I see this is a useful command to run to gain knowledge about clients. But when I run get-logonstatistics -identity me@mydomain.com | fl I seem to get loads of entries, as in lots of different times, do they refer to different times I opened Outlook? Is there a way to add a switch just to get the latest entry? Also, there is an entry for "latency". Does this mean latency from the machine where I ran Powershell or latency between the client and the mailbox server?

On Thu, 3 Mar 2011 19:41:26 +0000, Joe Budden wrote: > > >I see this is a useful command to run to gain knowledge about clients. > >But when I run get-logonstatistics -identity me@mydomain.com | fl > >I seem to get loads of entries, as in lots of different times, do they refer to different times I opened Outlook? Is there a way to add a switch just to get the latest entry? They refer to the different connections that have been made and remembered by the information store service. It's also important to remember that Outlook makes many connections to your mailbox and to any delegate mailboxes in our profile. The default timeout on a connection is two hours so an abandoned connection will still be displayed even if it's no longer in use. There's no switch. You can use something like this, though: get-logonstatistics <name> | sort lastaccesstime >Also, there is an entry for "latency". Does this mean latency from the machine where I ran Powershell or latency between the client and the mailbox server? It's a value reported by the client and includes the time to transit the network and the server processing time. --- Rich Matheisen MCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

Thanks for the answer, Rich. Still not sure about this one, though: >Also, there is an entry for "latency". Does this mean latency from the machine where I ran Powershell or latency between the client and the mailbox server? It's a value reported by the client and includes the time to transit the network and the server processing time So if I ran get-logonstatistics -identity user@domain.com | fl And the latency for the last accessed time was 1000 Does this mean: 1. There is 1000ms network latency between the client and the Exchange mbx server 2. There is 1000ms network latency between the client and the server I am running that command on 3. The RPC latency is 1000ms between the client and the mbx server And could you also clarify the difference between network and RPC latenccy? Many thanks for all your help

On Fri, 4 Mar 2011 07:40:36 +0000, Joe Budden wrote: >Thanks for the answer, Rich. > >Still not sure about this one, though: >>>Also, there is an entry for "latency". Does this mean latency from the machine where I ran Powershell or latency between the client and the mailbox server? >>It's a value reported by the client and includes the time to transit the network and the server processing time >So if I ran get-logonstatistics -identity user@domain.com | fl And the latency for the last accessed time was 1000 >Does this mean: >1. There is 1000ms network latency between the client and the Exchange mbx server >2. There is 1000ms network latency between the client and the server I am running that command on >3. The RPC latency is 1000ms between the client and the mbx server It means that, as measured by the client, it took 1000ms from the time the RPC was issued until the result was returned. IIRC, it's not the "last" value though, it's an average of the last "X" RPCs (I don't recall exactly what "X" is)). >And could you also clarify the difference between network and RPC latenccy? Many thanks for all your help Network latency is the time it takes for the data to move between the client and the server -- round trip. RPC latency is measured at the server. It's how long it takes for the RPC operation to finish. The client just sees the elapsed time, which should be the total of the two latencies. --- Rich Matheisen MCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

Thanks This morning I had an issue where if I checked get-logonstatistics latency for a user, the latency was listed as about 800. The user in question was saying that his Outlook was unresponsive. However, if I ran a Ping from the same Exchange server I ran the get-logontstatistics command from, the result was about 20ms. Do you know what could cause the difference?

On Sat, 5 Mar 2011 11:16:43 +0000, Joe Budden wrote: >This morning I had an issue where if I checked get-logonstatistics latency for a user, the latency was listed as about 800. The user in question was saying that his Outlook was unresponsive. > >However, if I ran a Ping from the same Exchange server I ran the get-logontstatistics command from, the result was about 20ms. > >Do you know what could cause the difference? Lots of things. Insufficient memory, an overburdened I/O system, mailbox folders with a gazillion items in them, working with multiple (i.e. delegate) mailboxes in the same profile, desktop search engines that index mailboxes, not working in cached mode, etc. Have a look perfmon and see if you have excessivly long I/O times, long I/O queues, larger than exected RPC Requests outstanding, etc. --- Rich Matheisen MCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

Thanks Richard, maybe I am not understanding this correctly. So the latency I see under logonstatistics and the latency I get from a ping are two different things you are saying? The logonstatistics one is RPC latency, whereas the Ping one is purely network latency. Therefore, in the case of this morning where the user had 800ms latency from logonstatistics data, this may not necessarily have been a network issue? The network could actually have been fine, but his PC may have been slow, Exchange server may have been under load etc?

On Sat, 5 Mar 2011 17:19:35 +0000, Joe Budden wrote: >Thanks Richard, maybe I am not understanding this correctly. > >So the latency I see under logonstatistics and the latency I get from a ping are two different things you are saying? Ping doesn't even use TCP. ;-) It uses ICMP and doesn't go very far up the network stack. It's useful for verifying connectivity and the time it takes for a very small (32 byte) packet of data to traverse the network between two endpoints on a network. You may see a longer "ping" time reported if you were to use a larger packet size (e.g. ping <addr> -l 1472). Using "pathping" yields a better result becasue it runs for a longer interval. >The logonstatistics one is RPC latency, whereas the Ping one is purely network latency. The get-logonstatistics reports the TOTAL latency, from the time the RPC is issued until the RPC result is returned. The size of the data is considerably larger than 32 bytes and information about network retries isn't broken out -- think of it as you timing how long it takes you to get from your house to a store and return home, including the time you spend in the store. The time it takes you to get to and from the store is pretty much the same as the "network latency" and it includes local speed limits, other traffic on the road, detours, etc. Once you get to the store you leave your car, enter the store and, once you're in the store, you have to find what you wanted to buy and then go stand in line at the checkout, and then return to your car. That's the rough equivilent of the RPC latency. Add the two times and you have the something like the figure reported by the get-logonstatistics "latency" value. >Therefore, in the case of this morning where the user had 800ms latency from logonstatistics data, this may not necessarily have been a network issue? Maybe, maybe not. >The network could actually have been fine, but his PC may have been slow, Exchange server may have been under load etc? Sure. Maybe. You can run ExMon to report on lots of things that you're asking about: http://www.microsoft.com/downloads/en/details.aspx?FamilyId=9A49C22E-E0C7-4B7C-ACEF-729D48AF7BC9&displaylang=en --- Rich Matheisen MCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

Great analogy! The store in this case is the Exchange server, correct? In terms of ExMon and the issue where network latency/RPC latency were quite different, what sort of thing would I be looking for to try and identity the problem and figure out if it's a local issue or Exchange issue?

On Sat, 5 Mar 2011 19:42:22 +0000, Joe Budden wrote: >Great analogy! The store in this case is the Exchange server, correct? Yes. >In terms of ExMon and the issue where network latency/RPC latency were quite different, what sort of thing would I be looking for to try and identity the problem and figure out if it's a local issue or Exchange issue? I'd look for excessive CPU time and server latency. You may find that the client is issuing lots of RPCs or the mailbox has way too many items in too few folders (which would casue the too many RPCs). If the problem happens pnly to one user it's almost always a problem with the mailbox and, in the case of people that never move anything out of their Inbox, it's almost always a case of way too many items in the folder. --- Rich Matheisen MCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP