Message Tracking

[Rising Flight]

Hi experts, for one of my user Printer/Scanner feature of scan to email has an issue.
The user complains that scan to email option is not working.
i have checked receive connector and i can see scanner IP
when i do message tracking i can see the below output

What is the difference between the below two syntaxes DELIVER and RECEIVE.
scan@mydomain.com is coming from scanner. i want to know user1@mydomain.com has received any email from scanner(scan@mydomain.com) from 1 AM to 11:30 AM on Aug 20.

[PS] C:\Windows\system32>Get-MailboxServer | Get-MessageTrackingLog -Sender scan@mydomain.com -Recipient user1@mydomain.com -Start "08/20/2018 01:00" -End "08/20/2018 11:30" | where {$_.EventId -eq "DELIVER"} | fl MessageSubject,Timestamp

MessageSubject : Message from "ANP001234567C00"
Timestamp     : 8/20/2018 11:15:10 AM
==================================================================
[PS] C:\Windows\system32>Get-MailboxServer | Get-MessageTrackingLog -Sender scan@mydomain.com -Recipient user1@mydomain.com -Start "08/20/2018 01:00" -End "08/20/2018 11:30" | where {$_.EventId -eq "RECEIVE"} | fl MessageSubject,Timestamp

MessageSubject : Message from "ANP001234567C00"
Timestamp     : 8/20/2018 11:15:09 AM
==================================================================
In the below syntaxes did the user receive 4 emails from scanner or is it one email.(there is one second difference between first syntax and this syntax)

[PS] C:\Windows\system32>get-messagetrackinglog -sender scan@mydomain.com -recipient user1@mydomain.com -start "08/20/2018 01:00" -end "08/20/2018 11:30" | select messagesubject,timestamp

MessageSubject               Timestamp
--------------               ---------
Message from "ANP001234567C00" 8/20/2018 11:15:09 AM
Message from "ANP001234567C00" 8/20/2018 11:15:09 AM
Message from "ANP001234567C00" 8/20/2018 11:15:09 AM
Message from "ANP001234567C00" 8/20/2018 11:15:09 AM

[#2]

Hello @Rising Flight,

This has the information you are looking for:

https://docs.microsoft.com/en-us/exchange/monitoring/trace-an-email-message/run-a-message-trace-and-...

RECEIVE The message was received by the service.
DELIVER The message was delivered to a mailbox.

So if you see deliver, the message should be in the mailbox for the user.

If you see Receive, O365 servers got the message, but that does not mean it was delivered.

If i am reading your post right, I would say 1 mail has been delivered (as there is one confirmed result there), even though 4 were received, but it was a bit hard to follow with the syntax.

So there is a chance for instance O365 can receive the same message several times (which would show in the logs), but if it has the same messageID and details, it would likely only deliver it once.

Hope that helps to clarify why you are seeing!
Adam