Continuity - Monitor

This article contains information on configuring and using the Continuity Monitor to detect, alert, and manage email disruptions, including prerequisites, detection algorithms, failure counters, and detailed setup steps for Mimecast services.

 

Introduction

The Continuity Monitor will alert you to a mail-flow disruption, so you can respond accordingly, e.g. by enabling a Continuity event, if required.

Prerequisites

• • • You have created a Continuity Connector.
    • You have Application Impersonation rights to your organization's mailboxes so that outbound emails can be sent to Mimecast as part of the monitoring process.
      • If you're using Exchange On-Premises, see the Configuring Application Impersonation guide for your version of Exchange. You'll need to provide the credentials of the mailbox if you want to grant this permission.
      • If you're using Microsoft 365, see Managing Connectors.
    • You have a mailbox-licensed account in the organization to send the Outbound emails, if the Outbound Monitor will be enabled. This cannot be an alias or contact, and preferably should not be an actual person's mailbox.

Continuity Monitor Detection Algorithm

The Continuity Monitor uses a detection algorithm to determine whether your email server will go offline, or experience delivery issues. Failure counts increase and decrease as issues arise and are resolved.
The counter can be set to alert you when potential issues arise by setting a threshold. 

Once your Inbound and Outbound Continuity Monitor is configured:

• • • If the thresholds that you have configured in the Continuity Monitor are triggered, and you are sent an alert or (by SMS or email message) that a Continuity condition has been met.
    • You can click on the link to the Continuity Portal from inside the SMS or email message (which is valid for 24 hours), and use this to start, stop or extend a Continuity event.
    • Alerts are issued every 30 minutes, for as long as the detection algorithm detects a potential issue, and one or more threshold conditions have been met, and these alerts can be suspended via the Continuity Portal.

If both inbound and outbound checks are enabled, and either or both checks fail, the counter only increases by one per two minute check period.

Inbound Trafic

The algorithm monitors your organization's normal inbound email traffic. The events and their effect on the failure counter are:

Event	Failure Count
A failure is detected. A failure is detected based on the last usable route. If you've multiple fail over routes associated, all must fail before the failure counter is increased.	Increases by 1.
No inbound traffic is detected.	Decreases by 1.
No failures detected.	Decreases by 1.

Outbound Traffic

Mimecast simulates outbound emails with outbound traffic. By logging in to a specified mailbox, and sending a specially formatted email outbound to <custom-string>@mimecastmonitor.com email address. You can find these messages by navigating to Message Center | Accepted Messages, and filtering on Outbound.
When a two-minute window begins, Mimecast checks to see if the last sent message was received within the acceptable latency window.

The events and their effect on the failure counter are:

Event	Failure Count
A failure is detected.	Increases by 1.
The test message is delivered successfully.	Decreases by 1.

Maximum / Minimum Failure Count

If the failure counter reaches the specified threshold, an email alert is sent to the specified e-mail addresses and / or cell phone numbers. There will be no increase in the failure counter over the configured threshold as long as the checks continue. Furthermore, the failure counter cannot go below zero. There is no decrease if the failure counter is already zero when a decrease is required.

Configuring a Continuity Monitor

You can configure a Continuity Monitor, by using the following steps:

1. Log on to the Mimecast Administration Console.
2. Navigate to Services | Continuity.
3. Click on New Continuity Monitor.
4. Enter details for Mail Server Monitoring:

• • • • Description: Specify a description for the monitoring event, e.g. Head Office Server Continuity Monitor.
      • Notes: You can enter optional notes about the Continuity Monitor, of up to 500 characters.
      • Time Zone: Select the appropriate time zone from the drop down list, that the Continuity Monitor start / end time should be based on.
      • Enable Inbound Check: If selected, inbound email is monitored for failures, and further fields are displayed:
        • Delivery Route: Select the delivery route to monitor from the drop down list. If you've configured fail over routes (alternative routes), they're also monitored.
          A failure only occurs after all fail over routes meet the threshold template. Once a value is selected, the Preview Route field is displayed.
        • Preview Route: Click on the  icon to display the route's properties. Click on the Go Back button to return to the Continuity Monitor configuration screen.
      • Enable Outbound Check: If selected, a test email is sent to Mimecast, to confirm that outbound messages are reaching their destination, and further fields are displayed:
      • Latency Threshold: You can specify the maximum number of seconds allowed to receive an outbound message, before a failure occurs. A value of 30 to 300 can be entered, but a value of 50 is a good starting point.
        See The Continuity Monitor Detection Algorithm for how this threshold value is used.
      • Connector: Select a configured Connector from the drop down list.
      • Test Email Address: Click on Lookup, to select the email address to be used to send the test message. We recommend that this should be on the same server as the affected users, and is not an active user. An alias email address cannot be used.
    • Failure Counter Threshold: Use this to set the failure count required to trigger an alert. Each monitoring cycle is two minutes, with the counter incremented once per cycle. A value of 1 to 20 can be entered, but a value between 3 and 6 is a good starting point.  
      See The Continuity Monitor Detection Algorithm for how this threshold value is used.
    • Send Administrator Notifications: Click on Look Up,  to select a group of administrators to be notified when a potential event is detected. The notification contains a link to the Continuity Portal to enable them to manage the event.
      Administrators can be notified by selecting one or both of the following options:
      • Notify by Email: The selected group must contain valid email addresses (preferably external), and the message is only delivered if the mailbox is accessible.
    • Notify by SMS: The users in the group must be subscribed to the Mimecast SMS service to receive these SMS. Read the Subscribing to SMS User Notifications page for further details. 

5. Enter details for Continuity Event:

• • • • Affected Group: Click on Look Up, to select the Active Directory group, or Mimecast User Group, which the Continuity event applies to.

        Users in the group must have the correct permissions enabled for Disaster Recovery to be invoked. Users without the correct permissions, or who do not have the client properly installed and configured, will not participate in the Continuity event.

      • Enable Outlook Continuity: You can select this option, to apply the Continuity event to Mimecast for Outlook.

        Mimecast for Outlook can only enter Continuity mode if Use Cached Exchange Mode is enabled in your Account Settings for Microsoft Outlook. If Microsoft Outlook is un non-cached mode, Continuity functionality will not be available.

      • Allow Cloud Password Reset:
        • If set to Never, your end users are not allowed to reset their Cloud password.
        • If set to any other option, your end users can reset their Cloud password using the specified method via the Reset Cloud Password link in the Mimecast Personal Portal login dialog.

          This option overrides any options set elsewhere. For example, if this option is set to email and other options are set to SMS, any alerts are sent via email.

      • Expand Distribution List During Continuity Event: You can select this option so that your end users are able to view and respond to messages sent to a distribution list that they are a member of during a Continuity event.
        These messages will be available via the online Inbox of all Mimecast applications, including the user's local Inbox when Mimecast for Outlook is working in Continuity mode.
        This also applies when viewing the online inbox of a delegate's mailbox. For example, if the delegate mailbox is in continuity but the other user viewing the mailbox is not, the other user will see mail sent to the distribution lists of the delegate.

        Active Directory synchronization must be enabled for group membership to be available. Group membership is based on the last successful synchronization.

      • Pause Inbound Delivery for the Duration of This Event: You can select this option to hold inbound emails in the Mimecast delivery queue.
        These messages are still available to users through all Mimecast end-user applications, during the Continuity event.

6. Enter details for Application User Notifications:

• • • • Event Start Message: You can use this field to enter a message to send to users when the Continuity event starts (e.g., explaining the reason why the Continuity event has started). This field is limited to 250 characters in length.

      • Event End Message: You can use this field to enter a message to send to users when the Continuity event ends (e.g., explaining that normal service has been resumed). This field is limited to 250 characters in length.

        Mimecast for Outlook users must be logged in prior to the Continuity event starting.

7. Enter details for SMS User Notifications:

• • • • SMS Group: Click on Look Up, to select the Active Directory group, or Mimecast User Group, which SMS notifications will be sent to.

        SMS notifications will only be sent to the SMS Group that has been set up. To receive SMS notifications, users must have first provided consent by opt-in. See Subscribing to SMS User Notifications.

      • Phone Number Attribute: This shows the attribute used to define your end users’ cell phone numbers, and is configured using the SMS Dashboard.
      • Event Start SMS: You can use this field to enter a message to send to users when the Continuity event starts (e.g. explaining the reason why the Continuity event has started).
        SMS notifications will be preceded by the caption Email Status and are limited to 120 characters in length.
      • Event End SMS: You can use this field to enter a message to send to users when the Continuity event ends (e.g. explaining that normal service has been resumed). This field is limited to 120 characters in length.

8. Click on the Save and Exit button.