Legacy Clients

The following services belong to the MSExchange_Legacy_Clients parent service.

Legacy Clients Availability

This service provides the following Legacy Clients Availability statistics:

KPI Description KPI search schedule and lookback time
Exchange Service Host Provides a host for several Microsoft Exchange services. 5 min/5 min lookback
IIS Service Provides Web connectivity and administration through the Internet Information Services Manager. 5 min/5 min lookback
IMAP4 Service Provides Internet Message Access Protocol service to clients. If this service is stopped, clients cannot connect to this computer using the IMAP4 protocol. 5 min/5 min lookback
POP3 Service Provides Post Office Protocol version 3 service to clients. If this service is stopped, clients cannot connect to this computer using the POP3 protocol. 5 min/5 min lookback

POP3

Proxies POP3 client connections from the front-end Client Access services to the back-end IMAP4 service on Mailbox servers. This service provides the following POP3 statistics:


KPI Description KPI search schedule and lookback time
POP3 Avg. Command Processing Time Provides the average Command Processing Time in milliseconds (ms). 5 min/5 min lookback
POP3 Connections/min The rate of POP3 client connections that are being made to the server. 5 min/5 min lookback
POP3 LDAP Latency Provides the average LDAP latency in milliseconds (ms). 5 min/5 min lookback
POP3 Mailbox Offline Errors/min Provides the number of mailbox offline errors that occur per minute. 5 min/5 min lookback
POP3 Permanent AD Errors/min Provides the number of permanent Active Directory errors that occur each minute. 5 min/5 min lookback
POP3 Permanent Storage Errors/min Provides the number of permanent storage errors that occur each minute. 5 min/5 min lookback
POP3 RPC Latency Provides the average time, in milliseconds (ms), that it takes for a remote procedure call to return results from a Mailbox server, averaged over RPC calls in the last minute. 5 min/5 min lookback
POP3 Transient AD Errors/min Provides the number of Active Directory transient errors that occur each minute. 5 min/5 min lookback
POP3 Transient Errors/min Provides the number of transient errors that occur each minute. 5 min/5 min lookback
POP3 Transient Mailbox Connection Failures/min Provides the number of transient errors that occur each minute when connecting to a Mailbox server. 5 min/5 min lookback
POP3 Transient Storage Errors/min Provides the number of transient storage errors that occur each minute. 5 min/5 min lookback

IMAP4

Proxies IMAP4 client connections from the front-end Client Access services to the back-end IMAP4 services on Mailbox servers. This service provides the following IMAP4 statistics:

KPI Description KPI search schedule and lookback time
IMAP4 Avg. Command Processing Time Provides the Average Command Processing Time in milliseconds (ms). 5 min/5 min lookback
IMAP4 Connections/min The rate of IMAP4 client connections that are being made to the server. 5 min/5 min lookback
IMAP4 LDAP Latency Provides the average LDAP latency in milliseconds (ms). 5 min/5 min lookback
IMAP4 Mailbox Offline Errors/min Provides the number of mailbox offline errors that occur per minute. 5 min/5 min lookback
IMAP4 Permanent Storage Errors/min Provides the number of permanent storage errors that occur each minute. 5 min/5 min lookback
IMAP4 Permanent AD Errors/min Provides the number of permanent Active Directory errors that occur each minute. 5 min/5 min lookback
IMAP4 RPC Latency Provides the average time, in milliseconds (ms), that it takes for a remote procedure call to return results from a Mailbox server, averaged over RPC calls in the last minute. 5 min/5 min lookback
IMAP4 Transient AD Errors/min Provides the number of Active Directory transient errors that occur each minute. 5 min/5 min lookback
IMAP4 Transient Errors/min Provides the number of transient errors that occur each minute. 5 min/5 min lookback
IMAP4 Transient Mailbox Connection Failures/min Provides the number of transient errors that occur each minute when connecting to a Mailbox server. 5 min/5 min lookback
IMAP4 Transient Storage Errors/min Provides the number of transient storage errors that occur each minute. 5 min/5 min lookback

Transport

The following services belong to the MSExchange_Transport parent service.

Transport Availability

This service handles all SMTP mail flow for the organization, performs message categorization, and performs message content inspection. This service provides the following Transport Availability statistics:

KPI Description KPI search schedule and lookback time
AD Topology Service Provides Active Directory topology information to Exchange services. If this service is stopped, most Exchange services are unable to start. 5 min/5 min lookback
Anti-Spam Service Microsoft Exchange Anti-spam Update Service 5 min/5 min lookback
Edge Sync Service Replicates configuration and recipient data from the Hub Transport servers to the Edge Transport servers. 5 min/5 min lookback
Exchange Service Host Provides a host for several Microsoft Exchange services. 5 min/5 min lookback
Exchange Submission Service This service, running on the Mailbox servers, receives the Submit events, processes the messages by converting them from MAPI to MIME, and then hands them over to the Transport service on a Mailbox server. 5 min/5 min lookback
Fast Search Indexer Drives indexing and querying of data for Exchange. 5 min/5 min lookback
IIS Service Provides Web connectivity and administration through the Internet Information Services Manager. 5 min/5 min lookback
Mail Delivery Service This service, running on the Mailbox servers, receives mail items from the Transport service on Mailbox servers, submits them to extension modules for processing, and then commits them into a mailbox database. 5 min/5 min lookback
Mail Submission Service Submits messages from the Mailbox server to the Hub Transport servers. 5 min/5 min lookback
Mailbox Replication Service The Mailbox Replication Service, MRS, which resides on all Microsoft Exchange Server 2010 Client Access servers, is the service responsible for moving mailboxes, importing and exporting .PST files, and restoring disabled and soft-deleted mailboxes. 5 min/5 min lookback
Protected Service Host Microsoft Exchange Protected Service Host service 5 min/5 min lookback
Transport Log Search Service Microsoft Exchange Transport Log Search service 5 min/5 min lookback
Transport Service Microsoft Exchange Transport service 5 min/5 min lookback

Inbound SMTP

This service provides details about inbound message traffic:

KPI Description KPI search schedule and lookback time
SMTP Receive: Avg. Message Size Shows the average number of message bytes per inbound message received. Determines sizes of messages being received for an SMTP receive connector. 5 min/5 min lookback
Provides details about inbound message traffic. Shows the number of messages received by the SMTP server each second. Determines current load. Compare values to historical baselines. 5 min/5 min lookback

Outbound SMTP

This service provides details about the SMTP Send service:

KPI Description KPI search schedule and lookback time
SMTP Send: Messages/sec Shows the number of messages sent by the SMTP send connector each second. Determines current load. Compare values to historical baselines. 5 min/5 min lookback

Transport Database

This service monitors the activity of the Microsoft Exchange Transport Database:

KPI Description KPI search schedule and lookback time
DB I/O Database Reads/sec Shows the rate of database read operations completed. Determines the current load. Compare values to historical baselines. 5 min/5 min lookback
DB I/O Database Writes/sec Shows the rate of database write operations completed. Determines the current load. Compare values to historical baselines. 5 min/5 min lookback
DB I/O Log Reads/sec Shows the rate of log file read operations completed. Determines the current load. Compare values to historical baselines. 5 min/5 min lookback
DB I/O Log Writes/sec Shows the rate of log file write operations completed. Determines the current load. Compare values to historical baselines. 5 min/5 min lookback
DB Log Generation Checkpoint Depth Represents the amount of work in count of log files that needs to be redone or undone to the database files if the process fails. 5 min/5 min lookback
DB Log Record Stalls/sec Shows the number of log records that can't be added to the log buffers per second because they are full. If this counter is nonzero most of the time, the log buffer size may be a bottleneck. 5 min/5 min lookback
DB Log Threads Waiting Shows the number of threads waiting for their data to be written to the log to complete an update of the database. If this number is too high, the log may be a bottleneck. 5 min/5 min lookback
DB Version Buckets Allocated Total number of version buckets allocated. Shows the default backpressure values as listed in the edgetransport.exe.config file. 5 min/5 min lookback

Transport Disk

This service monitors Logical and Physical disk latency:

KPI Description KPI search schedule and lookback time
Avg. Disk Read Latency Shows the average time, in seconds, of a read of data from the disk. 5 min/5 min lookback
Avg. Disk Write Latency Shows the average time, in seconds, of a write of data to the disk. 5 min/5 min lookback

Transport Dumpster

Transport dumpster helps protect against data loss by maintaining a queue of successfully delivered messages that hadn't replicated to the passive mailbox database copies in the database availability group (DAG).

This service provides the following Transport Dumpster statistics:

KPI Description KPI search schedule and lookback time
Transport Dumpster Deletes/sec Shows the rate at which items are deleted from the transport dumpster on this server. Determines the current rate of transport dumpster deletions. 5 min/5 min lookback
Transport Dumpster Inserts/sec Shows the rate at which items are inserted into the transport dumpster on this server. Determines the current rate of transport dumpster inserts. 5 min/5 min lookback
Transport Dumpster Item Count Shows the total number of mail items currently in the transport dumpster on this server. Shows the current number of items being held in the transport dumpster. 5 min/5 min lookback
Transport Dumpster Size Shows the total size (in bytes) of mail items currently in the transport dumpster on this server. 5 min/5 min lookback

Extensibility Agent

This service monitors the activities of transport agents and the time taken by each agent to process email messages. This service provides the following Extensibility Agent statistics:

KPI Description KPI search schedule and lookback time
Avg. Extensibility Agent Processing Time Shows the average agent processing time in seconds per event. 5 min/5 min lookback
Total Agent Invocations Shows the total number of invocations since the last restart. Shows the current invocation rate. 5 min/5 min lookback

Store Driver

The store driver is a software component of the Hub Transport Server that delivers inbound messages to Microsoft Exchange stores, the databases that contain public folder stores and mailbox stores. The store driver also retrieves messages from a user's outbox, and submits them for delivery.

This service provides the following Store Driver statistics:

KPI Description KPI search schedule and lookback time
Inbound: Message Delivery Attempts/sec Shows the number of attempts for delivering transport mail items per second. Determines current load. Compare values to historical baselines. 5 min/5 min lookback
Inbound: Recipients Delivered/sec Shows the number of inbound recipients delivered per second. Determines current load. Compare values to historical baselines. 5 min/5 min lookback
RPC Inbound: Local Delivery Calls/sec Shows the number of local delivery attempts per second. Determines current load. Compare values to historical baselines. 5 min/5 min lookback
RPC Outbound: Submitted Mail Items/sec Shows the number of mail items per second being submitted. Determines current load. Compare values to historical baselines. 5 min/5 min lookback

Transport Queues

This service provides details about the Exchange Server Transport Queues:

KPI Description KPI search schedule and lookback time
Active Mailbox Delivery Queue Length Shows the number of messages in the active mailbox queues. 5 min/5 min lookback
Active Non-SMTP Delivery Queue Length Shows the number of messages in the drop directory used by a Foreign connector. 5 min/5 min lookback
Active Remote Delivery Queue Length Shows the number of messages in the active remote delivery queues. 5 min/5 min lookback
Aggregate Delivery Queue Length Shows the number of messages queued for delivery in all queues. 5 min/5 min lookback
Largest Delivery Queue Length Shows the number of messages in the largest delivery queues. 5 min/5 min lookback
Messages Completed Delivery/sec Shows the number of messages delivered per second. Determines current load. Compare values to historical baselines. 5 min/5 min lookback
Messages Queued for Delivery/sec Shows the number of messages queued for delivery per second. Determines current load. Compare values to historical baselines. 5 min/5 min lookback
Messages Submitted/sec Shows the number of messages queued in the Submission queue per second. Determines current load. Compare values to historical baselines. 5 min/5 min lookback
Poison Queue Length Shows the number of messages in the poison message queue. 5 min/5 min lookback
Retry Mailbox Delivery Queue Length Shows the number of messages in a retry state attempting to deliver a message to a remote mailbox. 5 min/5 min lookback
Retry Non-SMTP Delivery Queue Length Shows the number of messages in a retry state in the non-SMTP gateway delivery queues. 5 min/5 min lookback
Retry Remote Delivery Queue Length Shows the number of messages in a retry state in the remote delivery queues. 5 min/5 min lookback
Submission Queue Length Shows the number of messages in the submission queue. 5 min/5 min lookback
Unreachable Queue Length Shows the number of messages in the Unreachable queue. 5 min/5 min lookback

Base Metrics

The following services belong to the MSExchange_BaseMetrics parent service.

.NET CLR Memory

The .NET CLR Memory category includes KPIs that provide information about the garbage collector:

KPI Description KPI search schedule and lookback time
# Bytes in all Heaps Displays the sum of the Gen 1 Heap Size, Gen 2 Heap Size, and Large Object Heap Size counters. This counter indicates the current memory allocated in bytes on the garbage collection heaps. 5 min/5 min lookback
% Time in GC Displays the percentage of elapsed time that was spent performing a garbage collection since the last garbage collection cycle. This counter usually indicates the work done by the garbage collector to collect and compact memory on behalf of the application. This counter is updated only at the end of every garbage collection. This counter is not an average; its value reflects the last observed value. 5 min/5 min lookback

ASP.NET

ASP.NET supports the application performance KPIs of a single instance of an ASP.NET application. The KPIs display zero when no applications are currently executing on the server. This service provides the following ASP.NET statistics:

KPI Description KPI search schedule and lookback time
Application Restarts Shows the number of times the application has been restarted during the Web server's lifetime. 5 min/5 min lookback

DNS

The Domain Name System (DNS) Performance KPIs monitor the status of the DNS Server service on a Windows device. This service provides the following DNS statistics:

KPI Description KPI search schedule and lookback time
Caching Memory The total amount of system memory in use by the DNS Server service for caching. Monitor this counter to determine whether the cache use is optimizing the use of available memory. Dynamic Update Received The total number of dynamic update requests received by the DNS server. Monitor this counter after enabling dynamic updates to determine whether DNS clients are attempting to update their DNS addresses. 5 min/5 min lookback
Database Node Memory The total amount of system memory in use by the DNS server on this node for database pages. 5 min/5 min lookback
Recursive Queries/sec The average number of recursive queries received by the DNS server in each second. 5 min/5 min lookback
Recursive Query Failure/sec The average number of recursive query failures in each second. 5 min/5 min lookback
Total Response Sent/sec The average number of responses sent by the DNS server in each second. 5 min/5 min lookback

Logic Disk

This consists of KPIs that monitor logical partitions of hard or fixed disk drives. Logical disks are identified by their drive letter, such as "C." This service provides the following Logic Disk statistics:

KPI Description KPI search schedule and lookback time
% Disk Read Time Amount of time your logical disks are being read, calculated as a percentage of total time. 5 min/5 min lookback
% Disk Write Time Amount of time your disks are being written to, calculated as a percentage of total time. 5 min/5 min lookback
% Free Space Amount of logical disk space which is Free Space, calculated as a percentage of total logical disk space. 5 min/5 min lookback
Free Megabytes Amount of Free Megabytes (MBs) on your logical disk in MBs. 5 min/5 min lookback

Memory

This service consists of KPIs that describe the behavior of physical and virtual memory on the computer. Physical memory is the amount of RAM on the computer. Virtual memory consists of space in physical memory and on disk. Many of the memory KPIs monitor paging, which is the movement of pages of code and data between disk and physical memory. Excessive paging is a symptom of a memory shortage and can cause delays that interfere with all system processes.

This service provides the following Memory statistics:

KPI Description KPI search schedule and lookback time
Available MBytes Available MBytes is the amount of physical memory, in Megabytes, immediately available for allocation to a process or for system use. It is equal to the sum of memory assigned to the standby (cached), free and zero page lists. 5 min/5 min lookback
Committed Bytes Committed Bytes is the amount of committed virtual memory while Commit Limit is the amount of virtual memory that can be committed without having to extend the paging file(s). 5 min/5 min lookback
Page Reads/sec Pages/sec is the rate at which pages are read from or written to disk to resolve hard page faults. This monitoring is based on the Memory\Pages/sec counter, which is a primary indicator of the kinds of faults that cause system-wide delays. Overall system performance may significantly diminish. 5 min/5 min lookback
Page Writes/sec The rate at which the disk was read to resolve hard page faults. 5 min/5 min lookback
Pages/sec The sum of Pages Input/sec and Pages Output/sec counters which is the rate at which pages are being read and written as a result of page faults. 5 min/5 min lookback

Store Interface

The Managed Store processes Exchange Server 2016 and Exchange Server 2019 data. The Managed Store is also known as the MSExchage Store Interface, the Information Store, or the Store. The Managed Store was introduced in Exchange Server 2013. The Managed Store uses a controller/worker process model that provides storage process isolation and faster database failover. The Managed Store also uses a static database caching mechanism that replaces the dynamic buffer algorithm in previous versions of Exchange. The service provides the following Managed Store statistics:

KPI Description KPI search schedule and lookback time
RPC Latency average/ ms Shows the average latency, in milliseconds (ms), of RPC requests. The average is calculated over all RPCs since exrpc32 was loaded. 5 min/5 min lookback
RPC Requests Sent/sec Shows the current rate of initiated RPC requests per second. Used for determining current load. 5 min/5 min lookback
RPC Requests failed (%) Shows the percentage of failed requests in the total number of RPC requests. Failed means the sum of failed with error code plus failed with exception. 5 min/5 min lookback

Network Interface

This service provides KPIs captured from each of the network cards in your servers. If you have more than one network card in your server, you will see one instance of each counter for every network card. This service provides the following Network Interface statistics:

KPI Description KPI search schedule and lookback time
Bytes Received/sec Bytes Received/sec is the rate at which bytes are received over each network adapter, including framing characters. Network Interface\\Bytes Received/sec is a subset of Network Interface\\Bytes Total/sec. 5 min/5 min lookback
Bytes Sent/sec Bytes Sent/sec is the rate at which bytes are sent over each network adapter, including framing characters. Network Interface\\Bytes Sent/sec is a subset of Network Interface\\Bytes Total/sec. 5 min/5 min lookback
Current Bandwidth \Network Interface(*)\Current Bandwidth is an estimate of the current bandwidth of the network interface in bits per second (bps). The expected value of a 1 Gbps connection is 1,000,000,000. Network teaming can make this value double the expected value. 5 min/5 min lookback
Packets/sec Packets/sec is the rate at which packets are sent and received on the network interface. 5 min/5 min lookback

NTDS

NTDS consists of KPIs that provide statistics about the activity of the Active Directory directory service:

KPI Description KPI search schedule and lookback time
Base searches/sec TODO 5 min/5 min lookback
DS % Reads from KCC Percentage of directory reads coming from Knowledge Consistency Checker (KCC), an Active Directory component that is responsible for generating the replication topology between domain controllers. 5 min/5 min lookback
DS % Reads from LSA Percentage of directory reads coming from Local Security Authority (LSA), a protected subsystem that maintains the security for the local computer. 5 min/5 min lookback
DS % Reads from SAM Percentage of directory reads coming from Security Accounts Manager (SAM) interface, that provides compatibility between Windows 2000 and Windows NT 4.0 domains. The Lightweight Directory Access Protocol (LDAP) interface that provides the API for LDAP clients and exposes the Active Directory Services Interface (ADSI) so additional applications may be written that can talk to the Active Directory. 5 min/5 min lookback
DS % Searches from KCC Percentage of directory searches coming from Knowledge Consistency Checker (KCC), an Active Directory component that is responsible for generating the replication topology between domain controllers. 5 min/5 min lookback
DS % Searches from LDAP Percentage of directory searches coming from Lightweight Directory Access Protocol (LDAP) interface that provides the API for LDAP clients and exposes the Active Directory Services Interface (ADSI) so additional applications may be written that can talk to the Active Directory. 5 min/5 min lookback
DS % Searches from LSA Percentage of directory searches coming from Local Security Authority (LSA), a protected subsystem that maintains the security for the local computer. 5 min/5 min lookback
DS % Searches from NTDSAPI Percentage of directory searches coming from Active Directory Domain Services API. 5 min/5 min lookback
DS % Searches from SAM Percentage of directory searches coming from Security Accounts Manager (SAM) interface, that provides compatibility between Windows 2000 and Windows NT 4.0 domains. 5 min/5 min lookback
DS % Writes from LDAP Percentage of directory writes coming from Lightweight Directory Access Protocol (LDAP) interface that provides the API for LDAP clients and exposes the Active Directory Services Interface (ADSI) so additional applications may be written that can talk to the Active Directory. 5 min/5 min lookback
DS % Writes from NTDSAPI Percentage of directory writes coming from Active Directory Domain Services API. 5 min/5 min lookback
DS % Writes from SAM Percentage of directory writes coming from Security Accounts Manager (SAM) interface, that provides compatibility between Windows 2000 and Windows NT 4.0 domains. 5 min/5 min lookback
DS Directory Reads/sec Shows the number of directory reads per second. 5 min/5 min lookback
DS Directory Searches/sec Shows the number of directory searches per second. 5 min/5 min lookback
DS Directory Writes/sec Shows the number of directory writes per second. 5 min/5 min lookback
Database modifications/sec Shows the number of directory modifications per second. 5 min/5 min lookback

Physical Disk

The PhysicalDisk service consists of KPIs that monitor hard or fixed disk drives. Disks are used to store file, program, and paging data. Disks are read to retrieve these items, and are written to record changes to them. The values of physical disk KPIs are sums of the values of the logical disks (or partitions) into which they are divided.

This service provides the following PhysicalDisk statistics:

KPI Description KPI search schedule and lookback time
% Disk Read Time The percentage of time the physical disk spent reading. The % Disk Read Time and % Disk Write Time counters can exaggerate disk time. This is because they report busy time based on the duration of the I/O request, which includes time spent in activities other than reading to or writing from the disk. It then sums up all busy time for all requests and divides it by the elapsed time of the sample interval. If multiple requests are in process at a time, the total request time is greater than the time of the sample interval; as a result, reported disk utilization can exceed actual utilization. 5 min/5 min lookback
% Disk Write Time The percentage of time the physical disk is spent writing. The % Disk Read Time and % Disk Write Time counters can exaggerate disk time. This is because they report busy time based on the duration of the I/O request, which includes time spent in activities other than reading to or writing from the disk. It then sums up all busy time for all requests and divides it by the elapsed time of the sample interval. If multiple requests are in process at a time, the total request time is greater than the time of the sample interval; as a result, reported disk utilization can exceed actual utilization. 5 min/5 min lookback
Disk Reads/sec The total number of individual disk IO read requests completed over a period of one second on the physical disk. 5 min/5 min lookback
Disk Writes/sec The total number of individual disk IO write requests completed over a period of one second on the physical disk. 5 min/5 min lookback
Split IO/Sec Measures the rate of IO split due to file fragmentation on the physical disk. This happens if the IO request touches data on non-contiguous file segments. 5 min/5 min lookback
% Free Space Amount of physical disk space which is Free Space, calculated as a percentage of total physical disk space. 5 min/5 min lookback

Process

This service provides KPIs highlighting the process or running process as the set of instructions currently being processed by the computer processor. A typical computer has multiple processes running all the time to help manage the operating system, its hardware, and the software running on the computer.

For example, in Windows you can see each of the processes running by opening the Processes tab in Task Manager. Windows Processes are Windows Services and background programs you normally don't see running on the computer. A process may be a printer program that runs in the background and monitors the ink levels and other printer settings while the computer is running.

This service provides the following Process statistics:

KPI Description KPI search schedule and lookback time
% Privileged Time Percentage of elapsed time that the process threads spent executing code in privileged mode. When a Windows system service is called, the service will often run in privileged mode to gain access to system-private data. Such data is protected from access by threads executing in user mode. Calls to the system can be explicit or implicit, such as page faults or interrupts. Unlike some early operating systems, Windows uses process boundaries for subsystem protection in addition to the traditional protection of user and privileged modes. Some work done by Windows on behalf of the application might appear in other subsystem processes in addition to the privileged time in the process.

Privileged Utility is the amount of work a processor is completing while executing in privileged mode, as a percentage of the amount of work the processor could complete if it were running at its nominal performance and never idle. On some processors, Privileged Utility may exceed 100%.

5 min/5 min lookback
% Processor Time Shows the percentage of elapsed processor time that all process threads used to execute instructions. An instruction is the basic unit of execution in a computer. A thread is the object that executes instructions, and a process is the object created when a program is run. Code executed to handle some hardware interruptions and trap conditions are included in this count. 5 min/5 min lookback
% User Time % User Time is the percentage of elapsed time the processor spends in the user mode. User mode is a restricted processing mode designed for applications, environment subsystems, and integral subsystems. 5 min/5 min lookback
IO Data Bytes/sec Shows the rate at which the process is reading and writing bytes in I/O operations. This counter counts all I/O activity generated by the process to include file, network and device I/'s. 5 min/5 min lookback
IO Other Bytes/sec Shows the rate at which the process is issuing bytes to I/O operations that don't involve data such as control operations. This counter counts all I/O activity generated by the process to include file, network and device I/O's. 5 min/5 min lookback
IO Read Bytes/sec Shows the rate at which the process is reading bytes from I/O operations. This counter counts all I/O activity generated by the process to include file, network and device I/O's. 5 min/5 min lookback
IO Write Bytes/sec Shows the rate the process is writing bytes to I/O operations. This counter counts all I/O activity generated by the process to include file, network and device I/O's. 5 min/5 min lookback
Page Faults/sec Shows the rate at which page faults by the threads executing in this process are occurring. A page fault occurs when a thread refers to a virtual memory page that is not in its working set in main memory. This does not cause the page to be fetched from disk if it is on the standby list and currently stored in the main memory, or if it is in use by another process with which the page is shared. 5 min/5 min lookback

Processor

This service provides KPIs associated to CPU utilization on the servers. This service provides the following Processor statistics:

KPI Description KPI search schedule and lookback time
% Processor Time % Processor Time is the percentage of elapsed time that the processor spends to execute a non-idle thread. Processor Time is calculated by measuring the percentage of time that the processor spends executing the idle thread and then subtracting that value from 100%. Each processor has an idle thread to which time is accumulated when no other threads are ready to run. The average percentage of busy time observed during the sample interval is displayed.

The calculation of whether the processor is idle is performed at an internal sampling interval of the system clock tick. On fast processors, % Processor Time can underestimate the processor utilization as the processor may be spending a lot of time servicing threads between the system clock sampling interval. For example, Workload based timer applications are more likely to be measured inaccurately as timers are signaled just after the sample is taken.
Processor Utility is the amount of work a processor is completing, as a percentage of the amount of work the processor could complete if it were running at its nominal performance and never idle. On some processors, Processor Utility may exceed 100%.

5 min/5 min lookback
% User Time Shows the percentage of processor time spent in user mode. User mode is a restricted processing mode designed for applications, environment subsystems, and integral subsystems. 5 min/5 min lookback

System

The System service delivers KPIs focused on the Windows Server resources and utilization of these resources and throughput.

Instances of \Process(*)\% Processor Time show all of the processor usage across all of the threads of the process. Any single process can consume up to 100% times the number of processors so long as it has enough threads to keep more than one processor busy.

Example:
An IIS worker process (w3wp.exe) is multithreaded and can consume up to 800% processor time on a system with eight logical processors. Alternatively, a single-threaded process can only consume up to 100% of a single logical processor. The single thread might run on a single processor or it might be evenly distributed across processors depending on the operating system.

This service provides the following System statistics:

KPI Description KPI search schedule and lookback time
File Read Bytes/sec Shows the overall rate at which bytes are read to satisfy file system read requests to all devices on the computer, including read operations from the file system cache. It is measured in numbers of bytes per second. 5 min/5 min lookback
File Read Operations/sec Shows the combined rate of file system read requests to all devices on the computer, including requests to read from the file system cache. It is measured in numbers of read operations per second. 5 min/5 min lookback
File Write Bytes/sec Shows the combined rate of file system read requests to all devices on the computer, including requests to write from the file system cache. It is measured in numbers of read operations per second. 5 min/5 min lookback
File Write Operations/sec Shows the combined rate of file system write requests to all devices on the computer, including requests to write to data in the file system cache. It is measured in numbers of write operations per second. 5 min/5 min lookback
Processes Total number of processes running. 5 min/5 min lookback
System Calls/sec Shows the combined rate of calls to Windows system service routines by all processes running on the computer. These routines perform all of the basic scheduling and synchronization of activities on the computer, and provide access to non-graphic devices, memory management, and name space management. 5 min/5 min lookback
System Uptime Total time since last startup. 5 min/5 min lookback
Threads Total number of threads running. 5 min/5 min lookback

TCPv4

The TCPv4 and TCPv6 service provides KPIs associated with network resource utilization:

KPI Description KPI search schedule and lookback time
Connections Established Shows the number of TCP connections for which the current state is either ESTABLISHED or CLOSE-WAIT. The number of TCP connections that can be established is constrained by the size of the nonpaged pool. When the nonpaged pool is depleted, no new connections can be established. 5 min/5 min lookback
Connections Reset Shows the number of times TCP connections have made a direct transition to the CLOSED state from either the ESTABLISHED state or the CLOSE-WAIT state. 5 min/5 min lookback
Connection Failures Shows the number of TCP connections for which the current state is either ESTABLISHED or CLOSE-WAIT. The number of TCP connections that can be established is constrained by the size of the nonpaged pool. When the nonpaged pool is depleted, no new connections can be established. 5 min/5 min lookback

Windows

The Windows service provides a high-level abstraction layer and KPIs that focus on disk usage. System administrators can use these indicators to monitor systems for performance or behavior problems, and resource usage on the servers.

This service provides the following Windows statistics:

KPI Description KPI search schedule and lookback time
Disk Total Space (KB) Total space of disk partition is monitored in real-time. 5 min/5 min lookback
Disk Free Space (KB) Total free space of disk partition monitored in real-time. 5 min/5 min lookback
Last modified on 22 October, 2021
PREVIOUS
Dashboard reference for the Content Pack for Microsoft Exchange
  NEXT
About the Content Pack for Monitoring and Alerting

This documentation applies to the following versions of Splunk® Content Packs for ITSI and IT Essentials Work: current


Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters