Understanding alert notifications

Platí pro: Windows SBS 2003

To help you become aware of potential problems with the server and to take corrective action more quickly, Microsoft® Windows® Small Business Server 2003 includes a predefined set of service and performance counter alerts.

Alerts are generated when a selected service is not running, when the threshold for a selected performance counter is exceeded, or when a selected event log error occurs. Alert activity is summarized in the server performance report. You can can also choose to receive an e-mail message when an alert is generated.

For example, one of the preconfigured alerts included with Windows Small Business Server 2003 defines an alert that will be generated if there is less than 500 megabytes (MB) of free disk space available on a disk or partition. Low levels of free disk space can cause performance problems and prevent users from saving files on the disk. If this threshold is exceeded, an alert will be generated and displayed in the server performance report, and, if specified in the Monitoring Configuration Wizard, an e-mail message will be sent to the specified e-mail recipients.

Use the Monitoring Configuration Wizard to specify whether you want to receive alert notifications. To receive alert notifications, select the Send me notification of performance alerts by e-mail check box on the Alerts page of the wizard, and then specify the e-mail addresses for alert recipients on the next page. For more information, see Using the Monitoring Configuration Wizard.

After completing the Monitoring Configuration Wizard, you can run the Alert Notifications configuration tool to configure the default alerts and thresholds by clicking Change Alert Notifications in the Monitoring and Reporting snap-in in Server Management. For more information, see Configure alert notifications.

Using the Alert Notifications configuration tool, you can:

• Specify a service for which you want to generate an alert when the service stops running.

• Specify the name of a predefined performance counter for which you want to generate an alert when the associated threshold is exceeded.

• Change the threshold for a performance counter.

• Specify an event log error for which you want to generate an alert when the error occurs.

• Specify the e-mail address for one or more alert recipients.

Expand the following sections to see a detailed list of the preconfigured alerts included with Windows Small Business Server 2003.

Services alerts

By default, an alert can be generated when one or more of the following services is not running:

Service	Description
DHCP Server	Performs TCP/IP configuration for DHCP clients, including dynamic assignments of IP addresses, specification of the WINS and DNS servers, and connection-specific DNS names. If this service is stopped, the DHCP server will not perform TCP/IP configuration for clients.
DNS Server	Activates DNS clients to resolve DNS names by answering DNS queries and DNS dynamic update requests. If this service is stopped, DNS name resolution will fail, and DNS updates will not occur. This can prevent users from accessing the server and the Internet.
Error Reporting Service	Collects, stores, and reports unexpected application crashes to Microsoft. If this service is stopped, then Error Reporting will occur only for kernel faults and some types of user mode faults.
Event Log	Activates event log messages issued by Windows-based programs and components to be viewed in Event Viewer.
Fax	Allows users to send and receive faxes, utilizing fax resources available on the computer running Windows Small Business Server 2003. By default, service and performance alerts for Fax are not enabled. If you install and configure a fax modem, you can enable the Fax alerts using the Alert Notifications configuration tool.
IPSEC Services	Provides end-to-end security between clients and servers on TCP/IP networks. If this service is stopped, TCP/IP security between clients and servers on the network will be impaired.
Kerberos Key Distribution Center	Allows users to log on to the network using the Kerberos authentication protocol. If this service is stopped, users will be unable to log on to the network.
Microsoft Exchange Information Store	Manages the Exchange mailbox and public folder stores. If this service is stopped, mailbox stores and public folder stores on the computer running Windows Small Business Server 2003 will be unavailable.
Microsoft Exchange Management	Manages Exchange management information that uses Windows Management Instrumentation (WMI). If this service is stopped, Exchange management information using WMI will be unavailable.
Microsoft Exchange POP3	Provides Post Office Protocol version 3 (POP3) services to client users. If this service is stopped, clients will be unable to connect to the computer running Windows Small Business Server 2003 by using the POP3 protocol. This alert is disabled by default.
Microsoft Exchange Routing Engine	Provides Exchange routing services using link state information. If this service is stopped, messages will not be routed by the computer running Windows Small Business Server 2003.
Microsoft Exchange System Attendant	Provides monitoring, maintenance, and Active Directory lookup services, such as monitoring of services and connectors, defragmenting the Exchange store, and forwarding Active Directory queries to a Global Catalog server. Most Exchange services depend upon the Microsoft Exchange System Attendant service and will stop if this service is stopped. Additionally, if this service is stopped, then monitoring, maintenance, and query services will be unavailable.
MSSQL$ SBSMONITORING	This service is required to manage information displayed in server performance reports and usage reports. If this service is stopped, users will be unable to view server performance or usage reports.
MSSQL$ SHAREPOINT	Allows users access to your Windows SharePoint Services-based intranet site. This service is required for access to your Windows SharePoint Services-based intranet.
Print Spooler	Manages all local and network print queues and controls all printing jobs. If this service is stopped, printing on the computer running Windows Small Business Server 2003 will be unavailable.
Routing and Remote Access	Activates virtual private network (VPN) and network address translation (NAT) routing services. If this service is stopped, these services will be unavailable. This service is enabled if you configure router, firewall, or VPN services.
SBCore Service	Provides core server services.
Security Accounts Manager	Signals other services that the Security Accounts Manager (SAM) is ready to accept requests.
Server	Supports file, print, and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable.
Simple Mail Transfer Protocol (SMTP)	Transports e-mail across the network. If this service is stopped, alert notifications will not be delivered to the recipients.
Terminal Services	Allows multiple users to be connected interactively to the computer running Windows Small Business Server 2003.
Windows Internet Name Service (WINS)	Resolves NetBIOS names for TCP/IP clients by locating network services that use NetBIOS names. If this service is stopped, network NetBIOS services will not function properly.
World Wide Web Publishing	Provides Web connectivity and administration through the Internet Information Services snap-in.

Performance counter alerts

By default, an alert can be generated when a threshold is exceeded for one or more of the following preconfigured performance counters:

Alert name	Performance counter	Default threshold
Allocated Memory	Committed Bytes	> 2 gigabytes (GB)
Disk Activity	% Disk Idle Time	< 5%
inetinfo.exe private bytes	Process - Private Bytes	> 100 megabytes (MB)
Low Disk Space	Disk Free Megabytes	< 500 MB
lsass.exe private bytes	Process - Private Bytes	> 100 MB
Memory Available	Available Mbytes	< 4 MB
Printing Errors	Print Job Errors	> 1
Processor Activity	% Idle Time	< 5%
Received Fax Failures	Failed Receptions	> 1
Sent Fax Failures	Failed Outgoing Connections	> 1
SMTP Server Remote Queue Length	Remote Queue Length	> 30
store.exe private bytes	Process - Private Bytes	> 100 MB
System Up Time	System Up Time	< 600 seconds

Event log errors

By default, an alert can be generated when one or more of the following event log errors occurs:

Event log error	Event ID	Event Log File	Description
Account Lockout	539	Security	An account was locked out due to multiple failed logon attempts that occurred in a short period of time.
Windows Small Business Server Backup failed	5634	Application	One or more components of Windows Small Business Server Backup failed.

Notes

• If Exchange is not installed, Exchange alerts are disabled.

• To run the Monitoring Configuration Wizard, click Configure Monitoring in the To Do List or Set Up Monitoring Reports and Alerts in the Monitoring and Reporting snap-in in Server Management.

• To run the Alert Notifications configuration tool, click Change Alert Notifications in the Monitoring and Reporting snap-in in Server Management.

• Additional alerts can be created using Health Monitor; however, only the preconfigured service and performance counter alerts can be configured using the Alert Notifications configuration tool.