Understanding Exchange User Monitor (ExMon) Output

exchangeexchange-2010

I recently downloaded and ran ExMon while trying to troubleshoot Outlook connectivity problems due to high CPU usage on Exchange Server 2010 SP2 UR8.

The tool provides a great set of data, but I have not yet figured out how to make great use of it.

My first question is why the Exchange Server itself shows up as a high-use MAPI client in the ExMon data.

  • Among the users' client versions I see build numbers listed for Outlook 2013, 2010, and yes, even 2007 clients. I also see build number 14.2.387.0, which represents Exchange Server 2010 SP2 Update Rollup 8 (+/- some other patch that makes it not quite match the UR8 number).
  • There are many user rows that list only "::1" and/or the short hostname of my Exchange server in the 'Client IP Addresses' column. Some other columns include the end-user's actual IP address and the Exchange server's IP address.
  • ExMon shows that it is actually Exchange Server that is utilizing the highest percentage of CPU that is used for MAPI calls.

I had expected to see 1 IP address and version number for each user reported by ExMon. Instead, most records show multiple version #'s (Exchange ver and Outlook ver) and multiple IPs (Exchange IP and client IP).

Can anyone explain the reason for this to me, please?

Best Answer

Strictly speaking, the MAPI connections from client >> Exchange 2010 mailbox server runs through the CAS, so if you've got CAS and mailbox roles installed on the same server, it makes sense that you'd see that your only server creating most of the MAPI activity.