Hi, A user within our exchange organisation has been reporting missing emails from our bug managment system. As far as I can see other users are not affected. I've looked into this already and have got this far using MS Message tracking: Message arrived at 16:35 Event ID RECIEVE. Event ID RESOLVE and DELIVER occur immediatly. After another second the message then gets event ID DUPLICATEDELIVER. As stated before the user does not recieve a copy of the mail and there are no other examples of the emai hitting the system. Its a little frustrating as I'd now like to run MS message track on all mail with DUPLICATEDELIVER event id but its not available in the drop down. I've got three questions Can I force the DUPLICATEDELIVER mails to be delivered tothe user now Is there a powershell method of listing all DUPLICATEDELIEVER messages How can I prevent this from happening in future Thanks for your help Soops

This will give you fair amount of idea on Duplicate emails..http://msexchangeteam.com/archive/2004/07/14/183132.aspxhttp://www.experts-exchange.com/Software/Server_Software/Email_Servers/Exchange/Q_23759723.htmlAs far as i think, duplicate mails cannot be tracked as it contains the same MAil ID as the original email and the message tracking always work on the mail ID. So when ever you try to track it down, probabaly it will take you to the original mail and not the duplicate one.Hope this helps.Raj

Hi Raj, Thanks for input. Those articles have helped my understanding of the process somewhat, however they dont explain why the messages werent seen by the user. I've checked the messageid field and the missing messages are all different from one another so I cant see why they were not delivered. The user has now reported that new messages from the Bug software are being delivered so this looks to have been a blip but I want to know why it happened Thanks Soops

Hi,From the message tracking log, the message indeed is sent to the user. However, the user didn't see the email on the client side immediately.Generally speaking, the third party Add-in in Outlook or firewall can cause such issue. Please understand that Outlook downloads the new email by means of UDP which is sent from the Exchange server to the client. When clients loging on the Exchange server, the client tells the server the IP address and port where it used to receive new email. When the server receives a mail message for a mailbox that a client is logged on to, it opens a UDP and sends a packet to the client.Now I would like to confirm what the type of the client did the user use. If it's Outlook, please try to test this issue in OWA.Additionally, whether any error message appear in the event log?ThanksAllen

Hi Allen, Thanks for the feedback, I've now realised this was part of a bigger issue to do with a bad cluster failover which I have detailed here: http://social.technet.microsoft.com/Forums/en-US/exchangesvrgeneral/thread/d1bcc7d6-b21c-4794-a5d2-2e395830f186 My theory now is that the messages were delivered to the store but when the lossy failover happened the logs on the passive node had not made it over and at that point the messages disappeared. The logging of course confirms delivery etc because once it passes them to the store its considers it to be "job done" Thanks Soops

Hi,Indeed the lossy failover can cause this issue since there is a feature of the Exchange Hub Transport server which named Tranport Dumpster which is responsible for retaining mails locally delivered to receipients on a Custer MailboxServer.When a lossy CCR failover occurs, a request will be made to the Hub Transport server to redeliver the lost mail. Please note that the Transport Dumpster is holding the mail that has already been delivered.For more information, you can refer to the below article:http://msexchangeteam.com/archive/2007/01/17/432237.aspxThanksAllen

Is there a powershell method of listing all DUPLICATEDELIEVER messages To get all of the DUPLICATEDELIVER EventId entries, use the PowerShell below:Get-MessageTrackingLog -EventId DUPLICATEDELIVER