none
Strange behavior of exchange server with no user mailboxes

    Question


  • Hi!

    Two days ago I installed the second exchange server – Exc02. Currently Exc02 has no user mailboxes at all.

    Both of my Exchange servers are 2013CU9 without DAG and Shadow Resilience.


    Today I have noticed that some internal emails go through my new Exchange server. 

    I can’t figure out why Mailbox Transport Service on Exc01 sends email via exc02 so far as recipient‘s mailbox is on the same server (Exc01)?

     

    Here are output from Get-MessageTrackingLog, Delivery report from ECP and a message header.

    Timestamp           Source      EventId   ConnectorId                           ClientHostname      ServerHostname
    ---------           ------      -------   -----------                           --------------      --------------
    28.10.2015 18:52:21 STOREDRIVER RECEIVE                                          Exc01  		Exc01    
    28.10.2015 18:52:22 SMTP        RECEIVE   Exc02\Default Exc02                	 Exc01  		Exc02    
    28.10.2015 18:52:22 AGENT       AGENTINFO                                        Exc02                          
    28.10.2015 18:52:22 STOREDRIVER SUBMIT                                           Exc01                  Exc02 	  
    28.10.2015 18:52:22 STOREDRIVER DELIVER                                          Exc02 			Exc01    
    28.10.2015 18:52:22 SMTP        SEND      Intra-Organization SMTP Send Connector Exc02                  Exc01  	 

    Delivery Report for  User2 ‎(user2@contoso.com)‎
    Submitted
    10/28/2015 18:52 Exc01
    The message was submitted to Exc01.contoso.com.
    Pending
    10/28/2015 18:52 Exc02.contoso.com
    Message was received by Exc02.contoso.com from Exc01.contoso.com.
    
    10/28/2015 18:52 Exc02.contoso.com
    The message has been transferred from Exc02.contoso.com to Exc01.contoso.com.
    Delivered
    10/28/2015 18:52 Exc01.contoso.com
    The message was successfully delivered.

    Received: from Exc02.contoso.com (10.117.1.19) by
     Exc01.contoso.com (10.117.1.18) with Microsoft SMTP Server (TLS) id
     15.0.1104.5 via Mailbox Transport; Wed, 28 Oct 2015 18:52:21 +0300
    
    Received: from Exc01.contoso.com (10.117.1.18) by
     Exc02.contoso.com (10.117.1.19) with Microsoft SMTP Server (TLS) id
     15.0.1104.5; Wed, 28 Oct 2015 18:52:21 +0300
    
    Received: from Exc01.contoso.com ([::1]) by Exc01.contoso.com
     ([::1]) with mapi id 15.00.1104.000; Wed, 28 Oct 2015 18:52:21 +0300
    From: User1 <User1@contoso.com>
    To: User2 <user2@contoso.com>
    Date: Wed, 28 Oct 2015 18:52:21 +0300

    Btw, is it possible to sort output from Get-MessageTrackingLog command in a horological order? TimeStamp is not suite because it has no milliseconds.


    • Edited by IvanSergeev Wednesday, October 28, 2015 9:59 PM
    Wednesday, October 28, 2015 9:58 PM

Answers

  • That is how Exchange is designed to work.

    Exchange will use all servers in the site to process email. The hub transport functionality doesn't belong to a single server. Therefore I would expect to see the behaviour you are seeing.

    In short, think of it like this - as soon as an Exchange server is installed in to a site with production servers, it too is in production.

    Simon.


    Simon Butler, Exchange MVP
    Blog | Exchange Resources | In the UK? Hire Me.

    Wednesday, October 28, 2015 10:44 PM
  • Hi,

    Each destination in Exchange 2013 has a collection of one or more transport servers that is responsible for delivering messages to the destination. This group of servers is called a delivery group. Mailbox databases on Exchange 2013 are serviced by the transport service on all Exchange 2013 mailbox servers in that site, even if there is no DAG present. 

    For more information, see the Delivery Groups section here: https://technet.microsoft.com/en-us/library/aa998825(v=exchg.150).aspx.

    As for your second question, when you run Get-MessageTrackingLog, the output is in chronological order. You don't need to sort by TimeStamp.

    Thanks.


    Please mark as an answer if this answers your question

    Mark Gossa

    MCSE 2003, MCITP Enterprise Administrator 2008 R2, MCSA 2012 R2, MCTS Exchange 2010, MCTS SQL 2012, MCTS SharePoint 2007, VCP4, VCP5, CCNA

    Blog: http://markgossa.blogspot.com   LinkedIn:

    Posts are provided “AS IS” without warranty of any kind, either expressed or implied.

    Wednesday, October 28, 2015 10:52 PM

All replies

  • That is how Exchange is designed to work.

    Exchange will use all servers in the site to process email. The hub transport functionality doesn't belong to a single server. Therefore I would expect to see the behaviour you are seeing.

    In short, think of it like this - as soon as an Exchange server is installed in to a site with production servers, it too is in production.

    Simon.


    Simon Butler, Exchange MVP
    Blog | Exchange Resources | In the UK? Hire Me.

    Wednesday, October 28, 2015 10:44 PM
  • Hi,

    Each destination in Exchange 2013 has a collection of one or more transport servers that is responsible for delivering messages to the destination. This group of servers is called a delivery group. Mailbox databases on Exchange 2013 are serviced by the transport service on all Exchange 2013 mailbox servers in that site, even if there is no DAG present. 

    For more information, see the Delivery Groups section here: https://technet.microsoft.com/en-us/library/aa998825(v=exchg.150).aspx.

    As for your second question, when you run Get-MessageTrackingLog, the output is in chronological order. You don't need to sort by TimeStamp.

    Thanks.


    Please mark as an answer if this answers your question

    Mark Gossa

    MCSE 2003, MCITP Enterprise Administrator 2008 R2, MCSA 2012 R2, MCTS Exchange 2010, MCTS SQL 2012, MCTS SharePoint 2007, VCP4, VCP5, CCNA

    Blog: http://markgossa.blogspot.com   LinkedIn:

    Posts are provided “AS IS” without warranty of any kind, either expressed or implied.

    Wednesday, October 28, 2015 10:52 PM
  • As for your second question, when you run Get-MessageTrackingLog, the output is in chronological order. You don't need to sort by TimeStamp.

    Mark, 

    Why I don't need this to be sorted? I as far as I know it is not sorted any kind by default.

    Thursday, October 29, 2015 10:45 AM
  • Hi,

    Try send a test email and then run the below command:

    Get-MessageTrackingLog -MessageSubject Test1004 | ft -AutoSize

    When I do this, I see the events in order.

    Thanks.


    Please mark as an answer if this answers your question

    Mark Gossa

    MCSE 2003, MCITP Enterprise Administrator 2008 R2, MCSA 2012 R2, MCTS Exchange 2010, MCTS SQL 2012, MCTS SharePoint 2007, VCP4, VCP5, CCNA

    Blog: http://markgossa.blogspot.com   LinkedIn:

    Posts are provided “AS IS” without warranty of any kind, either expressed or implied.

    Thursday, October 29, 2015 10:55 AM
  • Mark,

    Sorry, but I’m not getting these rows in a right order. Here is MessageTrackingLog  without sorting by TimeStamp:

    Get-TransportService | Get-MessageTrackingLog -recipients user2@contoso.com -sender User1@contoso.com -Start "10/28/2015 18:30:00 PM" -End "10/28/2015 11:59:59 PM" | FT TimeStamp,Source,EventId,ConnectorId,Clienthostname,Serverhostname -auto

    Timestamp          	 Source     		 EventId   		ConnectorId                	ClientHostname      ServerHostname
    ---------          	 ------     		 -------   		-----------                           	--------------      --------------
    28.10.2015 18:52:22 STOREDRIVER DELIVER                                       			   Exc02 		Exc01    
    28.10.2015 18:52:21 STOREDRIVER RECEIVE                                         			    Exc01  		Exc01
    28.10.2015 18:52:22 STOREDRIVER SUBMIT                                       			    Exc01                    Exc02
    28.10.2015 18:52:22 SMTP        RECEIVE   	    Exc02\Default Exc02               	    Exc01  		Exc02    
    28.10.2015 18:52:22 AGENT       AGENTINFO                                       			    Exc02                          
    28.10.2015 18:52:22 SMTP        SEND      		   Intra-Organization SMTP Send Connector   Exc02                   Exc01  


    I believe the rows should be in this order:

    Timestamp          	 Source     		 EventId   		ConnectorId                	ClientHostname      ServerHostname
    ---------          	 ------     		 -------   		-----------                           	--------------      --------------
    28.10.2015 18:52:21 STOREDRIVER RECEIVE                                         			    Exc01  		Exc01
    28.10.2015 18:52:22 STOREDRIVER SUBMIT                                       			    Exc01                    Exc02
    28.10.2015 18:52:22 SMTP        RECEIVE   	    Exc02\Default Exc02               	    Exc01  		Exc02    
    28.10.2015 18:52:22 AGENT       AGENTINFO                                       			    Exc02                          
    28.10.2015 18:52:22 SMTP        SEND      		   Intra-Organization SMTP Send Connector   Exc02                   Exc01  
    28.10.2015 18:52:22 STOREDRIVER DELIVER                                       			   Exc02 		Exc01    


    My transcription:

    1. Mailbox Transport Service (MTS) on Exc01 uses RPC to RECEIVE an outgoing message from a database.
    2. MTS on Exc01 SUBMITS the message to HUB selector and transfer the message to exc02 via SMTP
    3. Exc02 uses Transport Service to RECEIVE the message via SMTP
    4. Message Categorizer on Exc02 analyzes (AGENTINFO) the message and decides it is going to Exc01
    5. Transport service on Exc02 SENDs the message via SMTP to MTS on exc01
    6. MTS on exc01 DELIVERs the message to the database.


    • Edited by IvanSergeev Thursday, October 29, 2015 2:29 PM
    Thursday, October 29, 2015 2:24 PM
  • Hi,

    The reason you have different behaviour is because you're collecting message tracking log data from multiple servers. The timestamp variable includes milliseconds. It is Timestamp.Millisecond.

    If you sort by timestamp, the events should be sorted by time to the millisecond. Try below:

    Get-TransportService | Get-MessageTrackingLog -recipients user2@contoso.com -sender User1@contoso.com -Start "10/28/2015 18:30:00 PM" -End "10/28/2015 11:59:59 PM" | sort TimeStamp | FT TimeStamp,Source,EventId,ConnectorId,Clienthostname,Serverhostname -auto

    Thanks.


    Please mark as an answer if this answers your question

    Mark Gossa

    MCSE 2003, MCITP Enterprise Administrator 2008 R2, MCSA 2012 R2, MCTS Exchange 2010, MCTS SQL 2012, MCTS SharePoint 2007, VCP4, VCP5, CCNA

    Blog: http://markgossa.blogspot.com   LinkedIn:

    Posts are provided “AS IS” without warranty of any kind, either expressed or implied.

    Friday, October 30, 2015 12:26 PM
  • The reason you have different behaviour is because you're collecting message tracking log data from multiple servers. The timestamp variable includes milliseconds. It is Timestamp.Millisecond.

    If you sort by timestamp, the events should be sorted by time to the millisecond. Try below:

    Get-TransportService | Get-MessageTrackingLog -recipients user2@contoso.com -sender User1@contoso.com -Start "10/28/2015 18:30:00 PM" -End "10/28/2015 11:59:59 PM" | sort TimeStamp | FT TimeStamp,Source,EventId,ConnectorId,Clienthostname,Serverhostname -auto

    Mark hi,

    In my very first post (see above) I used sort by TimeStamp and as you can observe the rows are not in an order.

    Is there a way I can see TimeStamp.Millisecond in output? I’ve tried to play with get-member to see what I can use, but with no luck.


    • Edited by IvanSergeev Saturday, October 31, 2015 2:13 AM
    Saturday, October 31, 2015 2:09 AM
  • Hi,

    As this thread is already answered, please can you start a new thread.

    Thanks.


    Please mark as an answer if this answers your question

    Mark Gossa

    MCSE 2003, MCITP Enterprise Administrator 2008 R2, MCSA 2012 R2, MCTS Exchange 2010, MCTS SQL 2012, MCTS SharePoint 2007, VCP4, VCP5, CCNA

    Blog: http://markgossa.blogspot.com   LinkedIn:

    Posts are provided “AS IS” without warranty of any kind, either expressed or implied.

    Monday, November 2, 2015 11:46 PM