Percentage of message tracking report operations via ews completed with errors - where to look what is the cause? RRS feed

  • Question

  • Hi Guys,

    Couple of days ago I have received alert from SCOM saying that percentage of EWS MessageTracking that have been failed is above 5%, so I went to perfmon, added counter mentioned in the title, and I see it gives me 10% - so definately above 5% ;)

    And now the quesition is - how to identify what are those failed searches/who/what is doing them. I read that this might be delivery receip that has been failed and so on, but how to actually check that is the problem?

    I have checked MessageTracking logs on that day, and they returned me like hundreds of alerts from STOREDRIVER - couple of messages were full. I have extended the size, issue was gone, I was observing server for like few 2 hours - no improvement - I thought that might be the issue but not.

    Appreciate any help, cheers,


    Friday, August 21, 2015 10:41 PM

All replies

  • Hi,

    This alert refers to MessageTracking on a CAS server, it happens when users use the ECP to track messages and failed, also when the number of “failed” queries exceeds 3 or 5%, you get this warning in SCOM.

    Here's an thread about this alert, please refer to:

    We can use below command as Mike mentioned to monitor Message tracking log:

    $7DaysOfTracking = Get-ExchangeServer | Get-MessageTrackingLog -EventID Fail -Start (get-date).adddays(-7) -ResultSize unlimited
    $7DaysOfTracking | Measure-Object

    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Allen Wang
    TechNet Community Support

    Monday, August 24, 2015 3:21 AM
  • Hi Allen,

    Thanks for your help,

    So that link is exactly what I was checking - I have already found that thread in the MS forum, the thing is it is not really a complete explanation for me at all. Let me give some more explanation.

    Counter shows me 10%. So I run that command you have pasted, and there was 4000 FAILED message tracking requests. So I checked the overall number of message tracking requests and it was around 400000, so those 4000 is just 1% from that - not 10%, but ok I thought that maybe this caused that, so I took a look what do I have there - in tracking logs. There were many undelivered failures from STOREDRIVER because of the mailbox full. SO my thought was "ok, maybe that 1% is not 10% what counter actually is seeing - but that is suspicious." So I have expanded allowed size of the mailboxes that were causing issues in the message tracking log - there was no alert for like two hours about them, I have restarted exchange monitoring service also - still after two hours counter was showing 10% :/ and I was checking the counter directly on the server  - not SCOM, but using typeperf and performance monitor.

    So if those FAILED messages are not the reason of the alert - how to find the reason, but, you know, I would like to see some logs,some visible trace of that rather than assuming what is the cause.

    Or maybe that 1% of failed store driver messages was the reason, but how to explain it was not re-setted after like 2 hours?



    Monday, August 24, 2015 5:56 AM