Reproducable, some email entering the exchange system disappears ; observed a different locations.
I have 3 customers that are experiencing the same problem with Exchange Server. Their setups are different in some respects, as I will document here. Most email that comes into the exchange system arrives in the persons' mailbox/inbox without any problems. For each location:- Antivirus does NOT tie directly into the exchange databases (gateway scanners)- There are no other direct-tie in 3rd party applications (with the possible exception of Blackberry Enterprise Server at one location, but this is supposed to interface via MAPI calls)- None of these locations is running IMF- No mailbox routing rules are in effect- The missing messages do not appear in the badmail folder- In every instance, the messages were formatted by different devices but always by a program (never via outlook, or some other mail program). In most (probably all, don't recall the details fully for Location #3) cases the messages had an attachment associated with them.- SMTP logging is enabled, message tracking is enabled. SMTP logs show all messages arriving ; message tracking only shows the messages that actually show up in the mailbox. - The first notice of this problem was in September 2007 (last month)Location #1: (reproducable):Windows 2003 + Exchange Server 2003 Enterprise with Service Pack 2, using RPC-over-HTTP services with certificate from ThawteSMTP Logging is enabled, and message tracking is turned on.If I scan 7 individual scans from the copier to administrator@customersdomain.com then 5 will arrive, and 2 will come up missing. The SMTP Logs show all 7 messages coming in ; the message tracking shows 5 messages going to the mailboxes. Messages are being delivered inside, and never route through outside ; messages come directly from the copier to the exchange SMTP services. If I repeat the exact same steps going to a non-exchange email server all messages show up, every time.Location #2: Windows 2003 + Exchange Server 2003 Standard with Service Pack 2, and Blackberry Enterprise Server Note: At this location, like the others the messages show up in the SMTP logs but not in the message tracking logs. However, strangely the person here originally complained that he would see messages on his blackberry that never appear in the mailbox. This problem persists but is not as easily reproduced because circumstances rely on an outside party. Location #3: Windows 2000 Server (this is different from the other cases) + Exchange 2003 server standard with service pack 2 ; using OMA with a security certificate from ThawteVery infrequent, but did notice the same behavior as the other two sites. Here the person had 2 messages from a computer generated system that were caught by the spam filtering company. Both messages were released, and show in the SMTP logs. Only one showed in the mailbox.Additionally, doing some searching today yielded some information from another forum where somebody has registered the same problem. Please see http://channel9.msdn.com/ShowPost.aspx?PostID=343249 for details on that person's problem.I am concerned that these problems seemed to suddenly show up in September (last month), and that I'm seeing them at different customer locations. At face value, this acts like a bug in Exchange (I'm sure the MVP's for Exchange have never heard that one before). I dearly hope I'm wrong on that, because field-level fixes are easier than developer-level fixes. If anybody has insight into this problem OR have experienced similar issues, then please add to this thread. Thanks!
October 24th, 2007 10:47pm

I have the same problem, but can't reproduce on demand. SMTP server log shows message received, but the message does not show up in Exchange or the user's mailbox. I have found several instances of this, but only know to look when someone sends an email saying "why haven't you responded". I look in the SMTP log, see their email, but no trace of the email can be found in Exchange mailboxes. Server is Exchange 2000 SP3 running on Windows 2000 SP3, no virus scan on this server. Anyone experience this or have a clue? Thanks for any insight.
Free Windows Admin Tool Kit Click here and download it now
November 7th, 2007 10:01pm

Since I was having trouble finding more information beyond this, I asked my go-to-guy to come and take a peek. After spending some time verifying that I didn't miss anything, we found that:(1) This problem seems to occur because Exchange server is generating a non-unique message ID for some messages ; we could verify this by stopping the queues and copying the message ID for the messages. Today during testing 50% of the messages would disappear. When we held the queues and checked the message IDs there were sample-scans from the copier, and there would be 1 message + 1 message with a duplicate message ID. This is also supported by the SMTP logs which document the message ID's and show the duplicates. Once this was found I pulled the smtp-transfer logs and extracted the message ID's and got a count of the duplicates and found that this is happening to messages that originate from outside as well, not just the copier (as I had seen at my other clients)(2) further logging in Exchange server shows that (apparently due to the duplicate message IDs) the messages disappear because Exchange would flag the duplicate messages and only deliver one copy to the mailbox. This is supported by event logs that have Event ID: 9537, Category: "Transport Delivering" , Source: "MSExchangeIS Mailbox Store". Followed by "A duplicate message arrived on database "First Storage Group\Mailbox Store (<Server name is listed here>)". Ignoring delivery of message"<snip of the remainder of the message>We are waiting on a hotfix from microsoft on KB839268, but the hotfix listed there is a workaround NOT a fix.So, we've discovered the apparent trigger, and mechanism that causes the messages to disappear. However the generation of non-unique message ID's would absolutely seem to be a bug in exchange server. I would ask that any Microsoft support personnel that see this please respond. I can reproduce this behavior on demand, and have logs that support the findings.
November 8th, 2007 1:46am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics