topic Re: Splunk for Exchange - Database information not showing in Getting Data In

Splunk for Exchange - Database information not showing

deepcovelabs — Thu, 25 Oct 2012 16:26:42 GMT

Hello,

We are int he process of setting up Splunk for Exchange App and we seem to has it running, somewhat correctly, but the app does not display the mailstore db size at all we are get no values. We get values for the log files, all other part of the application seem to be displaying the correct data.

This is under Mailbox Database Overview

Database	MailboxStore	DatabaseSize(MB)	DBFreeSpace(%)	LogSize(MB)	LogFreeSpace(%)
MB-Net-01	Juno	0.00	72.61	33.00	94.29

Anyone have any ideas on how to correct this?

Thanks
Kevin

Re: Splunk for Exchange - Database information not showing

ahall_splunk — Thu, 25 Oct 2012 16:31:02 GMT

I need a little more information on the environment you are running in to be able to ask a follow-questions appropriate to diagnose. If you have a support contract, then follow up through a support call. If not:

What version of the App are you running?
What version of Exchange is running on the server in question?
What version of Splunk Universal Forwarder are you running on your mailbox store?

Re: Splunk for Exchange - Database information not showing

deepcovelabs — Thu, 25 Oct 2012 18:54:41 GMT

Sorry about not including the version info:

-Splunk: version 4.3.4, build 136012
-Splunk for Exchange: v1.1.6
-Exchange 2010 SP2: v14.2 build 247.5
-Splunk Forwarder Win_x64: version 4.3.4, build 136012

Re: Splunk for Exchange - Database information not showing

ahall_splunk — Thu, 25 Oct 2012 18:59:43 GMT

The Exchange 2010 SP2 is likely the cause. As detailed in the documentation (specifically: here), upgrading to SP2 sometimes (actually, most of the time) turns off the Exchange cmdlets, causing a loss of information. That same page also contains a link to a blog post about a fix for the issue.

A good test is to log onto your mailbox store, bring up the Exchange Powershell and run

Get-MailboxServer -Identity $env:ComputerName
Get-MailboxDatabase -server $env:ComputerName -Status

These are the two Exchange cmdlets that give us the information you are looking for.

Re: Splunk for Exchange - Database information not showing

ahall_splunk — Thu, 25 Oct 2012 21:44:05 GMT

No worries - if the scripts are running without issue and the size of the database is showing up in the scripts, the dashboard should work.

The script you want to be concentrating your efforts on is the get-databasestats.ps1 script.

Re: Splunk for Exchange - Database information not showing

deepcovelabs — Thu, 25 Oct 2012 21:49:37 GMT

The 2 powershell cmds work, and so did the work-around test command with the small change in path.

I change this:
cd "C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-Exchange-2010-MailboxStore"
"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" cmd exchangepowershell.cmd get-hoststats.ps1

to this:
cd "C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-Exchange-2010-MailboxStore"
"C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" cmd .\bin\exchangepowershell.cmd get-hoststats.ps1

result is as expected: white text result

Re: Splunk for Exchange - Database information not showing

deepcovelabs — Thu, 25 Oct 2012 22:19:56 GMT

Hmmm... I had a look at the get-databasestats.ps1 and I don't see any object Member with DatabaseSize. I'll keep digging

Re: Splunk for Exchange - Database information not showing

ahall_splunk — Thu, 25 Oct 2012 22:24:45 GMT

If you do a search for eventtype=msexchange-database-stats then the number you want is in the FileSize field.

Re: Splunk for Exchange - Database information not showing

deepcovelabs — Fri, 26 Oct 2012 23:09:10 GMT

to me this looked like a code error, I guess I am wrong:

$EdbSize = ($EdbFilePath.PathName | Get-ChildItem).Length

Shouldn't it be:

$EdbSize = ($Database.EdbFilePath.PathName | Get-ChildItem).Length

Re: Splunk for Exchange - Database information not showing

ahall_splunk — Fri, 26 Oct 2012 23:19:34 GMT

Im just looking at the script now. I do believe you are right. Its correct in the 2007 and 2013 Exchange scripts. I'll correct it here and it will go out with the next release. Feel free to edit the script as you suggested.

Re: Splunk for Exchange - Database information not showing

deepcovelabs — Mon, 29 Oct 2012 16:10:06 GMT

Thanks...

I made the edit on the script on friday and we are now seeing the value being populated. Thanks for your help.

Re: Splunk for Exchange - Database information not showing

deepcovelabs — Mon, 29 Oct 2012 16:11:32 GMT

Side question: What script does DNSBL Reputation relay on?

Re: Splunk for Exchange - Database information not showing

ahall_splunk — Mon, 29 Oct 2012 16:11:42 GMT

I posted v2.0.1 of the Splunk app for Exchange that has this fix in it as well.

Re: Splunk for Exchange - Database information not showing

ahall_splunk — Mon, 29 Oct 2012 16:12:30 GMT

DNSBL Reputation relay is in the TA-SMTP-Reputation

Re: Splunk for Exchange - Database information not showing

deepcovelabs — Mon, 29 Oct 2012 16:38:43 GMT

Thanks for all the help.