An Information Store backup shows the following warning upon completion:
Exchange transaction logs are not in sequential order.
Explanation: The existing transaction logs do not match the logs from the previous backup.
This warning may be thrown every time the backup is run or may occur sporadically.
Explanation
This warning indicates the Exchange transaction logs are not in the same state they were when the last Information Store backup ran. The most likely explanation for this is some log truncation event has occurred after the last Information Store backup.
We require the transaction logs to be unchanged between backups in order to guarantee successful restoration of the information store. If transaction logs are not backed up sequentially, the restored mailbox database would be in a "dirty shutdown" state. This state is usually indicative of missing or corrupt data.
Resolution
Fixing this warning comes down to determining why Exchange transaction logs are being truncated outside of the Information Store backups. One shortcut for finding log truncation events is to search for Event ID 224 of source ESE in Window's Event Viewer. This event demarcates every log truncation event and can be used to find when the transaction logs are truncated outside of the Information Store backups.
Once you have identified when the extraneous truncation events occurred, compare the times to likely sources to determine what is causing the log truncation.
Image-Style Backups
While many backup set types create shadow copies on the server they back up, some restrict the scope of the shadow copy to files of a specific type. For example, File and Folder backup sets will only create a shadow copy of the files and folders included in the backup set. Other backup set types, however, create shadow copies of an entire volume's content; image-style backups, which back up the entirety of a volume or machine, are some of those.
Since shadow copies are the initiators of Exchange transaction log truncation, a likely cause for extraneous truncation events would be an image-style backup of the Exchange server. Within Intronis's product suite, either an Image backup, a Hyper-V Standard/Rapid Recovery backup, or a VMware Standard/QuickSpin backup would cause the logs to truncate. Check if the volume(s) where the Exchange database and logs reside is included in an Image backup set or if the Exchange server is part of a Hyper-V or VMware backup set – if they are, that is what will cause the warning to occur.
Third-Party Backups
If there are other programs installed on your Exchange server which utilize shadow copies to back up Exchange, those could also be the cause of extraneous log truncation. Programs which back up Exchange on a mailbox or message level do not usually cause transaction log truncation.
Running Full Backups
If you cannot identify the source of the transaction log truncation or have found the source but are not willing to discontinue use of the backup(s) causing log truncation, you can change the Exchange Information Store backups to run full backups (mailbox database backups) each time the backup set is run. This may be fine for most mailbox databases, however, for databases larger than 200GB, this may not be feasible. Directions for changing the type of backup an Exchange Information Store backup set runs are as follows:
- Log into the management portal and navigate to the computer account you want to change.
- Go to the Backup tab and click the
button next to the Exchange Information Store backup set you want to run full backups. - Go to the Schedule tab and change the method to Full for any schedules present.
- When done, click Update Backup Set.