Link to home
Start Free TrialLog in
Avatar of itgolfer

asked on

Exchange Emails Delayed

The last two days, around 5:30am, a lot of delayed emails are being sent to our users. Some of them are a day or two old but some are up to a week old. When I look in the spam filter, I see them going through at the correct time so I think it's something with Exchange. Is there a log or something I can look at for a specific email that was delayed to see why? I restarted the Transport service yesterday but we still received a bunch of delayed emails this morning. We are on Exchange 2010.
Avatar of DLeaver
Flag of United Kingdom of Great Britain and Northern Ireland image

Is your Exchange server under resource constraints, as in low disk space, high memory or CPU usage?

A nightly process such as a backup may be causing back pressure on your Exchange server.

Check the event logs as a starting point.
Look for Back Pressure event ID's 15004, 15005, 15006, 15007

Look for event ID 1021 for any incoming connection rejected by Exchange.

Use Message Tracking logs and check for MessageLatency and MessageLatencyType for find delay
Avatar of itgolfer


The resources are fine. We have run into that in the past but it doesn't appear the issue this time.

I filtered the log for all of those IDs but there was only a couple of entries from the 1021 but nothing recent.

where do I find the message tracking logs? Is that in the Exchange Management Console?
Yes its in the Toolbox in the EMC

Alternatively you can use the powershell -
Get-TransportServer | Get-MessageTrackingLog -Sender <SenderEmail> -Recipients <RecipientEmail> -MessageSubject "MessageSubject" -Start "mm/dd/yyyy" -End "mm/dd/yyyy" | FT

Look for MessageLatency and MessageLatencyType attributes
OK, so I've found one of the emails that was sent to me on 2/8 and delivered this morning. What should I be looking for?

I thought maybe the problem went away as we didn't have it happen again. However, it happened again this morning. What should I be looking for when I find the email(s) in the message tracking logs?
Look at the message header of an email that's was delayed - this will show you at what point there was a delay
OK, here is the first part of one the delayed emails. I'm still not sure where the issue is after looking at this. The email should have been delivered at 6:14PM CST (4:14 PST) but was delivered to me at 2:58am CST.

Received: from SPAMFILTER ( by EXCHANGE (EXCHANGE IP) with Microsoft SMTP Server id; Thu, 25 Feb 2016 02:58:10 -0600
Received: from SPAMFILTER (unknown [IP])      by SPAMFILTER with ESMTP id 13FEA200A3      for <MY EMAIL ADDRESS>; Thu, 25 Feb 2016 00:14:25 +0000 (UTC)
X-Virus-Scanned: SPAMFILTER engine
Received: from (
 [])      (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256
 (128/128 bits))      (No client certificate requested)      by SPAMFILTER with ESMTPS id BC11A200DD      for <MY EMAIL ADDRESS>; Thu, 25 Feb 2016 00:14:24 +0000 (UTC)
Received: by with SMTP id y8so2873237igp.0        for <MY EMAIL ADDRESS>; Wed, 24 Feb 2016 16:14:24 -0800 (PST)
Avatar of DLeaver
Flag of United Kingdom of Great Britain and Northern Ireland image

Link to home
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial