Below is a description of the Average Delivery Time report, specifically in the area of negative values.
The Average Delivery Time report is a measure of the time it takes a message to go from entry into the system (which is either message creation or entry though an SMTP gateway) to a given server. As a message may be routed through several servers in an Exchange organization (based on the site/server Exchange topology of the given organization), this report helps to highlight links in the architecture that are slow and may need to be reviewed. It should be noted that the time reported might include more than one hop. That is to say that when the report states that the average delivery time between two servers, it cannot be implied that all messages went directly from the source server to the destination server. The only implication that can be inferred is that a message was created on a server and was received another server. The message may be delivered to the given recipient on the second server, or the message may continue to more through the Exchange topology.
The Average Delivery Time is calculated using the following values found in the Exchange 5.5 Tracking Log. The start time is actually the message creation time. This date/time, which is part of the Message ID, is created when the message itself is created. Message creation is defined as the point where a message is composed using a mail client, or the point the message first enters the Exchange organization. The end time is the log time reported at the server in question. There is a field in the tracking log, which provides the date/time of the log entry. The MessageStats system is only concerned with message arrival events in the Tracking log, and use these log entries in the computation of the Average Delivery Time. Finally, the Delivery Time of a given message is simply the time difference between the start time and the end time. The Average Delivery Time is the statistical average of delivery times from one server to another server.
Each individual Exchange server that has Tracking Logs enabled logs information about activities of the local server. It does so using the local clock of the server in question. It is because of this point, and the fact that the messages move between servers, that some unusual values can show up in the Average Delivery Time report. These unusual values are negative average delivery times. The root cause of negative average delivery times is the fact that the clocks between Exchange servers are not synchronized. To further explain this issue, here is an example: A message that is created on Server 1 is first transferred to Server 2 and then to server 3 where it is delivered to the mailbox in question. When the message gets created on Server 1, a Message ID is created using the local clock of Server 1. When the message gets transferred to Server 2, we can compute the delivery time of the given message. The start time is pulled from the Message ID, which was generated by Server 1, while the end time is the log entry, which was generated by Server 2. If the clocks on Server 1 and 2 are not synchronized, the delivery time may be negative. A negative delivery time will occur when the clock of the destination server is behind the source server. When the message gets sent to Server 3, the same problem can exists between Server 1 and Server 3.
So the root cause of negative average delivery times is unsynchronized server clocks. MessageStats does attempt to correct this inconsistency. It does so by try to determine time differences between two servers. If the application is able to do so, then the Average Delivery Time values reported, can be normalized, which is used to try to remove the server time difference values from the reported delivery times. These values are shown in the Correction Amount (Sec.) column in the detail portion of the Average Delivery Time report; however, these values cannot be always calculated. If the given server is not connectible from the machine running the MessageStats gathering process, the Correction amount cannot be determined. There are no real security issues with this time check other than just being able to contact the server in question. If a server cannot be contacted, one of two things is the problem. The first is that the server is not currently online.The second is that the server is in a domain that does not have at least a one way trust from the domain of the machine running the MessageStats gathering process. An easy check to see if the servers time can be determined is by going to a command prompt and executing the following statement:
net time \\servername
If this returns a value, then MessageStats will be able to compute a Correction Amount. If an access denied error is returned, MessageStats will not be able to compute a Correction Amount.
If a correction amount can be determined, there is still a small chance that average delivery times can be negative. This is due to the resolution of clocks (which is seconds), and the rounding of difference calculations to the nearest second. Because of these uncontrollable problems, negative (or zero) average delivery times can exist, even if a correction amount is applied. These negative values are generally in the range of -1 to -4 seconds.
In summary, negative average delivery times are due to unsynchronized server clocks. MessageStats attempts to correct for this issue by computing Correction Amounts. However, if the server is not available, these values may not be able to be determined. To get the best value from the Average Delivery Time Report, Exchange Server clocks need to be synchronized.
