AppAssure is a pretty good product, and I’m happy with it for the most part. It does have its hiccups like most Exchange backup solutions, and working with support over those has been hit and miss.  My latest problem was that an Exchange patching cycle recently forced a base image snap of one of my Exchange servers… that ran dreadfully slow.  Now I’m not the guy on my team to monitor backup success or failure, and apparently nobody else is.

This slow base image backup prevented any nightly job from running for some reason, which meant that logs weren’t being truncated… for days.  I didn’t notice this until a few volumes that house mailbox databases alerted due to disk space.  Since the backup was still running, it never triggered a failure alert.  Likewise we alert on truncation job failures, but since those jobs never ran, no failures were generated there either.

AppAssure support was contacted to see if there was a way to find out the last truncation date via their Powershell module.  The thought was to do a datediff function with the current date and alert based off that.  AppAssure support came back saying that was not possible.  They, of course, were wrong.  I started playing around with their module cmdlets and quickly found that the get-completedjobs cmdlet would be my key to success.  Every Exchange truncation job that kicks off has “with log truncation” in the summary.  Boom.  Easy.  I simply filtered off that and a status of “Succeeded” to get the jobs that successfully truncated Exchange logs.  I used the get-date.AddDays function to set the trigger for the alert.  At the end of the day, it looked like this:

———-

$currentdate = get-date

$compareDate = (Get-Date).AddDays(-2)

If(!(Get-Completedjobs -ProtectedServer servername | where {$_.Summary -like “*with log truncation*”} | Where-Object {$_.EndTime -ge $compareDate}))

{Send-MailMessage –From ExchangeLogTruncationAlerts@domain.com –To emailteam@domain.com –Subject “servername has not truncated logs in 2 or more days!” -Body ‘servername has not successfully completed a backup job with log truncation in over 2 days.  This requires your immediate attention ‘ –SMTPServer smtprelay.domain.com; Add-Content c:\scripts\logtruncation\TruncationEventLog.txt “`n$CurrentDate  –  FAILURE  –  servername has failed the truncation check” }

Else {Add-Content c:\scripts\logtruncation\TruncationEventLog.txt “`n$CurrentDate  –  PASS  –  servername has passed the truncation check”}

———-

I only have 3 protected servers, so I did all this manually.  I suppose if you have a lot of servers, you could use the get-protectedservers cmdlet in a variable and a foreach where $variable.displayname is substituted for servername.  For example:

————

$currentdate = get-date

$compareDate = (Get-Date).AddDays(-2)

$servers = get-ProtectedServers

Foreach ($server in $servers) {

If(!(Get-Completedjobs -ProtectedServer $server.displayname | where {$_.Summary -like “*with log truncation*”} | Where-Object {$_.EndTime -ge $compareDate}))

{Send-MailMessage –From ExchangeLogTruncationAlerts@domain.com –To emailteam@domain.com –Subject “$($server.displayname) has not truncated logs in 2 or more days!” -Body ‘$($server.displayname) has not successfully completed a backup job with log truncation in over 2 days.  This requires your immediate attention ‘ –SMTPServer smtprelay.domain.com; Add-Content c:\scripts\logtruncation\TruncationEventLog.txt “`n$CurrentDate  –  FAILURE  –  $($server.displayname) has failed the truncation check” }

Else {Add-Content c:\scripts\logtruncation\TruncationEventLog.txt “`n$CurrentDate  –  PASS  –  $($server.displayname) has passed the truncation check”}

———-

This could obviously use fine tuning, but it’s a quick and easy way to get alerts for missed days of truncating Exchange logs.