Incorrect delivery reports

Mikhail Firsov 1,876 Reputation points
2020-11-19T09:51:46.923+00:00

Hello,
Strange problem: delivery reports displays only a subset of sent/received messages (or display nothing at all), for example when I search my admin's mailbox that contains (18.11.2020) 6 unread items any many-many read ones I see only 2 !!! messages:
40940-3-1.png

I even sent the message from my private mailbox (at 6:00 as illustrated in the screenshot) and had no issues finding it in the tracking log manually.
For some users delivery reports return 0 messages although get-mailbox thatuser displays ~100... of items in his/her mailbox.

What am I missing here ???

Thank you in advance,
Michael

Microsoft Exchange Online Management
Microsoft Exchange Online Management
Microsoft Exchange Online: A Microsoft email and calendaring hosted service.Management: The act or process of organizing, handling, directing or controlling something.
4,161 questions
Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
7,331 questions
0 comments

3 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Joyce Shen - MSFT 16,641 Reputation points
    2020-11-20T02:32:00.177+00:00

    Hi @Mikhail Firsov ,

    We can check the meanings for the eventid in Message Tracking Log in the offcial document: Event types in the message tracking log

    HADISCARD A shadow message was discarded after the primary copy was delivered to the next hop.

    HARECEIVE A shadow message was received by the server in the local database availability group (DAG) or Active Directory site.

    And the delivery status of the message you can see in EAC:

    • Delivered: Indicates successful delivery.
    • Deferred: Indicates that a message is delayed.
    • Pending: If message delivery is pending because a message meets the criteria for an organization-wide rule or policy or because it's subject to message approval, the status message explains what action a rule is performing or that the message must be approved by a moderator before delivery.
    • Moderator: The status indicates whether the message was approved or rejected by the moderator.
    • Groups Expanded: If a message was sent to a group, the individual users are shown in the Summary to date section so you can see the delivery status for each recipient. If you need to remove or add a user to a group during a delivery report investigation, you can modify a group by clicking Edit Groups.
    • Failed: Shows the date, time, and reason for a message delivery failure. For example, an organization-wide rule may be blocking message delivery or the message couldn't be delivered.

    In addition, please also note that there have some limitation for delivery report in EAC:

    41235-qa-2020-11-20-10-14-29.png

    Detailed information here: Track messages with delivery reports

    If an Answer is helpful, please click "Accept Answer" and upvote it.

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
     

    0 comments
  2. Mikhail Firsov 1,876 Reputation points
    2020-11-20T14:34:24.327+00:00

    Hi joyceshen-MSFT,

    "We can check the meanings for the eventid" - you're right, I was also suprised not seeing DELIVER eventid - I can't explain this. Here's one more example: there're 3 messages sent from Bail to Bail (1) and from admin to Bail (2) in Outlook on the Web:
    41429-5.png

    The logs display no single DELIVER eventid although all messages have been delivered:
    41395-7.png

    ?

    0 comments
  3. Mikhail Firsov 1,876 Reputation points
    2020-11-23T13:34:22.167+00:00

    Hi AshokM-8240,

    "It looks silly" - no, it was my assertion "The logs display no single DELIVER eventid" that looked silly... forgot about the second server...shame on me :((( Thank you so much for pointing out!

    Regarding my initial question: I think the problem stems from my assumption that selecting only the first option - Mailbox to search - (withouth the second one "...sent to" or the third "...from") - would return all messages in the mailbox, but that is not true (at least in 2019).

    Regards,
    Michael