Known Issue: Disable Transport Handling and Mailbox components in Service Analyzer for Exchange Server 2007 and Server 2010 environments

Introduction

This page discusses how to fix an issue where tiles in the Service Analyzer and Service Health pages spuriously appear as red when the Splunk App for Microsoft Exchange monitors an Exchange Server 2007 or Exchange Server 2010 environment.

Symptoms

When you visit the Service Analyzer page, the "Mailbox" and "Transport Handling" tiles appear red/in a "Critical/Error" state, even though no data is present that warrants the services appear in such a state.

Cause

In Exchange Server 2007 and 2010, the Mailbox and Hub Transport roles were separate and had their own set of exclusive Windows services. In Exchange Server 2013, the Hub transport role was merged with the Mailbox role.

By default, Service Analyzer shows all of the components for both roles in the Hub Transport and Mailbox services. This means that if you have an Exchange Server 2007 or Exchange Server 2010 environment, you will see red components for those services.

Workaround

To fix this, use the configure components page to disable the following components for your Exchange Server 2007 and 2010 hosts:

Transport Handling role	Mailboxes role
Information Store Mail Submission Service Mailbox Assistants Replication Service RPC Client Access Service Search Service Backup Extension System Attendant Service Throttling Service	Anti-Spam Service Edge Sync Service Protected ServiceHost Transport Service

This problem only appears on Windows systems.