Scheduling ExMON Traces in Exchange 2003

When monitoring Mapi Client statistics, having to manually run the traces can be a troublesome.
After some investigation I found a way to schedule the EXMON traces using a tool called “Tracelog.exe” which is part of the W2000 Resource Kit.

Windows 2000 Resource Kit: Tracelog
Exchange User Monitor: ExMON

For this posting I will assume you have EXMON installed and have also run the installation for the Windows 2000 Resource Kit tool “TraceLog” found above.There are obviously several ways you can both schedule and manipulate the Exchange traces. For me the simplest is to create a folder, preferably on another local disk not your “system” drive. In the folder place both the “tracelog.exe” from the tracelog installation folder and a copy of the “.guid” file from the EXMON application folder.

Once created you can then proceed to create the Schedule jobs in the AT Scheduler.

You will need to create two scheduled jobs, one to start the trace and one to stop the trace.

Start Trace Command:
Tracelog.exe -start [sessionid] -guid [GUID file location] -f [Trace file location]


TRACELOG.EXE -start "Exchange Trace" -guid guid.txt -f Trace.etl

Stop Trace Command:
Tracelog.exe -stop [sessionid]


TRACELOG.EXE -stop "Exchange Trace"

Utilizing the above command in scheduled jobs, will enable you to schedule captures of Exchange User/Client Mapi session information. I normally embed the commands in batch files and add commands to rename and move the capture files off the DAS on the physical system. This will eliminate the need to keep track of the files and move them to prevent disks usage issues.


In a command file you could have the following commands to stop a trace, rename and move a file.

TRACELOG.EXE -stop "Exchange Trace"Rename D:\trace.etl \\Remote\Server_EXMON-%date:~4,2%-%date:~7,2%-%date:~10,4%.etl

Hope this helps.

All information is provided on an AS-IS basis, with no warranties and confers no rights.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s