| T O P I C R E V I E W |
| kra5139 |
Posted - 03/20/2012 : 5:05:13 PM
Hi all-
I don't know where to start with this one. I have a user that twice now has had an incoming email message 'stuck' somewhere in Exchange 2010 queues (or something). Upon sending him another email, he gets the new message AND the old, previously stuck message. Last time this happened the stuck message was stuck for 30 minutes. He called me on my cell and I sent him a message myself, and he immediately received my new email as well as the stuck one.
Honestly this might be related to anti-virus for Exchange (as about 99% of our Exchange problems really seem to be when they arise...), but I thought I'd throw it out there and ask what you think? I can't reproduce the issue. Other than this issue with what so far seems to be this one user the Exchange server is running fine.
Thoughts?
Thanks ~ k |
| 12 L A T E S T R E P L I E S (Newest First) |
| wobble_wobble |
Posted - 03/28/2012 : 6:51:32 PM
Cool - thanks for the update.
And good luck with the hunt for the issue.
Joe |
| kra5139 |
Posted - 03/28/2012 : 6:16:46 PM
The book I got the info from is Exchange Server 2010 Inside Out, Microsoft Press. The section on the Get-MessageTrackingLog cmdlet is all good stuff. The DELIVER log entry reports that the message WAS delivered, to what mailbox/database/server it was delivered, the receiving database's health (-1 means good apparently), and the message transfer latency. There's other info you can glean out of it, along with all the other log entries (SUBMIT, RECEIVE, etc). It's laid out pretty well in this book over about 8 or so pages. |
| wobble_wobble |
Posted - 03/24/2012 : 08:11:11 AM
Well done on poking and pushing the result. Now where did you get the info? Anything else you learn from the log output?
|
| kra5139 |
Posted - 03/23/2012 : 6:51:59 PM
About Get-MessageTrackingLog's [DatabaseHealth, -1] for wandering eyes that wish to see...
I found a good source and looked the -1 up. According to Microsoft Press, the [DatabaseHealth, -1] flag indicates a healthy database.
~ k |
| kra5139 |
Posted - 03/23/2012 : 6:36:29 PM
Exchange is working fine. Mail is flowing fine. I have no reason to suspect anything is wrong except that this one user has had 2 problems receiving timely email, each of those instances being about a month apart (2 instances while he is one of my heaviest recipients receiving tons of email every day without any problems otherwise). I take it the -1 isn't something to worry about? I understand it's late. Me too. Beer:30 it is.
Thanks a lot Mr. Wobble. |
| wobble_wobble |
Posted - 03/23/2012 : 6:31:18 PM
As its late here, I'll offer the following:
Is Exchange working as far as you know?
Is mail flowing?
If answer to both is yeah.....its beer time. Worry about -1 next week |
| kra5139 |
Posted - 03/23/2012 : 5:59:02 PM
I seriously need to get better at Exchange PowerShell.
I got the logs and sure enough there's the message with a RECEIVE and a DELIVER within 2 seconds of each other, though the message didn't show up in his Outlook for 30 minutes. I'm leaning towards Outlook or possible network communication issue.
I don't see anything else that looks particularly helpful in the log entry, though with some of it I don't really know what I'm looking at. Particularly the last bit:
EventData: {[MailboxDatabaseName, mailbox database xxxx], [DatabaseHealth, -1]}
I'm wondering what the [DatabaseHealth, -1] part means as, after admittedly not-so-thorough research, I can't find anything as to what the -1 means. Negative numbers look scary to me when placed after something like "DatabaseHealth". :-/ |
| wobble_wobble |
Posted - 03/23/2012 : 5:33:12 PM
quote:
Originally posted by kra5139
"When you look at the message header when does it show it was delivered?"
I can't look at the header info right now, but I believe the last time this happened let's say the message was sent at 12:00, then the message was actually received at 12:30 though it showed the time received as being 12:00.
...
Could be an Outlook problem I suppose...
This seems to indicate an Outlook issue.
Unless you have done something different, there should be some logs in Ex that you can look at.
get-messagetrackinglog -recipient "TheUserWithIssue" -Server "ServerName" -Start "2/11/2011 6:31:00 AM" -End "2/12/2011 7:51:00 PM" | fl >messagelog.log
Change the name and dates and have a look.
If the issue occurs again, get the user to check OWA.
Another one, and I may get shot for this, but technically email is best effort. There is no SLA for mail that I am aware of, availability of mail services - yes. We have become so used to it being here and now, that a delay seems like a mad idea. |
| kra5139 |
Posted - 03/23/2012 : 4:25:31 PM
Good advice, I'll do it. I'll post if I find anything else out. Thanks! |
| clearwaterms |
Posted - 03/23/2012 : 4:23:54 PM
It doesn't sound like you can catch it in the act, and in addition, you don't have any log files to try to extrapolate what is causing it, I think you will have to continue to monitor it. If you do see it happen again, before sending another message, have him log into OWA and see if he can see the email message, it could just be a problem with his outlook client. |
| kra5139 |
Posted - 03/23/2012 : 4:16:00 PM
"when you look at the que's is the message sitting in the que? What is the error message?"
I've never caught the problem "in the act". It's only happened twice, and both times it got resolved before I had a chance to look at the queue. It would be easy enough to just leave it alone since it resolves itself, but it's happened twice now and I'm afraid the 'something' causing this is in danger of getting worse. It just doesn't seem right that a small message gets caught ... somewhere for some reason for up to 30 minutes only to be pushed out so it seems by another message.
"When you look at the message header when does it show it was delivered?"
I can't look at the header info right now, but I believe the last time this happened let's say the message was sent at 12:00, then the message was actually received at 12:30 though it showed the time received as being 12:00.
"how is your exchange environment setup (totally exchange 2010, multiple servers, etc)"
One Exch 2010 server hosting all roles
"how is this user connecting to his mailbox (OWA, activesync, Outlook via RPC over HTTP or MAPI) is that different than any other user who is connecting?"
Local Outlook client, not RPC over HTTP
Could be an Outlook problem I suppose... |
| clearwaterms |
Posted - 03/23/2012 : 3:18:52 PM
when you look at the que's is the message sitting in the que? What is the error message? When you look at the message header when does it show it was delivered?
how is your exchange environment setup (totally exchange 2010, multiple servers, etc)
how is this user connecting to his mailbox (OWA, activesync, Outlook via RPC over HTTP or MAPI) is that different than any other user who is connecting?
Antivirus sounds like a likely source but the information you have provided isn't enough to answer the question. |
|
|
