locked
subject RRS feed

  • Question

  • Hi experts 

    one of my exchange online user has sent an email to exchange onpremises user with subject testmail.

    exchange on premises user says that he did not receive the email. so when i run the below shell command on exchange on premises i get the below output, i can see the output as testmail, does it mean that exchange onpremise user has received the email.

    Get-MailboxServer | get-messagetrackinglog -sender exchangeonlineuser@mydomain.com -recipients exchangeonpremisesuser@mydomain.com -start "06/28/2018 00:00" -end "06/28/2018 23:59" | fl  messagesubject

    testmail

    Wednesday, July 4, 2018 7:14 PM

Answers

  • Hi Risingflight,

    The meaning of Event Id “DELIVER” is “A message was delivered to a local mailbox ”.

    You can use command below to search this user’s mailbox to find out whether this mail is in his mailbox:

    Search-Mailbox 6a@domain.com -SearchQuery "Subject: Test again" -TargetMailbox 3a@domain.com TargetFolder: search

    The above command will send the search result to the TargetMailbox,  you will see whether this mail exist and where is it.

    By the way, I also want to confirm with you, how many users have this issue? Whether this user set a inbox rule to move this mails to other folder?

    If you still cannot find this mail, you can post the result of this command below at here (remember remove your sensitive information)

    Get-TransportService | Get-MessageTrackingLog -Sender exchangeonlineuser@mydomain.com -Recipient exchangeonpremisesuser@mydomain.com -start "06/28/2018 00:00" -end "06/28/2018 23:59" | fl 

    Regards, 

    Kyle Xu


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.

    Thursday, July 5, 2018 9:16 AM
  • Hi Risingflight,

    The value of Identity is the mailbox you want to search.

    The value of TargetMailbox is the mailbox you want export result to.

    So, did you find this mail in the searchresults folder in target mailbox?

    If you don't find this mail, you can post the result of this command below at here (remember remove your sensitive information)
    Get-TransportService | Get-MessageTrackingLog -Sender exchangeonlineuser@mydomain.com -Recipient exchangeonpremisesuser@mydomain.com -start "06/28/2018 00:00" -end "06/28/2018 23:59" | fl

    Regards,

    Kyle Xu


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.

    • Marked as answer by Risingflight Tuesday, July 10, 2018 5:38 PM
    Friday, July 6, 2018 1:35 AM
  • Hi Risingflight,

    This Event id "deliver" indicates this mail has been deliver to this user, if this receipt doesn't see this mail, this mail may be deleted by accident or other things which we cannot know.

    Event types in the message tracking log: https://docs.microsoft.com/en-us/exchange/mail-flow/transport-logs/message-tracking

    Regards,

    Kyle Xu


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.

    Tuesday, July 10, 2018 2:06 AM

All replies

  • Hi Risingflight,

    Yes, the output result indicate this mail have achieved the On-Premise Exchange server.

    Regards,

    Kyle Xu


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.

    Thursday, July 5, 2018 3:02 AM
  • when i try the below syntax it shows me messagesubject as testemail

    Get-MailboxServer | Get-MessageTrackingLog -Sender exchangeonlineuser@mydomain.com -Recipient exchangeonpremisesuser@mydomain.com
    -start "06/28/2018 00:00" -end "06/28/2018 23:59" | where {$_.EventId -eq "DELIVER"} | fl MessageSubject

    MessageSubject : testmail

    Thursday, July 5, 2018 4:52 AM
  • Hi Risingflight,

    The meaning of Event Id “DELIVER” is “A message was delivered to a local mailbox ”.

    You can use command below to search this user’s mailbox to find out whether this mail is in his mailbox:

    Search-Mailbox 6a@domain.com -SearchQuery "Subject: Test again" -TargetMailbox 3a@domain.com TargetFolder: search

    The above command will send the search result to the TargetMailbox,  you will see whether this mail exist and where is it.

    By the way, I also want to confirm with you, how many users have this issue? Whether this user set a inbox rule to move this mails to other folder?

    If you still cannot find this mail, you can post the result of this command below at here (remember remove your sensitive information)

    Get-TransportService | Get-MessageTrackingLog -Sender exchangeonlineuser@mydomain.com -Recipient exchangeonpremisesuser@mydomain.com -start "06/28/2018 00:00" -end "06/28/2018 23:59" | fl 

    Regards, 

    Kyle Xu


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.

    Thursday, July 5, 2018 9:16 AM
  • I tried the below syntaxes on exchange onpremises but i am getting errors

    [PS] C:\Windows\system32>Search-Mailbox exchangeonpremisesuser@mydomain.com -SearchQuery "Subject:TestEmail" -TargetMailbox exchangeonlineuser@mydomain.com TargetFolder: searchresults
    A positional parameter cannot be found that accepts argument 'TargetFolder:'.
        + CategoryInfo          : InvalidArgument: (:) [Search-Mailbox], ParameterBindingException
        + FullyQualifiedErrorId : PositionalParameterNotFound,Search-Mailbox
        + PSComputerName        : myexchangeserver@mydomain.com

    ---------------------------------------------------------------------------------------------------------

    [PS] C:\Windows\system32>Get-Mailbox  -ResultSize Unlimited | Search-Mailbox -Identity 'exchangeonpremisesuser@mydomain.com' -SearchQuery 'Subject:"TestEmail" And Received:<$('06/28/2018 00:00') And Received:>$('06/28/2018 23:59')' -targetmailbox "mymailboxoncloud@mydomain.com" -targetfolder "searchresults" -logonly -loglevel full


    Thursday, July 5, 2018 6:23 PM
  • Hi Risingflight,

    The value of Identity is the mailbox you want to search.

    The value of TargetMailbox is the mailbox you want export result to.

    So, did you find this mail in the searchresults folder in target mailbox?

    If you don't find this mail, you can post the result of this command below at here (remember remove your sensitive information)
    Get-TransportService | Get-MessageTrackingLog -Sender exchangeonlineuser@mydomain.com -Recipient exchangeonpremisesuser@mydomain.com -start "06/28/2018 00:00" -end "06/28/2018 23:59" | fl

    Regards,

    Kyle Xu


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.

    • Marked as answer by Risingflight Tuesday, July 10, 2018 5:38 PM
    Friday, July 6, 2018 1:35 AM
  • hi below is results of the syntax i have edited some of the information

     [PS] C:\Windows\system32>Get-TransportService | Get-MessageTrackingLog -Sender exchangeonlineuser@mydomain.com -Recipient
     exchangeonpremisesuser@mydomain.com -start "06/28/2018 00:00" -end "06/28/2018 23:59" | fl


    RunspaceId              : 654d2367-c2ef-480b-b6aa-59f760bb0db0
    Timestamp               : 6/28/2018 7:00:57 PM
    ClientIp                :
    ClientHostname          : myexchangeserver02.mydomain.com
    ServerIp                :
    ServerHostname          : myexchangeserver01
    SourceContext           : XXXXXXXXX;2018-06-28T12:55:40.570Z;ClientSubmitTime:2018-06-28T12:55:19.000Z
    ConnectorId             :
    Source                  : STOREDRIVER
    EventId                 : DELIVER
    InternalMessageId       : 18606543789045
    MessageId               : <xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx>
    NetworkMessageId        : xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    Recipients              : {exchagneonpremisesuser@mydomain.com}
    RecipientStatus         : {}
    TotalBytes              : 47654
    RecipientCount          : 1
    RelatedRecipientAddress :
    Reference               :
    MessageSubject          : Test Email
    Sender                  : exchangeonlineuser@mydomain.com
    ReturnPath              : exchangeonlineuser@mydomain.com
    Directionality          : Originating
    TenantId                :
    OriginalClientIp        : X.XX.XX.XXX
    MessageInfo             : XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
    MessageLatency          : 00:00:00
    MessageLatencyType      : EndToEnd
    EventData               : {[IncludeInSla, True], [MailboxDatabaseGuid, xxxxxx],
                              [Mailboxes, xxxxx], [StoreObjectIds, xxxxxxxxx
                              xxxxxxxxxxxxxxxxx==], [FromEntity,
                              Internet], [ToEntity, Hosted], [P2RecipStat, 0.007/2], [MsgRecipCount, 2], [DeliveryLatency,
                              0.000], [AttachCount, 0], [E2ELatency, 1.697], [DeliveryPriority, Normal], [AccountForest,
                              mydomain.com]}
    TransportTrafficType    : Email
    SchemaVersion           : 15.01.1466.003


    Friday, July 6, 2018 7:18 AM

  • in the above output i can see Source and EventID, which i belive the email must have been receied by my onpremises user.

    Source                  : STOREDRIVER
    EventId                 : DELIVER



    Friday, July 6, 2018 4:52 PM
  • please correct me if i am wrong

    Store Driver is responsible for transmitting the message from the sender to the receiver 

    DELIVER - the email has been received to the recipient

    RECEIVE - the email has been received to the exchange server from external user

    SEND - the email has gone out of the exchange server

    DROP - the email has been dropped not going out of the exchange server.

    Friday, July 6, 2018 4:52 PM
  • Hi Risingflight,

    Whether this phenomenon occurs on other mails that this online user send to this on-premise user?

    Whether this phenomenon occurs on other users?

    This Event id indicate this mail has been deliver to this user, if this receipt doesn't see this mail, this mail may be deleted by accident or other things which we cannot know.

    Regards,

    Kyle Xu


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.

    • Marked as answer by Risingflight Monday, July 9, 2018 4:00 AM
    • Unmarked as answer by Risingflight Monday, July 9, 2018 4:01 AM
    Monday, July 9, 2018 2:07 AM
  • its only for one user
    • Marked as answer by Risingflight Monday, July 9, 2018 4:00 AM
    • Unmarked as answer by Risingflight Monday, July 9, 2018 4:00 AM
    Monday, July 9, 2018 4:00 AM
  • please correct me if i am wrong

    Store Driver is responsible for transmitting the message from the sender to the receiver 

    DELIVER - the email has been received to the recipient

    RECEIVE - the email has been received to the exchange server from external user

    SEND - the email has gone out of the exchange server

    DROP - the email has been dropped not going out of the exchange server.

    Monday, July 9, 2018 4:01 AM
  • Hi Risingflight,

    This Event id "deliver" indicates this mail has been deliver to this user, if this receipt doesn't see this mail, this mail may be deleted by accident or other things which we cannot know.

    Event types in the message tracking log: https://docs.microsoft.com/en-us/exchange/mail-flow/transport-logs/message-tracking

    Regards,

    Kyle Xu


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.

    Tuesday, July 10, 2018 2:06 AM
  • Hi Risingflight,

    Any update now?
    If the above suggestion helps, please be free to mark it as answer for helping more people.

    Regards,

    Kyle Xu


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.

    Tuesday, July 10, 2018 10:57 AM