Incorrect delivery reports

Question

Hello,
Strange problem: delivery reports displays only a subset of sent/received messages (or display nothing at all), for example when I search my admin's mailbox that contains (18.11.2020) 6 unread items any many-many read ones I see only 2 !!! messages:

I even sent the message from my private mailbox (at 6:00 as illustrated in the screenshot) and had no issues finding it in the tracking log manually.
For some users delivery reports return 0 messages although get-mailbox thatuser displays ~100... of items in his/her mailbox.

What am I missing here ???

Thank you in advance,
Michael

Answer 1

Hi @Mikhail Firsov

Does is it make any difference if you use Get-TransportService | Get-MessageTrackingLog. It looks silly but just wanted to make sure to search all transport logs if you have multiple Exchange servers.

Answer 2

Hi @Mikhail Firsov ,

We can check the meanings for the eventid in Message Tracking Log in the offcial document: Event types in the message tracking log

HADISCARD A shadow message was discarded after the primary copy was delivered to the next hop.

HARECEIVE A shadow message was received by the server in the local database availability group (DAG) or Active Directory site.

And the delivery status of the message you can see in EAC:

• Delivered: Indicates successful delivery.
• Deferred: Indicates that a message is delayed.
• Pending: If message delivery is pending because a message meets the criteria for an organization-wide rule or policy or because it's subject to message approval, the status message explains what action a rule is performing or that the message must be approved by a moderator before delivery.
• Moderator: The status indicates whether the message was approved or rejected by the moderator.
• Groups Expanded: If a message was sent to a group, the individual users are shown in the Summary to date section so you can see the delivery status for each recipient. If you need to remove or add a user to a group during a delivery report investigation, you can modify a group by clicking Edit Groups.
• Failed: Shows the date, time, and reason for a message delivery failure. For example, an organization-wide rule may be blocking message delivery or the message couldn't be delivered.

In addition, please also note that there have some limitation for delivery report in EAC:

Detailed information here: Track messages with delivery reports

---

If an Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
 

Answer 3

Hi joyceshen-MSFT,

"We can check the meanings for the eventid" - you're right, I was also suprised not seeing DELIVER eventid - I can't explain this. Here's one more example: there're 3 messages sent from Bail to Bail (1) and from admin to Bail (2) in Outlook on the Web:

The logs display no single DELIVER eventid although all messages have been delivered:

?

Answer 4

Hi AshokM-8240,

"It looks silly" - no, it was my assertion "The logs display no single DELIVER eventid" that looked silly... forgot about the second server...shame on me :((( Thank you so much for pointing out!

Regarding my initial question: I think the problem stems from my assumption that selecting only the first option - Mailbox to search - (withouth the second one "...sent to" or the third "...from") - would return all messages in the mailbox, but that is not true (at least in 2019).

Regards,
Michael