locked
Exchange 2010 - ClientAccessInformationWorker RRS feed

  • Question

  • Hello,

    Does anyone can help me to understand what the class "ClientAccessInformationWorker" and the monitor "KHI: Too many failed message tracking requests via task - Red (>5%) -" stand for?

    The monitor is red and i can´t find information related! (Exchange 2010, SCOM 2007 R2)

     

    Any help is appreciated.

     

    Tuesday, June 28, 2011 11:04 AM

Answers

  • Well, it's a key health indicator.  When the # of failed message tracking requests exceeds 5%, you will see this.   This is about an exchange feature that allows message tracking requests (read receipt, delivery receipt, delete receipt).  These put additional load n the server, and if the # goes too high, you are expending considerable exchange resources on message tracking that is not working.  Let's say a spammer with a "noReply" mail address hits your MTS with 100K messages, all with read receipt turned on.   This kind of DOS is just a script kiddie "for fun" problem, and the action may be to block the sender mail in your email firewall.   Perhaps their relay has stopped routing tracking data, because of volume - this will cause the track-back mails to fail as well.

    These are KHI's for exchange - your exchange admin should be brought in if you are getting KHI Alerts.

    If you are just looking at the red/green lights in the state views or in diagram views, but are not getting any alerts, then these are just input to the correlation engine.  That will look at combinations of reds, and then raise alerts as needed.  The underlying states are not relevant or interesting unless you are getting matching KHI alerts.

     


    Microsoft Corporation
    • Marked as answer by HermanoF Wednesday, June 29, 2011 10:59 AM
    Tuesday, June 28, 2011 3:23 PM

All replies

  • Well, it's a key health indicator.  When the # of failed message tracking requests exceeds 5%, you will see this.   This is about an exchange feature that allows message tracking requests (read receipt, delivery receipt, delete receipt).  These put additional load n the server, and if the # goes too high, you are expending considerable exchange resources on message tracking that is not working.  Let's say a spammer with a "noReply" mail address hits your MTS with 100K messages, all with read receipt turned on.   This kind of DOS is just a script kiddie "for fun" problem, and the action may be to block the sender mail in your email firewall.   Perhaps their relay has stopped routing tracking data, because of volume - this will cause the track-back mails to fail as well.

    These are KHI's for exchange - your exchange admin should be brought in if you are getting KHI Alerts.

    If you are just looking at the red/green lights in the state views or in diagram views, but are not getting any alerts, then these are just input to the correlation engine.  That will look at combinations of reds, and then raise alerts as needed.  The underlying states are not relevant or interesting unless you are getting matching KHI alerts.

     


    Microsoft Corporation
    • Marked as answer by HermanoF Wednesday, June 29, 2011 10:59 AM
    Tuesday, June 28, 2011 3:23 PM
  • Thank you Dan.
    Thursday, June 30, 2011 11:10 AM
  • This will count the number of (failed) message tracking logs in Exchange.

    $7DaysOfTracking = Get-ExchangeServer | Get-MessageTrackingLog -EventID Fail -Start (get-date).adddays(-7) -ResultSize unlimited
    $7DaysOfTracking | Measure-Object 
    



    Mike Crowley | MVP
    My Blog -- Planet Technologies

    Tuesday, May 14, 2013 7:01 PM
  • Hi, is there a way we can change the Severity and Priority on this alert?

    OOO alert settings are as follow:

    Severity = Critical

    Priority - High

    I like to change this to:

    Severity = Warning

    Priority - Medium


    MA

    Is it as simple as overriding Its corresponding integer values?

    Monday, July 14, 2014 7:43 PM