I just wanted to investigate how could fail to be delivered when one DAG server crashed.

I have 3 Dag servers and one of them got a "BLUE SCREEN", crashed but not totally down.

1-some users started getting Outlook "disconnected" on the clients, I wonder why this has to happen with the clients when the databases were already mounted on the 2 remaing Dag servers. Till I had to reboot the crashed dag server that they users started getting connections. Could it be that because the server was not down completely ?

2-At the same time an email was sent to a distribution list of over 2000 users when the dag server crashed, some users got the email and others did not. So what could have been the logic here ? why the email flow stopped and even when the dag server was bounced no mail flow continued to the DL.

Hi Petro,

Firstly client connectivity would be with the CAS, hence you need to confirm is your CAS is same or separate box.

This might explain connectivity issues on outlook.

Second is your CAS loadbalanced, if yes how, what are the versions of Outlook clients facing issues were using.

Are all the users in DAG mailbox databases, if yes, emails might be in process or queue. check Message Tracking logs to identify what happened to rest of the emails. You might want to find out which server did the Expansion of the DL or if you have any fixed expansion server for that DL.

Thanks for the reply. The Cas servers are separate from the MBX. Yes using load balancer and the clients are 2013. But checking on transactions logs, I found something else, I don't know if it was related to the DAG crash or just a coinsident. Because some of the same email were delivered and those that failed had the error below.

554-5.6.0 Corrupt message content 554 5.6.0 STOREDRV.Deliver.Exception:ConversionFailedException; Failed to process message due to a permanent exception with message Content conversion: Corrupt summary TNEF content. ConversionFailedException: Content conversion: Corrupt summary TNEF content. [Stage: CreateReplay],554-5.6.0 Corrupt message content 554 5.6.0 STOREDRV.Deliver.Exception:ConversionFailedException; Failed to process message due to a permanent exception with message Content conversion: Corrupt summary TNEF content. ConversionFailedException: Content conversion: Corrupt summary TNEF content. [Stage: CreateReplay],554-5.6.0 Corrupt message content 554 5.6.0 STOREDRV.Deliver.Exception:ConversionFailedException; Failed to process message due to a permanent exception with message Content conversion: Corrupt summary TNEF content. ConversionFailedException: Content conversion: Corrupt summary TNEF content. [Stage: CreateReplay],554-5.6.0 Corrupt message content 554 5.6.0 STOREDRV.Deliver.Exception:ConversionFailedException; Failed to process message due to a permanent exception with message Content conversion: Corrupt summary TNEF content. ConversionFailedException: Content conversion: Corrupt summary TNEF content. [Stage: CreateReplay],554-5.6.0 Corrupt message content 554 5.6.0 STOREDRV.Deliver.Exception:ConversionFailedException; Failed to process message due to a permanent exception with message Content conversion: Corrupt summary TNEF content. ConversionFailedException: Content conversion: Corrupt summary TNEF content. [Stage: CreateReplay],554-5.6.0 Corrupt message content 554 5.6.0 STOREDRV.Deliver.Exception:ConversionFailedException; Failed to process message due to a permanent exception with message Content conversion: Corrupt summary TNEF content. ConversionFailedException: Content conversion: Corrupt summary TNEF content. [Stage: CreateReplay]

Hi Petro,

Hope on the mailbox server crashed, hence CAS conenctivity would be fine. Also as you have Office2013 in-place you have the http client side loadbalancing as well.

The tracking logs you shared should be explaining what happened to the messages, anyways there are message transport redundancy inplace which should have recovered unless it got corrupted before it could be copied.

Email was sent exactly at the time of bluescreen.

Did you find out why the bluescreen happened, it might help you relate things. Check the .dmp and eventvwrs for more details.

Only way is to check via the logs.

There are more logs for exchange under the install directory as well.