Summary: Exchange log files are critical as they record all events that take place on the server and help restore the server in case of an unexpected crash. If these log files go missing or get deleted, it may cause Exchange database corruption and errors, such as operation terminated with Exchange error 528. In this post, we have discussed the cause of error 528 and solutions to fix this error.
In Exchange, log files play a vital role. Log files keep transaction records of all events that takes place on the Exchange server database and maintain data integrity. However, in the event of sudden Exchange shutdown or server crash due to malware or virus intrusion, these critical log files may go missing. If the log file(s) is deleted or gets damaged, it leads to database corruption.
And when you try to restore such corrupt database using PowerShell commands, following error appears,
“Operation terminated with error 528-current log file missing”
That’s why it’s important to maintain the database server transaction log files. As an Exchange administrator, you should keep an eye on these transaction logs to ensure continuity and proper functioning of Exchange.
Below we have discussed a few methods that can help you troubleshoot and fix this error. Post fix, you can try to mount or restore the database. However, these methods may fail if the database corruption is severe or log files can’t be found/replayed. In such cases, you can download and install an Exchange repair tool, such as Stellar Repair for Exchange to fix the error ‘528 – Current Log File is Missing’ . The software can help you extract mailboxes from such damaged database that fails to mount and restore the mailboxes to new or existing database on your server.
Importance of Log Files in Exchange
Transaction log files are an important component of the Exchange server. They store all the changes made to the Exchange server database and thus, help in restoring the database after the server or database crash.
All the changes that occur on the server are first written to log files and then committed to the database when the system allows. This write-ahead method of logging allows users to send and receive messages without touching the database.
However, until a transaction is committed to the database, the only existence of the data involved in that transaction is stored in the system memory and the transaction logs.
Reasons for Exchange Error 528
The error 528 occurs when the following Exchange database log files are missing from the server directory.
- Edb.log: This log file keeps all the details of events and operations performed in the Exchange database.
- Edb.chk: This is the checkpoint file that keeps the link to the database and Edb.log file. It maintains the relationship between the information stored in the database and logs.
When a log file is lost due to server crash, power outage, virus or malware intrusion, etc., the Exchange database gets dismounted and marked in a “dirty shutdown” state.
And when the admin runs an integrity check on the database or restore (mount) database, the error “Operation terminated with error 528 – current log file missing” is displayed. This indicates database corruption.
To overcome this disaster, quick action is needed.
Methods to Resolve Exchange Error 528
Note: The manual techniques discussed below can be performed by users with moderate technical knowledge. However, some of these manual methods involve the risk of data loss and can take up a significant amount of time to complete.
Method 1: Check Anti-virus for Missing Log Files
If you haven’t added an exception for Exchange in your anti-virus application, it may regard all transaction log files as viruses or infected files. Thus, before you perform any operation, check the Quarantine settings, and change the configuration settings of your anti-virus. The steps are as follows,
- Run anti-virus software and go to settings
- Enable the quarantine module
- Next, stop all services of the Exchange server and move the log files from <drive>:\Program Files\exchsrvr\MDBDATA\E0000000.log to some other location
- Now delete all files that have .log extension
- Finally, you should be left with three files, viz. res1.log, res2.log, & e00.chk
- Restart all Exchange services. This should fix things
If this doesn’t resolve the error 528, proceed to the next solution.
Method 2: Use ESEUTIL Command-line Utility To Repair EDB Files
The inbuilt ESEUTIL utility comes handy in situations precisely like this one. It can detect and fix errors with EDB files and bring the database to a consistent state. To fix the error 528 by using ESEUTIL, follow these steps,
- Make a note of the log files required to bring the database to a “clean shutdown”
- In PowerShell, use the command eseutil /mh
- Now to initiate a soft recovery procedure on the database, use following command
Eseutil /r <logFileSequenceName> /l <logFileLocation> /d <DatabaseLocation> /a /i
If this doesn’t work, try the following:
- Back up all your databases and logs
- Rename the Checkpoint file to something else
- Create a new folder at the same location and copy all the healthy log files into it
- From the result of eseutil /mh command you executed to find starting point of the missing logs, locate the last complete log. Make a copy of it, rename it, and place it in the same location
- Now run the soft recovery command again and delete the renamed last log that you created while soft recovery is running
Once the recovery completes, the database will be in a clean shutdown state. Before mounting the database again, clear all logs in the database location so that you can start with a new set of log files and backup right away.
Note: This is a tricky process and the slightest mistake could make matter worse. So kindly proceed with caution and do not attempt these steps unless you have good experience with ESEUTIL.
Method 3: Use New-MailboxRepairRequest Command to Repair the Database
Another preferred approach for resolving the “Operation terminated with error 528 current log file missing” error is by using the New-MailboxRepairRequest command.
The best aspect of this command is that it can repair the Exchange database without the need to dismount it. Simply execute the command New-MailboxRepairRequest -Database[-StoreMailbox] to fix and restore EDB data files.
If, however, this technique also doesn’t work to fix the 528 – Current Log File is Missing error or you have limited or no experience in the command-line interface, the best way of overcoming the error 528 is by using a reliable Exchange recovery software such as Stellar Repair for Exchange.
Method 4: Use Stellar Repair for Exchange to Fix Exchange Error 528
Regardless of how complex an Exchange error is, when manual techniques are unable to provide an accurate solution, the best strategy to bring Exchange online is to use Stellar Repair for Exchange.
Backed by sophisticated scanning and EDB repair algorithms, this specialized product is recommended as the number one Exchange recovery tool by MVPs.
The software repairs corrupt Exchange Database (EDB) files and restores mailbox contents even if the database is in dismounted state. Further, the restored mailboxes from the database can be directly exported to your Live Exchange server or Office 365.
It also provides users with the option to repair large and multiple EDB files in a few clicks. By using this software, you can repair and recover dismounted & offline EDB files too and fix the ‘528 – Current Log File is Missing’ error.
Conclusion
We hope that one of the above-mentioned solutions helped you get rid of Exchange error 528. While you can add an exception in your anti-virus program for your Exchange log files, a majority of problem-causing factors that trigger error 528 cannot be prevented. Thus, if a situation like error 528 arises in the future, wherein critical log files go missing from the server, remember to backup database files and initiate a soft recovery procedure.
And if that doesn’t work, you know you can rely on Stellar Repair for Exchange to save the day. Also, read what MVPs have to say about the software.
