Get-logonstatistics
I see this is a useful command to run to gain knowledge about clients.
But when I run get-logonstatistics -identity
me@mydomain.com | fl
I seem to get loads of entries, as in lots of different times, do they refer to different times I opened Outlook? Is there a way to add a switch just to get the latest entry?
Also, there is an entry for "latency". Does this mean latency from the machine where I ran Powershell or latency between the client and the mailbox server?
March 3rd, 2011 2:49pm
On Thu, 3 Mar 2011 19:41:26 +0000, Joe Budden wrote:
>
>
>I see this is a useful command to run to gain knowledge about clients.
>
>But when I run get-logonstatistics -identity me@mydomain.com | fl
>
>I seem to get loads of entries, as in lots of different times, do they refer to different times I opened Outlook? Is there a way to add a switch just to get the latest entry?
They refer to the different connections that have been made and
remembered by the information store service. It's also important to
remember that Outlook makes many connections to your mailbox and to
any delegate mailboxes in our profile. The default timeout on a
connection is two hours so an abandoned connection will still be
displayed even if it's no longer in use.
There's no switch. You can use something like this, though:
get-logonstatistics <name> | sort lastaccesstime
>Also, there is an entry for "latency". Does this mean latency from the machine where I ran Powershell or latency between the client and the mailbox server?
It's a value reported by the client and includes the time to transit
the network and the server processing time.
---
Rich Matheisen
MCSE+I, Exchange MVP
--- Rich Matheisen MCSE+I, Exchange MVP
Free Windows Admin Tool Kit Click here and download it now
March 3rd, 2011 10:18pm
Thanks for the answer, Rich.
Still not sure about this one, though:
>Also, there is an entry for "latency". Does this mean latency from the machine where I ran Powershell or latency between the client and the mailbox server?
It's a value reported by the client and includes the time to transit
the network and the server processing time
So if I ran get-logonstatistics -identity user@domain.com | fl
And the latency for the last accessed time was 1000
Does this mean:
1. There is 1000ms network latency between the client and the Exchange mbx server
2. There is 1000ms network latency between the client and the server I am running that command on
3. The RPC latency is 1000ms between the client and the mbx server
And could you also clarify the difference between network and RPC latenccy?
Many thanks for all your help
March 4th, 2011 2:52am
On Fri, 4 Mar 2011 07:40:36 +0000, Joe Budden wrote:
>Thanks for the answer, Rich.
>
>Still not sure about this one, though:
>>>Also, there is an entry for "latency". Does this mean latency from the machine where I ran Powershell or latency between the client and the mailbox server?
>>It's a value reported by the client and includes the time to transit the network and the server processing time
>So if I ran get-logonstatistics -identity user@domain.com | fl And the latency for the last accessed time was 1000
>Does this mean:
>1. There is 1000ms network latency between the client and the Exchange mbx server
>2. There is 1000ms network latency between the client and the server I am running that command on
>3. The RPC latency is 1000ms between the client and the mbx server
It means that, as measured by the client, it took 1000ms from the time
the RPC was issued until the result was returned. IIRC, it's not the
"last" value though, it's an average of the last "X" RPCs (I don't
recall exactly what "X" is)).
>And could you also clarify the difference between network and RPC latenccy? Many thanks for all your help
Network latency is the time it takes for the data to move between the
client and the server -- round trip.
RPC latency is measured at the server. It's how long it takes for the
RPC operation to finish.
The client just sees the elapsed time, which should be the total of
the two latencies.
---
Rich Matheisen
MCSE+I, Exchange MVP
--- Rich Matheisen MCSE+I, Exchange MVP
Free Windows Admin Tool Kit Click here and download it now
March 4th, 2011 8:43pm
Thanks
This morning I had an issue where if I checked get-logonstatistics latency for a user, the latency was listed as about 800. The user in question was saying that his Outlook was unresponsive.
However, if I ran a Ping from the same Exchange server I ran the get-logontstatistics command from, the result was about 20ms.
Do you know what could cause the difference?
March 5th, 2011 6:25am
On Sat, 5 Mar 2011 11:16:43 +0000, Joe Budden wrote:
>This morning I had an issue where if I checked get-logonstatistics latency for a user, the latency was listed as about 800. The user in question was saying that his Outlook was unresponsive.
>
>However, if I ran a Ping from the same Exchange server I ran the get-logontstatistics command from, the result was about 20ms.
>
>Do you know what could cause the difference?
Lots of things. Insufficient memory, an overburdened I/O system,
mailbox folders with a gazillion items in them, working with multiple
(i.e. delegate) mailboxes in the same profile, desktop search engines
that index mailboxes, not working in cached mode, etc.
Have a look perfmon and see if you have excessivly long I/O times,
long I/O queues, larger than exected RPC Requests outstanding, etc.
---
Rich Matheisen
MCSE+I, Exchange MVP
--- Rich Matheisen MCSE+I, Exchange MVP
Free Windows Admin Tool Kit Click here and download it now
March 5th, 2011 11:26am
Thanks Richard, maybe I am not understanding this correctly.
So the latency I see under logonstatistics and the latency I get from a ping are two different things you are saying? The logonstatistics one is RPC latency, whereas the Ping one is purely network latency.
Therefore, in the case of this morning where the user had 800ms latency from logonstatistics data, this may not necessarily have been a network issue? The network could actually have been fine, but his PC may have been slow, Exchange server may have been
under load etc?
March 5th, 2011 12:39pm
On Sat, 5 Mar 2011 17:19:35 +0000, Joe Budden wrote:
>Thanks Richard, maybe I am not understanding this correctly.
>
>So the latency I see under logonstatistics and the latency I get from a ping are two different things you are saying?
Ping doesn't even use TCP. ;-) It uses ICMP and doesn't go very far up
the network stack. It's useful for verifying connectivity and the time
it takes for a very small (32 byte) packet of data to traverse the
network between two endpoints on a network. You may see a longer
"ping" time reported if you were to use a larger packet size (e.g.
ping <addr> -l 1472). Using "pathping" yields a better result becasue
it runs for a longer interval.
>The logonstatistics one is RPC latency, whereas the Ping one is purely network latency.
The get-logonstatistics reports the TOTAL latency, from the time the
RPC is issued until the RPC result is returned. The size of the data
is considerably larger than 32 bytes and information about network
retries isn't broken out -- think of it as you timing how long it
takes you to get from your house to a store and return home, including
the time you spend in the store. The time it takes you to get to and
from the store is pretty much the same as the "network latency" and it
includes local speed limits, other traffic on the road, detours, etc.
Once you get to the store you leave your car, enter the store and,
once you're in the store, you have to find what you wanted to buy and
then go stand in line at the checkout, and then return to your car.
That's the rough equivilent of the RPC latency. Add the two times and
you have the something like the figure reported by the
get-logonstatistics "latency" value.
>Therefore, in the case of this morning where the user had 800ms latency from logonstatistics data, this may not necessarily have been a network issue?
Maybe, maybe not.
>The network could actually have been fine, but his PC may have been slow, Exchange server may have been under load etc?
Sure. Maybe.
You can run ExMon to report on lots of things that you're asking
about:
http://www.microsoft.com/downloads/en/details.aspx?FamilyId=9A49C22E-E0C7-4B7C-ACEF-729D48AF7BC9&displaylang=en
---
Rich Matheisen
MCSE+I, Exchange MVP
--- Rich Matheisen MCSE+I, Exchange MVP
Free Windows Admin Tool Kit Click here and download it now
March 5th, 2011 2:11pm
Great analogy! The store in this case is the Exchange server, correct?
In terms of ExMon and the issue where network latency/RPC latency were quite different, what sort of thing would I be looking for to try and identity the problem and figure out if it's a local issue or Exchange issue?
March 5th, 2011 2:49pm
On Sat, 5 Mar 2011 19:42:22 +0000, Joe Budden wrote:
>Great analogy! The store in this case is the Exchange server, correct?
Yes.
>In terms of ExMon and the issue where network latency/RPC latency were quite different, what sort of thing would I be looking for to try and identity the problem and figure out if it's a local issue or Exchange issue?
I'd look for excessive CPU time and server latency. You may find that
the client is issuing lots of RPCs or the mailbox has way too many
items in too few folders (which would casue the too many RPCs).
If the problem happens pnly to one user it's almost always a problem
with the mailbox and, in the case of people that never move anything
out of their Inbox, it's almost always a case of way too many items in
the folder.
---
Rich Matheisen
MCSE+I, Exchange MVP
--- Rich Matheisen MCSE+I, Exchange MVP
Free Windows Admin Tool Kit Click here and download it now
March 5th, 2011 3:26pm