IssueWarningQuote / Exchange Online Mailbox Quota Alerts?
Good morning.
We are currently using the O365 SaaS connector. While this is a nice connector, it lacks in any detailed monitoring such as individual mailbox activity/stats. There is one metric I am looking to manage via LM, which is the "IssueWarningQuota" mailbox status. I would like to know when a mailbox has consumed more space than the "IssueWarningQuota". This would allow technology to be made aware when a user's mailbox is getting to the point where we need to ask them to archive or delete, etc. It's also a very critical metric for managing service account mailboxes...which if they hit the "ProhibitSendReceiveQuota" could cause production issues....
This is not available in the SaaS product. I am wondering if anyone else has successfully done this in logic monitor. I know we can run powershell with custom datapoints. But I also am not quite sure yet how to correctly grab mailbox sizes and check them against IssueWarningQuota.....any ideas?
Mike Moniz
·4 years agoI was referring to how to get the $mailboxname value and if you want to check multiple mailboxes (but not all) with the same DataSource. Instead of creating multiple DataSources per mailbox like "AdminMailboxQuotaCheck" or "ImportantMailboxQuoteCheck", you can create just one DataSource that uses ##wildvalue## for $mailboxname and create multiple instances. If the DataSource has multi instance enabled but Autodiscover disabled, you can manually create multiple instances on the device itself, like how PingMulti works.
John_Lockie
OP4 years agoGood feedback. What do you mean about multi instance and no discovery script? We did not hard code service account in the autodiscover script (although technically the api call to get the creds is hard coded here). You piqued my curiosity with this comment...
Regarding coding thresholds into the datasource, couldn't agree more. We ended up being able to grab all the data points that allow us flexibility w/ LM logic to be able to alert. For now we kept it simple by biulding alert threshold > 90 90 90 so that if the totalsize goes above 90 we trip a crit alert. Down the road we may be able to do something nice such as "totalsize > issuewarning" and then trigger it. So as we manage the issuewarning setting on a given mailbox, the LM logic is current...and no alert threshhold needs to be modified.
This is the first time we have done powershell. We have a few groovy scripts on custom datasources that do things like check cloud storage for last file write date to accomplish a sort of "dead man's switch" on ETL stuff....and it has worked nicely. I am stoked to see we are able to do so much with powershell as well...!
John_Lockie
OP4 years agoWe solved this with a little engineering....
We have a windows collector - and installed the EOL module on this collector. We then created a custom datapoint with embedded powershell script. YMMV on authentication, but we built a read-only account for this, then stored in our keyvault, called via API and conver to secure string. The actual command we are using to collect the data we need is (I assume folks reading this can understand we use some variables for things like mailbox identity, and those are snipped for security reasons...):
This gets us a clean table of data
We also have 3 datapoints we can build alerts off of
Mike Moniz
·4 years agoI would ask support if they can get you a copy of one of the old DataSources as they do most of the work. I switched jobs so I no longer have a copy myself.
Some generic suggestions:
John_Lockie
OP4 years agoYeah - haha....the new SaaS version is not as good as the old one. There are also fewer metrics around SharePoint sites. Some of this is Microsoft some of it is LM.
But I agree w/ LM that these particular powershell commands are latent so it wasn't sustainable. I am wondering if we cannot use custom datasource and run itfrom a machine that has powershell (with EOL module). The script itself will take some thought, because there is no flag on accounts that have reached the "IssueWarningQuota". So we'd have to do some unique script that stores that field for each mailbox and matches it against current mailbox size, and alerts when current mailbox size > IssueWarningQuota....if we end up developing this I may post it here. There are specific service mailboxes we want to do this for, so possibly we only do it against those handful....seems feasible. We could even do a custom datasource for each service account and then we can simply grab mailbox size, and create custom alert when mailbox size is > what we are comfortable with. This is less dynamic, cause if an exchange admin changes IssueWarningQuota our datasource become out of sync, since we'd need to in theory update the alert as well....
We'll likely engineer something for this, and post back here.
Mike Moniz
·4 years agoI think LM had per-user checks in the legacy collector-based DataSources but it would frequently fail. For many environments it would take too long to collect the data due to the number of users and it would time out.
https://web.archive.org/web/20200919180848/https://www.logicmonitor.com/support/monitoring/applications-databases/microsoft-office-365-monitoring
"Exchange Online: Initially created to monitor Exchange Online mailbox statistics, this DataSource was removed from the Office 365 monitoring package in April 2020 due to timeout issues stemming from slow Microsoft PowerShell module performance. We are currently researching alternative approaches to retrieving the metrics."
P.S. I thought that was the point of moving to a SaaS version to help fix these, but there isn't a mention of that.