Network Monitor (Netmon.exe) is one of the Microsoft Windows Server 2003 administrative tools. Netmon is used to monitor network traffic at the packet level. Netmon is not installed by default, but you can install it yourself from Control Panel. Netmon is useful for identifying what network activities are occurring at the same time an issue is occurring. For example, you can use Netmon to capture network activity on the Exchange server and correlate the times of events in the event logs with the network activities that appear in the Netmon capture. (For example, Exchange servers contacting domain controllers, global catalogs, or Domain Name System (DNS) servers.)

Procedure

LogParser (LogParser.exe or LogParser.dll) is a helpful tool that can help you analyze Netmon captures. LogParser can read Netmon .cap files natively. It can also export .cap data to .csv files for use in Microsoft Excel. For example, to export the Netmon capture named NetMonCapture.cap to the .csv file named NetMonOutput.csv, open a Command Prompt window and run the following command:

	Copy Code
C:\Program Files\Log Parser 2.2>logparser -i:NETMON -o:CSV "select * INTO NetMonOutput.csv from NetMonCapture.cap"

The path location in the preceding example is the default installation location for LogParser. If you install LogParser in a non-default location, you must specify the installed location. To download LogParser, see Log Parser 2.2.

Netstat is a command that you issue from a command prompt. It enumerates current network connections and lists them with information about process ID, protocol, local address, foreign address, and state. For a list of options, type netstat /? at a command prompt.

You must use the Exchange Management Shell to set the Microsoft Exchange Replication Service (MSExchangeRepl) logging level (for either LCR or CCR configurations) and the Windows Cluster service event logging level for CCR. The possible logging levels that you can set are Lowest, Low, Medium, High, and Expert. The default logging level is Lowest.

Note:
You should always return the logging level to the default setting after completing your troubleshooting activities.

The following examples show you how to use the Get-EventLogLevel and the Set-EventLogLevel cmdlets in the Exchange Management Shell to increase logging levels. The first example applies to the Microsoft Exchange Replication Service and shows how to increase the logging level to Expert:

	Copy Code
Get-EventLogLevel -id:"MSExchange Repl" | Set-EventLogLevel -Level expert

The following example shows you how to increase the logging level for the Cluster service to Expert:

	Copy Code
Get-EventLogLevel -id:"MSExchange Cluster" | Set-EventLogLevel -Level expert

The Cluster Recovery utility is a tool that collects several pieces of functionality that are particularly useful in a server cluster after a disk on the shared bus has failed. The Cluster Server Recovery utility is included in the Microsoft Windows Server 2003 Resource Kit Tools. Alternatively, you can download the Cluster Server Recovery utility from Cluster Server Recovery Utility (ClusterRecovery.exe).

The Cluster Diagnostics and Verification tool performs basic verification and configuration analysis checks on a pre-production server cluster and creates log files to help system administrators identify configuration issues prior to deployment in a production environment. ClusDiag can capture all relevant log files and event logs from each node of a server cluster and merge them into a single file for easy analysis and troubleshooting. Administrators can analyze these log files with built-in filtering, merging, and bookmarking functionality, and generate various diagnostics reports. ClusDiag can also create text-based and graphical reports of cluster disk and network configurations as well as generate a graphical view of the cluster resource dependency tree.

You can download Clusdiag from Cluster Diagnostics and Verification Tool (ClusDiag.exe).