About Nortec

The All Things Nortec Blog

New Release of Microsoft Exchange Server User Monitor (ExMon) – Free Download

Microsoft just released new version of Exchange Server Monitor (ExMon). ExMon allows administrators to view and evaluate individual users usage and experience with Microsoft Exchange Server: ExMon for Exchange 2007 SP 1. The correct version is 14.00.0553.004. If this does not come up you may need to refresh page.


The Microsoft® Exchange Server User Monitor (ExMon) tool enables administrators to view and evaluate individual users’ usage and experience with Microsoft Exchange Server. With this tool, administrators can gather real-time data that helps them better understand current client usage patterns and plan for future use.

Using ExMon, administrators can view the following:

IP addresses used by clients

Microsoft Office Outlook® versions and mode, such as Cached Exchange Mode and classic online

Outlook client-side monitoring data

Resource use, such as:

CPU usage

Server-side processor latency

Total latency for network and processing with Outlook 2003 and later versions of MAPI
Network bytes

Frequently Asked Questions

Q: How much disk space is required for ExMon data collection?
A: File size depends on the Exchange server load. You can estimate required file size by looking at the Perfmon counter, MSExchangeISRPC Operationssec, as the file size per hour. For example, a server that has an average RPC Operationssec of 300 requires 300 MB per hour of free space for ExMon data collection.

Q: How long should I collect ExMon data?
A: Tracing time depends on user activity and how you want to use the data. For good averages across all users, it is recommended that you collect data for at least 30 minutes during a period of expected user activity. Some client monitoring data is collected only at certain intervals. Therefore, collecting data for longer may increase the probability of more complete data. When you troubleshoot individual users and problems, traces of one to five minutes are generally sufficient.

Q: Does ExMon support non-English languages of Exchange Server 2003 or later versions and the Windows operating system?
A: Yes. ExMon can be run with any language that is supported by Exchange Server and any language that is supported by Windows. ExMon supports Unicode display names for users. However, the ExMon tool interface and documentation are available only in English.

Q: How does ExMon data collection affect Exchange server performance?
A: The effect of data collection on Exchange Server is less than a two percent increase in CPU or latency. To minimize the effect, you should not collect data on a hard disk drive that is currently being used by Exchange, such as the database, streaming, log file, or queue drives. Also note that ExMon tracing uses a Windows technology known as Event Tracing for Windows (ETW). ETW was designed especially for performance tracing and is used by core parts of Windows. As a result, the effect on the server is less than two percent additional processing time and a negligible additional latency.

Q: Because ExMon data is collected with ETW, can I write my own data parser?
A: No, you currently cannot write your own data parser. The raw data requires a significant amount of analysis to produce meaningful data.

Q: Why does ExMon display only part of a user’s display name?
A: Because of limitations in the tracing and parsing code, ExMon truncates user display names to 32 characters.

Q: Why are some data columns blank?
A: Some data columns are blank because some servers do not provide some information. ExMon can view data in Exchange Server 2000 SP2 and later versions, in Exchange Server 2003 SP1 and later versions, and in Exchange Server 2007 SP1 and later versions. Since the release of Exchange Server 2000, significant changes have been made. ExMon supports data files from all these servers, although not all the data is available. For example, the Foreground Latency column in the By Clientmon view requires Exchange Server 2003 SP1. It also requires that users also have Outlook 2003 SP1.

Q: How can I collect data on Exchange that is running on Clustering Services for Microsoft Windows?
A: Tracing ExMon data on Exchange servers that use Cluster Service is difficult because you care about collecting data for a specific virtual server instead of data from just a physical node. A cluster failover during a data collection session causes incomplete data. By collecting on shorter intervals, such as five minute intervals, on every node of the cluster, you can minimize the amount of data that is lost if there is a failover. Both System Monitor and Tracelog.exe provide functionality to create intervals based on file size instead of time. You can also write a script to run on cluster failovers, and start and stop the appropriate data collections.

Q: Why doesn’t ExMon display data when I have passed in an input file?
A: You may be able to resolve this issue by performing the following tasks:
Make sure that you put the path and file name in double quotation marks if the path or file name contains a space.

ExMon must run on Windows Server 2003 or later versions if the Event Trace Log (.etl) file was collected on Windows Server 2003 or later versions.
Verify that the Exmon.reg file was applied before you began collecting data. For instructions on how to apply the Exmon.reg file, see “Installation” earlier in this document.

Source: Microsoft