locked
Unreachable queue length Value incorrect? - Exchange 2010 MP RRS feed

  • Question

  • Hi,

    We are getting email alerts advising "Unreachable queue length - sustained for 60 minutes - Red".  The Values in the email alert is very high (see bold below):

    Subject:
    New Alert: Unreachable queue length - sustained for 60 minutes - Red(>1) - Hub Transport. Priority: 2 Severity: 2 Resolution state: New

    Body:
    Alert: Unreachable queue length - sustained for 60 minutes - Red(>1) - Hub Transport.
    Source: Queues - HT01 (Hub Transport) - Site
    Path: HT01.domain.com;HT01 (Hub Transport) - Site
    Last modified by:
    System Last modified time: 18/09/2011 2:32:01 PM
    Alert description:
    TimeSampled: 2011-09-18T14:29:21.0000000+10:00
    ObjectName: MSExchangeTransport Queues
    CounterName: Unreachable Queue Length
    InstanceName: _total
    Value: 647
    SampleValue: 2

    Link:
    http://go.microsoft.com/fwlink/?LinkID=67336&id=484E9D6E-C7C0-45dc-8772-76B9BD2F2CB2


    When viewing the Transport Queues graph in the SCOM console they never get over 9, but the email alerts show 500+.

    This seems to be some kind of reporting bug?  Or maybe I'm looking in the wrong area in SCOM.  I'm viewing the Transport Queues graph (Microsoft Exchange Server > Exchange 2010 > Hub Transport)

    W're obviosuly hesitant to simply override the counter in the event something does go wrong.

    Any assistance would be much apprecicated.
    SCOM 2007 R2
    Exchange 2010 SP1 RU4

    Thanks

    Monday, September 19, 2011 3:29 AM

Answers

  • Since the pack does not include any notification, this is something that was set up by someone at your company.  It is likely that the notification is incorrectly coded.  Also note, the sample value is 2.
    Microsoft Corporation
    • Marked as answer by Matt112 Monday, October 10, 2011 6:04 AM
    Monday, September 19, 2011 3:52 PM
  • I was looking at that value too, just thought i was misreading it.


    Bob Cornelissen - BICTT (My BICTT Blog) - Microsoft Community Contributor 2011 Recipient
    • Marked as answer by Matt112 Monday, October 10, 2011 6:05 AM
    Monday, September 19, 2011 5:04 PM

All replies

  • Could be that youre not looking at the same counter in that case. Best to open the exchange mgmt console and find the queues and take a look at whats happenening in the individual queues.

    Some links:
    http://technet.microsoft.com/en-us/library/hh361381(EXCHG.140).aspx
    http://unifiedpeople.ru/exchhelp.en/html/8805390c-5fcf-4b7d-8eb5-049f15d7cfe7.htm

    Bob Cornelissen - BICTT (My BICTT Blog) - Microsoft Community Contributor 2011 Recipient
    Monday, September 19, 2011 5:54 AM
  • Thanks for your reply Bob

    I thought that and we have checked the queues in Exchange, they reflect the graph in SCOM, but not the email alert.

    This isn't happening to the other queues, only unreachable.

    Monday, September 19, 2011 5:57 AM
  • Thats strange. I dont have the mp in front of me currently. Could you open the alert and see if the company knowlege contains any inline tasks (for instance to request the current number...). See wha it comes up with. Whe there are 600+ unreachables you would find them and know about it I guess. You can also open the properties of the monitor and see what counter it is trying to target. Sometimes it is easy to see.
    Bob Cornelissen - BICTT (My BICTT Blog) - Microsoft Community Contributor 2011 Recipient
    Monday, September 19, 2011 6:04 AM
  • The alert is closed at the moment, it's alerts every couple of days

    The Company Knowledge of the closed alert says:
    "No Company Knowledge was available for this alert"

    This is the alert:

    TimeSampled: 2011-09-17T19:38:56.0000000+10:00
    ObjectName: MSExchangeTransport Queues
    CounterName: Unreachable Queue Length
    InstanceName: _total
    Value: 1172
    SampleValue: 4

     


    Knowledge: _http://go.microsoft.com/fwlink/?LinkID=67336&id=48

    Monday, September 19, 2011 6:31 AM
  • Since the pack does not include any notification, this is something that was set up by someone at your company.  It is likely that the notification is incorrectly coded.  Also note, the sample value is 2.
    Microsoft Corporation
    • Marked as answer by Matt112 Monday, October 10, 2011 6:04 AM
    Monday, September 19, 2011 3:52 PM
  • I was looking at that value too, just thought i was misreading it.


    Bob Cornelissen - BICTT (My BICTT Blog) - Microsoft Community Contributor 2011 Recipient
    • Marked as answer by Matt112 Monday, October 10, 2011 6:05 AM
    Monday, September 19, 2011 5:04 PM
  • The notifications were setup by us, but it's quite general.  Anything in the 'Microsoft Exchange 2010 All Server Roles' group with a severity of 'Critical'.

    The notification is simply emailing what is reported in the console by default, nothing fancy from us.  The SCOM graphs for 'Unreachable Queue Length' _total do not reflect what is being alerted on in the console or email alerts.

    I don't understand why you are highlighting the sample value?  Isn't that simply saying for X checks it has been over the rule's threshold?

    • Edited by Matt112 Tuesday, September 20, 2011 12:13 AM
    Monday, September 19, 2011 11:52 PM
  • No, you are highlighting some high value.  I don't know where it comes from.  You are reporting that the actual values are very low - so I am pointing out that the collected sample value is very low.

    You would have to look at the definition of the monitor to see what it does.  If it is a simple performance threshold monitor, it will be easy to check what the comparison value is and change the rule to alert at a more reasonable threshold.


    Microsoft Corporation
    Tuesday, September 20, 2011 4:12 PM
  • It is likely the alert is generated via the Exchange Correlation Engine as there is no where we see in the Exchange MP that actually generates this alert. Can you look closer at the rule or monitor in the alert details? It should be a clickable link. It would help to know what the rule name is that generated the alert, and confirm if it is generated by a rule in the Exchange MP. Also, what version of the Exchange MP are you running?

    Also, would like to note here that getting a case with Microsoft Phone Support looks like a better approach here.


    Ketan Thakkar | Microsoft Online Community Support
    Wednesday, September 21, 2011 9:49 AM
  • The name of the rule is:

    KHI: Unreachable queue length - sustained for 60 minutes - Red(>1) - Hub Transport.

    It's management pack is 'Exchange Server 2010', version 14.2.71.0.

    Thursday, September 22, 2011 12:29 AM
  • I think that one already alerts if the value is 1 or 2 actually. Hmmm, the name suggests it fires at a value higher than 1, so at 2 and above (unless you override this to a little bit higher value). And as ponted out the samplevalue is 2 and 4 in the examples you gave, so within the likely range for your environment and above the threshold for the monitor to fire an alert.
    Bob Cornelissen - BICTT (My BICTT Blog) - Microsoft Community Contributor 2011 Recipient
    • Edited by Bob CornelissenMVP Thursday, September 22, 2011 6:24 AM
    • Proposed as answer by Felyjos Tuesday, October 15, 2013 2:13 PM
    Thursday, September 22, 2011 6:22 AM

  • After looking up the rule in the Exchange MP, we can see that the rule looking for SDK Event 500 from publisher _484E9D6E_C7C0_45dc_8772_76B9BD2F2CB2_. Can you create a view in OpsMgr to see if you can locate the SDK event, and then provide us with the details from it?

    To do this, from the Monitoring or My Workspace view, do the following:
    - Right click on the parent folder where you would like to create the view
    - Click New->Event View
    - Give it a name
    - Under criteria check "with a specific event number" and "from a specific source"
    - Click specific for the event number and enter:
    500
    - Click specific for the source and enter:
    _484E9D6E_C7C0_45dc_8772_76B9BD2F2CB2_
    - Click OK to create the view

    You should see the event if the alert was raised within your Database Grooming setting for Event data (default 7 days). If nothing is returned, modified the properties of the view and uncheck from a specific source. If you do this, there could be several Exchange events returned, and you may need to look through each to see if it is pertinent.

    Once you locate the event, please reply with as much of the details from it as you can.


    Ketan Thakkar | Microsoft Online Community Support
    • Proposed as answer by Felyjos Friday, October 18, 2013 7:26 PM
    Thursday, September 22, 2011 12:41 PM
  • Hello Matt, any updates on this?
    Bob Cornelissen - BICTT (My BICTT Blog) - Microsoft Community Contributor 2011 Recipient
    • Proposed as answer by Felyjos Friday, October 18, 2013 7:25 PM
    Monday, October 3, 2011 7:50 PM
  • Hi Matt, did this answer your question? Please mark so we can close the thread.
    Bob Cornelissen - BICTT (My BICTT Blog) - Microsoft Community Contributor 2011 Recipient
    • Proposed as answer by Felyjos Friday, October 18, 2013 7:25 PM
    Sunday, October 9, 2011 6:43 PM
  • Hi Bob,

    I've figured out my understanding of Value and SampleValue is wrong (basically I had them around the wrong way!).
    Our Org has a complex routing structure for mail flow, it appears this alert is highlighting an issue with another Exchange organisation and we have alerted them for a fix.  From what I can tell the alert is functioning as normal.

    Thanks to everyone for the comments and suggestions.

    Monday, October 10, 2011 6:04 AM

  • After looking up the rule in the Exchange MP, we can see that the rule looking for SDK Event 500 from publisher _484E9D6E_C7C0_45dc_8772_76B9BD2F2CB2_. Can you create a view in OpsMgr to see if you can locate the SDK event, and then provide us with the details from it?

    To do this, from the Monitoring or My Workspace view, do the following:
    - Right click on the parent folder where you would like to create the view
    - Click New->Event View
    - Give it a name
    - Under criteria check "with a specific event number" and "from a specific source"
    - Click specific for the event number and enter:
    500
    - Click specific for the source and enter:
    _484E9D6E_C7C0_45dc_8772_76B9BD2F2CB2_
    - Click OK to create the view

    You should see the event if the alert was raised within your Database Grooming setting for Event data (default 7 days). If nothing is returned, modified the properties of the view and uncheck from a specific source. If you do this, there could be several Exchange events returned, and you may need to look through each to see if it is pertinent.

    Once you locate the event, please reply with as much of the details from it as you can.


    Ketan Thakkar | Microsoft Online Community Support

    Hi,

    Which event number could it be for "xxxx - Unreachable Queue Length Event View"?

    Thanks,

    Dom


    System Center Operations Manager 2007 / System Center Configuration Manager 2007 R2 / Forefront Client Security / Forefront Identity Manager


    • Edited by Felyjos Monday, October 21, 2013 8:58 PM
    Friday, October 18, 2013 7:31 PM
  • enabling the rules made the trick thanks,

    DOm


    System Center Operations Manager 2007 / System Center Configuration Manager 2007 R2 / Forefront Client Security / Forefront Identity Manager

    • Proposed as answer by Felyjos Monday, October 21, 2013 8:59 PM
    Monday, October 21, 2013 8:59 PM