The curious drop in mail items reported by Get-MailboxStatistics


Office 365 provides users with 50 GB mailbox quotas, so you’d expect that these mailboxes accumulate tens of thousands of items over time, especially as the default retention policy applied by Exchange Online does not clean out Deleted Items folders from user mailboxes (unless you change the policy).

Users are happy because they can keep as much data as they like while organizations are happy because data is retained for compliance purposes. So when reports suddenly show a major drop in the amount of data stored in Office 365 mailboxes, it’s a matter of some concern.

Which is exactly what happened in my Office 365 tenant in mid-May when the number of items reported for a number of mailboxes – but not all – suddenly had an alarming decline. Take the example of my own mailbox (below) where the item count reduced from nearly 272,000 to under 70,000.

11-05-16 Tony.Redmond 271950
12-05-16 Tony.Redmond 69337
13-05-16 Tony.Redmond 70164
14-05-16 Tony.Redmond 70677

The same decline was seen for a number of other mailboxes in the tenant:

13-05-16 dpredmond@ 17793
14-05-16 dpredmond@ 2680
15-05-16 dpredmond@ 2639

Looking at this from a tenant perspective (using the reporting facilities from Cogmotive.com), the drop-off is very obvious. In fact, it’s like the item count fell off a cliff face.

The number of mailbox items in an Office 365 tenant

The number of mailbox items in an Office 365 tenant

Behind the scenes, reporting products like Cogmotive depend on public interfaces provided by Microsoft to extract data that they use to generate reports like “Mailbox Item Count over Time”. Cogmotive connects to Office 365 regularly to fetch data on behalf of the tenants that have signed up for their service and stores this data for future reference, which is how they can provide charts of information over time.

In this case, Cogmotive uses the Get-MailboxStatistics cmdlet to fetch data about mailbox usage and this is where the problem seems to lie. If I run Get-MailboxStatistics against my mailbox, it reports:

DisplayName               ItemCount    LastLogonTime

Tony Redmond              71267        17-May-16 6:47:57 AM

However, if I run the Get-MailboxFolderStatistics cmdlet to report the items stored in each folder and export the data to Excel, I get a different figure:

Get-MailboxFolderStatistics –Identity TRedmond | Select Identity, ItemsInFolder | Export-CSV c:\temp\Items.csv –NoTypeInformation

The true count of items in a mailbox

The true count of items in a mailbox

There’s quite a difference in the figures reported by the two cmdlets: 71,267 and 222,276!

[Note to self: Maybe I should stop auditing owner events in my mailbox. Maybe Get-MailboxStatistics doesn’t like counting those audit items]

In any case, it seems like a change in behavior with the Get-MailboxStatistics cmdlet happened sometime in the middle of May. It’s strange that this should happen with Get-MailboxStatistics as the cmdlet was one of the original set introduced with Exchange 2007 and hasn’t change in scope or functionality much since. I know that the issue is not evident in just my Office 365 tenant as several Cogmotive customers have reported the same problem.

The issue has been reported to Microsoft. No doubt we’ll find out what happened in due course. In the interim, if you have some reports that depend on Get-MailboxStatistics, perhaps you need to check the output to ensure that it’s accurate.

Follow Tony @12Knocksinna

Advertisements

About Tony Redmond ("Thoughts of an Idle Mind")

Exchange MVP, author, and rugby referee
This entry was posted in Exchange Online, Office 365, Uncategorized and tagged , , , , , . Bookmark the permalink.

3 Responses to The curious drop in mail items reported by Get-MailboxStatistics

  1. Brad Hughes says:

    Tony, this is due to a change rolling out to classify certain system mailbox content as “System” messages. Now they don’t show in the normal message count, but in a new count for “System” messages. If you add the MessageCount with the system message count (also available on MailboxStatistics), you’ll get close to the original number.

      • For those wondering what Brad’s reply means, I read it to be that Get-MailboxStatistics no longer includes the system messages in hidden folders like Audit Items, Calendar Logging and the like. The upshot is that the number of items reported should more accurately represent the items that a user can access in a mailbox rather than stuff they can’t.

        Here’s how to check. Note that a lot of items in my mailbox are system messages whereas the count of “real mail” is much reduced. All of which goes to prove that you have to keep an eye on what’s happening inside Office 365…

        [PS] C:\> Get-MailboxStatistics -Identity TRedmond | Format-Table ItemCount, System*

        ItemCount : 74538
        SystemMessageSize : 121.7 MB (127,635,444 bytes)
        SystemMessageCount : 201369
        SystemMessageSizeWarningQuota : 4.5 GB (4,831,838,208 bytes)
        SystemMessageSizeShutoffQuota : 5 GB (5,368,709,120 bytes)

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s