Chapter 4 - Monitoring Your MSMQ Enterprise

You monitor your MSMQ enterprise network through MSMQ Enterprise Explorer and other Windows NT administration tools: Event Viewer, Performance Monitor, and Network Monitor. For procedures for all MSMQ administrative tasks, see MSMQ Explorer Help.

Checking Computer Status Using MQPing

MSMQ supports an MQPing* *command, not unlike the ping feature supported by the TCP/IP protocol. Use MQPing (for MSMQ Explorer) to determine if an MSMQ computer is currently connected to the network. When a computer running MSMQ receives an MQPing request, it returns the contents of the request to a private queue called mqping response.

When you ping a computer, MSMQ attempts to connect to the computer for 30 seconds and updates the computer icon accordingly. MSMQ Explorer displays one of the following symbols next to the computer's icon.

Table 4.1 

When you update the MSMQ Explorer display by pressing f5, MQPing status symbols are no longer displayed. However, pinging additional computers does not affect the ping status symbols already displayed.

To ping more than one computer, select multiple computers in the right pane of MSMQ Explorer before right-clicking a computer and clicking MQPing. To select a contiguous block of computers, hold down shift and click the computers. To select non-contiguous computers, hold down ctrl and click the computers.

Note Pinging many computers generates significant network traffic in large enterprises. Ping all computers only when necessary, preferably when the network load is low.

Monitoring Events

MSMQ logs important information about its operation. This information is logged in different places, depending on which platform you use to run MSMQ.

Monitoring Events On Computers Running Windows 95

On computers running Windows 95, MSMQ logs important information about its operation to the Msmqlog.txt file. This file is located in the same folder used to store MSMQ messages (C:\Program Files\Msmq\Storage by default). Use Notepad, WordPad, or any other application that can read text files to view the Msmqlog.txt file.

Note If you are using an application to view Msmqlog.txt when an event occurs, the event is not logged.

Monitoring Events On Computers Running Windows NT Workstation and Windows NT Server

On computers running Windows NT Workstation or Windows NT Server, MSMQ logs important information about its operation to Windows NT event logs. The event source for all events is always MSMQ. Most MSMQ events are written to the Application log, while security events are written to the Security log. There are three types of MSMQ application events:

• Informational 

• Warning 

• Error 

Informational events are infrequent significant events that describe successful operations. Warning events are not necessarily significant, but indicate potential problems. Error events are generated for significant problems.

Note Some application events are not logged at each occurrence. For example, if an MSMQ routing server cannot establish a session with the target computer, an event is logged for the first failure, and another event is logged when the session is established.

There are two types of MSMQ security events:

• Success Audit 

• Failure Audit 

Success Audit events are generated when selected objects are accessed successfully. Failure Audit events are generated when access to a selected object is denied.

For information on enabling MSMQ auditing, see "Auditing" in Chapter 5, "Securing Your MSMQ Enterprise".

Viewing Events

You can view events from MSMQ Explorer or from Windows NT Event Viewer. MSMQ Explorer displays those events of type MSMQ. If you view the events from Event Viewer, you can sort, filter, and search for events based on different event properties.

To view events from Windows NT Explorer, right-click a computer, click Properties, and then click the Events tab.

For more information on Event Viewer, see Windows NT Server Version 4.0 Concepts and Planning.

Monitoring MSMQ Performance

You can use Windows NT Performance Monitor and MSMQ Performance Monitor counters to monitor and tune you MSMQ enterprise.

MSMQ Performance Monitor Counters

Many performance statistics can be viewed from MSMQ Explorer for both computers and queues. To see the performance counters from MSMQ Explorer, right-click a computer or a queue, click Properties, and then click the Status tab. To view all available performance counters for MSMQ, open the Windows NT Performance Monitor. The default MSMQ performance counters are grouped under the following objects:

• MSMQ IS 

• MSMQ Service 

• MSMQ Queue 

• MSMQ Session 

For definitions of each counter, open Performance Monitor, click Add counter, select one of the MSMQ objects, and then click Explain. As you select different counters, definitions for each counter appear under Counter Definition.

Additional performance counters can be installed on MSMQ servers by MSMQ connectors. For example, performance counters are grouped under the MSMQ Exchange Connector object when you install the MSMQ Exchange Connector.

You can also use Perf2mib.exe (the Performance Monitor MIB Builder Tool) to enable any simple network management protocol (SNMP) manager to read MSMQ performance counters. For more information, see the Windows NT Workstation Resource Kit or the Windows NT Server Resource Kit.

For more information on Performance Monitor, see Windows NT Server Version 4.0 Concepts and Planning. For more information the MSMQ Exchange connector, see Appendix B "Installing and Configuring the MSMQ Exchange Connector."

The MSMQ IS Object

The MSMQ IS object is available on all MSMQ controller servers. The MSMQ IS object contains performance counters that you can use to monitor MQIS access.

For information on each counter, open Performance Monitor; on the Edit menu, click Add to Chart; click MQIS IS; click Explain button, and then click the various counters.

The MSMQ Service Object

The MSMQ Service object is available on any computer running the Microsoft Message Queue Service. The MSMQ Service object contains performance counters you can use to monitor session and message statistics for the selected computer.

The MSMQ Queue Object

The MSMQ Queue object contains performance counters you can use to monitor message statistics for the selected queue. There are instances for each queue on the computer. If an MSMQ-based application has a private queue open on another computer, an instance for that queue is also available. The instance name of these queues is the format name of the queue. If an MSMQ connector application is running on the computer, an instance is available for the MSMQ connector queue. The queue name is displayed as foreign=GUID.

Instance lists only the first 97 queues created on the computer, including private queues.

Note The Computer Queues instance represents the computer's source-journal and dead-letter queues. The Bytes in Queue and Messages in Queue counters monitor the computer's dead-letter queue. The Bytes in Journal Queue and Messages in Journal Queue counters monitor the computer's source-journal queue.

Temporary queues are easily identifiable because the computer name in the instance does not match the name of the computer on which they reside.

The MSMQ Session Object

The MSMQ Session object is available when the computer has an MSMQ session established with another computer. Multiple instances of this object are available, one for each session. Instance lists the IP or IPX address of the computer with which the session is established.

Monitoring MSMQ Messaging Performance

If available processing resources (CPU time) are not limiting messaging performance, MSMQ independent clients and servers may be able to improve messaging performance by storing the various files used to implement messaging across multiple physical disks.

MSMQ can use two different drives to send and receive standard messages, or three for transactional messages. If you are sending transactional messages, you may also be able to put the data and log files for the application you are transacting with on two or more different drives. However, if your CPU usage is at or near 100 percent, adding additional disk drives will not improve messaging performance.

To determine if additional hard disk drives will improve messaging performance, use Performance Monitor to track the % Processor Time and Avg. Disk Queue Length counters. If sustained CPU use is above 75% while sending messages, adding processing capacity may improve messaging performance. If the average disk queue length for any drive is greater than 0.6 while sending messages, additional drives may improve messaging performance.

For more information on putting the MSMQ message queuing files on separate physical drives, see "Maximizing MSMQ Messaging Performance" in Chapter 3, "Managing Your MSMQ Enterprise" and "Improving Messaging Performance with Multiple Disks" in Chapter 6, "Deploying MSMQ."

Tracking and Monitoring Messages

You can monitor message routes and message content by:

• Sending a test message 

• Enabling message-route tracking 

• Using network monitor 

Sending a Test Message

Using MSMQ Explorer, you can send test messages from any MSMQ independent client or server to a test queue on any other independent client or server within the same enterprise. You can use MSMQ Explorer to create test queues or change the type ID of existing queues so that you can send test messages to the queues.

Note Test queues have a type ID of {55EE8F33-CCE9-11CF-B108-0020AFD61CE9}. If you change the type ID of a transactional queue to {55EE8F33-CCE9-11CF-B108-0020AFD61CE9} and send test messages to the transactional queue, the messages are not delivered. Only transactional messages can be sent to transactional queues, and MSMQ Explorer test messages are not transactional. Similarly, if you change the type ID of a queue requiring authentication to {55EE8F33-CCE9-11CF-B108-0020AFD61CE9} and send test messages to the queue, the messages are not delivered (unless the target queue is located on the sending computer).

For information on how to send a test message using MSMQ Explorer, see MSMQ Explorer Help.

Enabling Message-Route Tracking

You can use message-route tracking to track the path messages take on your MSMQ network. As the messages pass through an MSMQ routing server, a message is sent to the report queue, indicating which server the message passed through.

Enabling message-route tracking is a two step process. First, the administrator must enable message-route tracking by defining a report queue for the sending computer. Second, the application must set the correct message property. The application developer must set this property or enable some way for it to be set by the user (such as through the Windows registry), so that message-route tracking can be enabled for the application.

Because all test messages are sent with message-route tracking enabled, if the sending computer has a report queue, the message path is tracked.

For information on how to enable message-route tracking, see MSMQ Explorer Help. For information on how to set message properties, see the Microsoft Message Queue Server Software Development Kit (MSMQ SDK).

Report Message Format

Report message labels are written in the following formats:

gggg:dddd:hh sent from <computer> to <address> at <time>gggg:dddd:hh received by <computer> to <address> at <time>

where gggg is the first 4 hexadecimal digits of the source queue globally unique identifier (GUID); dddd is the internal message identifier; and hh is the hop count.

The internal message identifier is the message sequence number, which is part of the entire message identifier. The entire message identifier is not used because it is too big to be easily read (a 16-byte source GUID and a 4-byte sequence number).

Avoiding Report Conflicts

Each message supports only one report queue. If a message is being tracked and it passed through an MSMQ routing server that also has message-route tracking enabled, a report conflict message is sent to the report queue.

For example, suppose report-message tracking is set for computer A, and the MSMQ-based application on computer A is sending message M to computer C through MSMQ routing server B. If the computer A report queue is queue R, a report message is sent to queue R when:

• Message M leaves computer A 

• Message M arrives at computer B 

• Message M leaves computer B 

• Message M arrives at computer C 

However, if computer B (an MSMQ routing server) is also configured with report message tracking with report messages being sent to queue R, queue R receives a report queue conflict message when Message M leaves computer B. Queue R continues to receive correct tracking messages.

Using Network Monitor

MSMQ includes a Microsoft Network Monitor parser you can use to monitor MSMQ traffic on your network. Two parsers are included with MSMQ. One parser is compatible with the Windows NT Server version 4.0 Network Monitor and SMS version 1.2 Network Monitor. The other parser is compatible with the SMS version 1.1 Network Monitor. Both parsers are installed on your hard disk when you install the MSMQ SDK on a computer running Windows NT Workstation or Windows NT Server. The parsers are not installed on Windows 95 computers.

To install the MSMQ parser

1. If the MSMQ SDK is not already installed, click Start, point to Programs, point to Microsoft Message Queue, click Setup, click Add/Remove, and click Software Development Kit. 

2. If Network Monitor is not yet installed, install it from either Windows NT Server or SMS version 1.1 or later. 

   Run Inst.bat from the MSMQ SDK\NMParser folder (typically c:\Program Files\Msmq\Sdk\Nmparser).

   • To install the parser that is compatible with the Windows NT Server version 4.0 Network Monitor and the SMS version 1.2 Network Monitor, type the following at the Windows NT command prompt: 

     inst < folder > 4.0 

   • where <folder> is your Network Monitor folder. 

   • To install the parser that is compatible with SMS version 1.1 Network Monitor, type the following at the Windows NT Command Prompt: 

     inst < folder > 1.1 

   • where <folder> is your Network Monitor folder. 

Note If N/A appears in the MSMQ protocol fields, you probably have the wrong MSMQ parser installed. To correct this, quit Network Monitor, and then install the correct parser.

For more information on the Network Monitor, see Windows NT Server Version 4.0 Concepts and Planning or your SMS documentation.