MailStore (Server & SPE)

The MailStore (Server & SPE) check reports the number of archived users, evaluates archiving profile runs and monitors TLS certificate expiry — the last two on by default. The Edition field picks the product. MailStore SPE (Management API) queries the Service Provider Edition (SPE) Management API — no per-instance access is needed — and reports a count per instance plus a deployment-wide total; stopped instances still count toward the total when license data is available. MailStore Server (Administration API) queries a single MailStore Server, which has no instances, and reports one count. The check runs on Windows only (Server and Desktop), on the octoja agent of a host that can reach the MailStore API, every 360 minutes (6 hours). The interval is not user-configurable.

Prerequisites

• MailStore SPE installed on a Windows server
• The octoja agent installed on the same server (or any Windows host that can reach the SPE Management API)
• A Management API user with permission to list instances and (optionally) query users, profiles and worker results — create it under Management Console → User Administration in SPE
• Network reachability from the agent to the SPE Management API host on TCP/8474 (or your configured port)

For MailStore Server (Administration API) you need a MailStore administrator instead; the Administration API uses port 8463 by default.

Where is the Management Console? On the SPE management host, look for "MailStore SPE Management Console" in the Start menu. Documentation: help.mailstore.com (the former SPE wiki page for the Management API has been retired — start from the documentation hub).

Steps

1. Make sure the octoja agent is installed on a Windows device that can reach the MailStore API.
2. Go to Devices and open that device.
3. Click the Checks tab → Add Check → MailStore (Server & SPE).
4. Choose the Edition — the first field in the dialog. For an SPE deployment, leave it on MailStore SPE (Management API).
5. Enter Server, Port, Username and Password, and adjust the monitoring options (see Settings).
6. Click Add Check.

After the first check interval, the result appears in the device's Checks tab with the total, a per-instance breakdown (name, status, user count, count source), an archiving-profile section (profiles checked and failed, plus a row for each unhealthy profile) and a certificate section listing each probed endpoint and its remaining lifetime.

Settings

If Warning threshold (days) is lower than Critical threshold (days), the check swaps the two values before evaluation. A Look-back window (hours) below 1 is treated as 1 hour.

Results

The overall check result is the worst status across the user counts, the archiving profiles and the monitored certificates.

• Successful archiving profiles are counted but do not appear as individual problem rows in the result.
• HTTP timeout per API call is 30 seconds. Additional certificate endpoints are probed with a 10-second timeout.
• If querying profile runs (GetWorkerResults) fails for an instance, for example because the API user lacks permission, the check skips the archiving evaluation for that instance without reporting a warning.
• In SPE, a successful run distinguishes three count sources per instance: GetUsers is the authoritative live count for running instances; License is the per-instance usedLicenseCount from the SPE license report, used as a fallback when GetUsers fails; License(stopped) is the same fallback for stopped instances.
• MailStore Server has no instances, so the check reports a single row named after the configured server, and the count always comes from GetUsers — there is no license fallback. Archiving profile runs and certificate expiry are evaluated the same way as in SPE.

Metrics collected

Per check run:

• totalUsers — sum of userCount across all instances
• instanceCount — number of instances returned by GetInstances; always 1 in MailStore Server edition
• profilesChecked — archiving profiles whose latest run was evaluated across all instances
• profilesFailed — of those, how many had a critical last run

Per instance:

• instanceId — SPE instance identifier; empty in MailStore Server edition
• name — instance display name (falls back to alias, then to ID); the configured server host in MailStore Server edition
• status — instance lifecycle status from SPE (e.g. Running, Stopped); always running in MailStore Server edition
• userCount — archived user count, or null if undetermined
• source — how the count was obtained: GetUsers (running + API call), License (running + license fallback), License(stopped) (stopped + license fallback), empty (undetermined). The two license values are SPE-only

Per archiving profile — only profiles whose latest run was not healthy are listed; healthy ones are counted only:

• instanceName — instance the profile belongs to
• profileName — profile name from GetProfiles, or the profile ID when the name could not be resolved
• lastStatus — raw MailStore status token of the latest run
• lastRunAt — timestamp of the latest run, or null

Per probed certificate endpoint:

• endpoint — host:port that was probed
• notAfter — certificate expiry, or null when the certificate could not be read
• daysRemaining — days until expiry, negative once expired
• unreachable — true when the endpoint could not be reached or presented no certificate

Privacy and credentials

• The check uses HTTP Basic authentication. The configured credentials are used only for the API calls and are never included in the check output.
• The check does not capture user names, email addresses, or any archive content — only counts, archiving profile names with their last run status, and certificate expiry data.

Tips

• User counts change slowly in archive workloads; the 6-hour interval avoids needless load on the SPE management host.
• Use a dedicated read-only Management API user for octoja. If the credentials ever leak, you can rotate them in the SPE Management Console without touching real archive users.
• If you split SPE across multiple management hosts, configure one check per management host — each is queried independently.
• The Total users figure in the check result is the sum across all instances, useful for license tracking and capacity planning.