Monitoring and managing users and top consumers

 PATROL for Microsoft Exchange Servers provides application classes that monitor

• Users that send the most messages
• Users that receive the most messages
• Mailboxes that contain the most messages
• Public folders that contain the most messages
• Users that you specify

You can choose how many senders, receivers, mailboxes, and folders to monitor and base your monitoring on either the message count or the total size of the messages. 

Changing warn and prohibit settings

Use one of the following tasks to specify the alarm and warning settings for a user mailbox. When the mailbox reaches this size, either an e-mail message will be sent to an administrator, or the mailbox will be unable to send or receive e-mail.
Select one of the following tasks:

• To change the warn and prohibit settings for a top mailbox
• To change the warn and prohibitsettings for a mailbox Store
• To change the warn and prohibit settings for a watched user

To change the warn and prohibit settings for a top mailbox

1. Access the appropriate instanceNamesOfTopMailboxes application class instance menu as described in Accessing KM Menu Commands.
2. Select the Admin > Change Quota Settings menu command to display the Quota Settings dialog box.
3. Complete the fields in the dialog box and click Accept.

To change the warn and prohibit settings for a Mailbox Store

1. Access the appropriate instanceNamesOfMailboxStores application class instance menu as described in Accessing KM Menu Commands.
2. Select the Admin > Change Quota Settings menu command to display the Quota Settings dialog box.
3. Complete the fields in the dialog box and click Accept.

 To change the warn and prohibit settings for a watched user

1. Access the appropriate instanceNamesOfWatchedUserInstances application class instance menu as described in Accessing KM Menu Commands.
2. Choose the Admin > Change Quota Settings menu command to display the Quota Settings dialog box.
3. Complete the fields in the dialog box and click Accept.

Configuring the mailbox that PATROL uses to detect potential viruses

Use this task to set up the mailbox that you can use to spot potential e-mail viruses. This mailbox uses an obscure name and is not a member of any distribution group. Thus, it should not receive or send mail. If it does, an e-mail virus may be sending mail to addresses that it randomly selects from the global address list.

You must create this mailbox before using it to detect viruses.

1. Access the Watched Users application class menu as described in Accessing KM Menu Commands.
2. Select the PATROL Admin > Create Suspect Mail Monitor menu command to display the Create Suspect Mail Monitor dialog box. 
3. Enter the mailbox name, user ID, and password. For more information, see Configure Mailbox for Suspect Mail Detection dialog box. 
4. To create the mailbox, click OK.

PATROL creates an instanceNamesOfWatchedUserInstances application class instance to represent the suspect mailbox. This application class instance contains the following parameters:

• SuspectMsgCount

• MsgSize

• AssocContentCount

• AttachmentSize

• QuotaLimit

• MsgRecvRate

• netMsgRecvRate

• InetMsgSendRate

• MsgSendRate

• MsgCount

When the SuspectMsgCount parameter, which is the number of messages sent or received by the mailbox, is greater than zero, the parameter enters an alarm state and, if you have enabled the associated recovery action for this parameter, PATROL automatically shuts down the MTA.

Configuring the monitoring of top folders

Use this task if you want to change the criteria that PATROL uses to monitor the top folders in your environment.

1. Access either the Exchange application class menu, the Top Folders application class menu, or the instanceNamesOfTopFolders application class menu, as described in Accessing KM Menu Commands.
2. Choose one of the following menu commands to display the Configure Top Folders dialog box:
   
   • From the Exchange application class menu, choose PATROL Admin > Configure > Top > Public Folders.
   • From the Top Folders application class menu, choose PATROL Admin > Configure Top Folder.

   • From the instanceNamesOfTopFolders application class, choose PATROL Admin > Configure Top Folders.

3. Use the slider to specify the number of top folders that you want to monitor. As you monitor more folders, you use more system resources. Adjust the number of top folders as appropriate for your system. 
4. Select whether you want to have PATROL determine the top folders based on message count or total message size. 
5. Click OK.

The instanceNamesOfTopFolders application class icons appear during the next discovery cycle. By default, discovery occurs every 10 minutes.

To change warning or alarm ranges or to add recovery actions to a parameter, select the parameter from the KM tab on the PATROL console and change the appropriate settings. For more information about customizing parameters, see your console documentation.

Configuring the monitoring of top mailboxes

Use this task if you want to change the criteria that PATROL uses to monitor the top mailboxes in your environment.

1. Access either the Exchange application class menu, the Top Mailboxes application class menu, or the instanceNamesOfTopMailboxes application class menu, as described in Accessing KM Menu Commands.

2. Choose one of the following menu commands to display the Configure Top Mailboxes dialog box:
   
   • From the Exchange application class menu, choose PATROL Admin > Configure > Top > Mailboxes.
   • From the Top Mailboxes application class menu, choose PATROL Admin > Configure Top Mailboxes.
   • From the instanceNamesOfTopMailboxes application class menu, choose PATROL Admin > Configure Top Mailboxes.
3. Use the slider to specify the number of top mailboxes that you want to monitor. 
   
   As you monitor more mailboxes, you use more system resources. Adjust the number of top mailboxes as appropriate for your system. 
4. Select whether you want to have PATROL determine the top mailboxes based on message count or total message size. 
5. Click OK.

The top mailbox application class instance icons appear during the next discovery cycle. By default, discovery occurs every 10 minutes.

To change warning or alarm ranges or to add recovery actions to a parameter, select the parameter from the KM tab on the PATROL console and change the appropriate settings. For more information about customizing parameters, see your console documentation.

Removing a user from the watch list

1. Access the appropriate instanceNamesOfWatchedUserInstances application class instance menu as described in Accessing KM Menu Commands.
2. Select the PATROL Admin > Delete User from Watch List menu command. 

Setting watched users alert properties

Use this task to specify the e-mail recipient that should receive alert messages when the QuotaLimit recovery action runs.

1. Access the Watched Users application class menu as described in Accessing KM Menu Commands.
2. Select the PATROL Admin > Set Alert Properties menu command to display the Set Alert Properties dialog box.
3. Select the user to whom all alert messages should be delivered.
4. Click Accept. 

Updating the user data cache

Use this task to reset the user data cache file, userdata.dat. The userdata.dat file collects the following data about each user on an Exchange Server:

• LegacyDistinguishedName
• AliasName
• DisplayName
• SMTP Address

The following application classes use the userdata.dat file to convert the LegacyDistinguishedName to an alias name and the AliasName to a display name:

• MSEXCH_Watched_Users
• MSEXCH_Top_Senders
• MSEXCH_Top_Receivers
• MSEXCH_Top_Mailboxes
• MSEXCH_Top_Folders

PATROL for Exchange Servers updates the userdata.dat file at an interval specified on MSEXCHSetup/MaxCacheAge, which is 24 hours by default. If you need to perform an action on a user added since the last cache refresh, perform this task to update the userdata.dat file.

1. Access the Watched Users application class menu as described in Accessing KM Menu Commands.
2. Select the PATROL Admin > Reset User Data Cache menu command to display the Reset User Data Cache dialog box.
3. Click OK to reset the cache.
4. Click OK to close the confirmation message.