# The queue drained. Nothing was consuming it.

> One Service Bus default, six hours, and 4,318 orders that never existed.

- **Format:** short video, 10 steps, ~32 seconds
- **Topic:** A Service Bus incident — how EnableDeadLetteringOnMessageExpiration defaulting to false silently deleted real customer orders.
- **Author:** Suthahar Jegatheesan (MSDEVBUILD)
- **Category:** Azure · Azure
- **Tags:** azure, azureservicebus, deadletterqueue, servicebus, postmortem, sre, systemdesign, microsoftazure, azurecloud, cloudarchitecture, dotnet, az305, msdevbuild
- **Canonical URL:** https://blog.msdevbuild.com/shorts/azure-dead-letter-incident/

---
## What you'll learn

- How a message TTL deletes orders with no error and no log line
- Why a queue draining with no consumer is deletion, not recovery
- The three queue properties and one alert that would have caught it

## Understand it one step at a time

### 1. 09:12 — the deploy goes out

Three instances of orders-worker, health checks green, consumer connected. An ordinary Tuesday.

### 2. 09:40 — the consumer stops

A serialisation bug in the new build. The handler throws on start-up and never receives anything.

### 3. 10:41 — the queue starts draining

Depth begins falling. Nothing is consuming. No worker has come back. Read that twice.

### 4. The messages are just gone

No dead-letter entry. No exception. No log line. The graph looks like recovery — it is deletion.

### 5. The setting I skipped

Somebody set a one-hour TTL so stale orders would not pile up. That is the trap, and it is armed by a default.

### 6. With it on, they survive

Same bug, same six hours, same TTL. The expired orders land in the dead-letter queue instead of nowhere.

### 7. We found out from customers

Not from an alert. Support tickets at 16:20, four hours after the graph said everything was fine.

### 8. Three things failed

The bug was one. The one-hour TTL was two. The default nobody read was three — and only three was silent.

### 9. The four-line fix

Three properties on the queue and one alert rule. Ten minutes of work, and none of it is application code.

### 10. Defaults are decisions

Somebody chose that default, and it was not you. Read the properties on anything holding your data.

---

## The takeaway

**A TTL is a delete instruction**

Set one without dead-lettering on expiration and the broker throws your messages away quietly.