In this blog, I will explain one of the best tools provided by Microsoft for Exchange server i.e. ExMon. Microsoft introduced Exchange server User Monitor tool that helps administrator to monitor the performance of the Exchange server to know how it is affected by individual Outlook client. The tool enables administrator to collect & view real time data so that he can analyze current client usage pattern, it will help him to plan for future use accordingly.

ExMon also allows administrator to view IP addresses of Exchange users, CPU usage, network traffic, Outlook edition & mode (Cached exchange mode or Classic online mode), sever side processor latency, total latency for network etc.

Even though ExMon enables administrator to view & evaluate individual users’ usage, it doesn’t measure traffic by non-MAPI protocols like SMTP, POP3, IMAP4. ExMon is capable of measuring only MAPI traffic.

Installation of ExMon 

ExMon can be installed on Exchange 2000 Server SP2 and later versions, Exchange Server 2003 SP1 and later versions, Exchange Server 2007 SP1 and later version.

Step 1: Download ExMon, it can be downloaded from Microsoft sites.

Step 2: Go to C:\Program Files\ExMon then execute ExMon.msi. This leads to open below Wizard. Click Next to proceed.

E0E11i.jpeg


Step 3: Next step is to Read & accept the agreement. Click next to proceed.

trvWuG.jpeg

Step 4: Now browse the location where you want to save the installed ExMon or it can be saved in default location.

7AYMKC.jpeg

Step 5: Now click Finish to complete the installation.

zdKLRy.jpeg

Step 6: Next step is to add two registry keys- RpcEtwTracing & UserPerformanceClock to the registry as these keys help to collect the data. ExMon.reg file can be found in installation directory. All you have to do is double click the file or run through a command prompt window.

q2Mrze.jpeg 

Step 7: After completing the above steps, now ExMon can be started by executing the ExMon.exe file from the installation directory (C:\Program Files\ExMon). The below screen will be shown that contains all currently connected IMAP users.

3ApM9x.jpeg 

All the collected data is saved in Event Trace Log (.ETL) files in the installation directory (C:\Program Files\ExMon), as shown in below figure.

mOAnKR.jpeg

Export data with ExMon

ExMon can export collected data to comma-separated text files (.csv) that can be viewed by Microsoft Excel, Microsoft Access, & Microsoft SQL server. You can export files by using either –SU, -SV or SC in command prompt. 

Below command will export the By User data to a .CSV file.

ExMon.exe –SU “C:\Program Files\ExMon\data\ByUser.csv”

ExMon Syntax

exmon.exe

exmon.exe “[Drive:] [Path] InputFileName”

exmon.exe /h

exmon.exe /?

exmon.exe [/ {SU|SV|SC} “[Drive:] [Path] OutputFileName”

“[Drive:] [Path] InputFileName”

Multiple files can be exported at a same time by combining SU, SV, SC. 

st03CD.png

 Unknown StartTrace Error (183) Message

ExMon refresh the real time data every 1minute. If there is a lot of data in Exchange server then ExMon can be crashed while collecting the data with the message ExMon has stopped working. You need to choose between check online or close the program.

When you try to reopen ExMon, you will encounter with an Unknown StartTrace error (183). 

Uy6bk4.jpeg

This error occur because there is an old Event Trace is still running in the background. You need to stop this old trace using a tool called Tracelog.exe for Windows Server 2000/2003. You have to make sure Exmon.exe isn’t running.

V92DFX.jpeg

In Windows Server 2008 you can stop the old Event Trace using a tool called Logman.exe by running the following commands:

HkQ0kR.png

Logman stop "Exchange Event Trace" -ets

WXNRs7.png

After completing the above steps, now your ExMon will work correctly.