Email doesn't display on message tracking, received by one user for others not

[OPSSys]

Hi All,
Recently I have been encountering problems with receiving emails from a particular domain.
The problem is on and off. On a particular day, there were 3 emails sent to our domain for 3 users, 2 received by everyone. One received by only single user.

In message tracking centre, there is no sign we have received this particular email.
When I check the SMTP log, I can see we received the email but only the sequence EHLO MAIL RCPT QUIT
The DATA part is missing.
But as I mentioned one user has received this email.

I'm stumped, hope to get some clue to resolve this issue.

Thank You.

 

[ShackDaddy]

So are the tracking logs working at all? If you tell it, for example, to show all emails received today by one of those three users, does it show all the mail? Or does it show none? Or does it show most of it but the item you are looking for doesn't show up?

I believe there may be an auto-filter on the log that only shows mail that has the status "Received" and if you remove that filter you may see more, although that may only be in more recent versions of Exchange.

Lastly, is there any sort of external anti-spam appliance or service in place that would also have tracking logs on it?

Dave Shackelford
ThirdTier.net
TrainSignal.com

 

[OPSSys]

If I query the tracking log, say on a particular day I received 3 emails from this sender and with one email the DATA part missing
I can see only 2 messages listed.
The email where the DATA part missing, still received by one person's mailbox.

So its quite puzzling for me, if DATA part missing how she was able to receive the email?

This particular log entry, reflects in message tracking, also received by all 3 recipients.

2013-05-24 01:21:52 192.168.2.108 senderdomain SMTPSVC1 EXCSERVER 192.168.2.28 0 EHLO - +senderdomain 250 0 0 25 0 SMTP - - - -
2013-05-24 01:21:52 192.168.2.108 senderdomain SMTPSVC1 EXCSERVER 192.168.2.28 0 MAIL - +FROM:+<sender@domain> 250 0 51 50 0 SMTP - - - -
2013-05-24 01:21:52 192.168.2.108 senderdomain SMTPSVC1 EXCSERVER 192.168.2.28 0 RCPT - +TO:+<user1@mydomain> 250 0 0 29 422 SMTP - - - -
2013-05-24 01:21:52 192.168.2.108 senderdomain SMTPSVC1 EXCSERVER 192.168.2.28 0 RCPT - +TO:+<user2@mydomain> 250 0 0 27 0 SMTP - - - -
2013-05-24 01:21:52 192.168.2.108 senderdomain SMTPSVC1 EXCSERVER 192.168.2.28 0 RCPT - +TO:+<user3@mydomain> 250 0 0 34 0 SMTP - - - -
2013-05-24 01:21:55 192.168.2.108 senderdomain SMTPSVC1 EXCSERVER 192.168.2.28 0 DATA - +<71AFC611E5327F428764FA7D7EA36B920414E5C2@fuyucnsrv04.fuyucn.ad> 250 0 148 46835 1718 SMTP - - - -
2013-05-24 01:21:55 192.168.2.108 senderdomain SMTPSVC1 OPS-D01 192.168.2.208 0 QUIT - senderdomain 240 2797 65 4 0 SMTP - - - -

The following one, received by user1, not user2 and user3
2013-05-24 01:28:01 192.168.2.108 senderdomain SMTPSVC1 EXCSERVER 192.168.2.28 0 EHLO - +senderdomain 250 0 0 25 0 SMTP - - - -
2013-05-24 01:28:01 192.168.2.108 senderdomain SMTPSVC1 EXCSERVER 192.168.2.28 0 MAIL - +FROM:+<sender@domain> 250 0 51 50 0 SMTP - - - -
2013-05-24 01:28:02 192.168.2.108 senderdomain SMTPSVC1 EXCSERVER 192.168.2.28 0 RCPT - +TO:+<user1@mydomain> 250 0 0 28 453 SMTP - - - -
2013-05-24 01:28:02 192.168.2.108 senderdomain SMTPSVC1 EXCSERVER 192.168.2.28 0 RCPT - +TO:+<user2@mydomain> 250 0 0 34 0 SMTP - - - -
2013-05-24 01:28:02 192.168.2.108 senderdomain SMTPSVC1 EXCSERVER 192.168.2.28 0 RCPT - +TO:+<user2@mydomain> 250 0 0 27 0 SMTP - - - -
2013-05-24 01:28:06 192.168.2.108 senderdomain SMTPSVC1 EXCSERVER 192.168.2.28 0 QUIT - senderdomain 240 5844 46 4 2328 SMTP - - - -

Any ideas?

I checked the spam filtering tool and not found any related entries.

Thanks in advance.

 

[ShackDaddy]

Those are the protocol logs, not the tracking logs. You can see the tracking logs from within the Exchange System Manager, near the bottom of the left hierarchy. Look there!

Dave Shackelford
ThirdTier.net
TrainSignal.com