Event ID 215: Database Serious Error - Fix Guide 2025

Event ID: 215
Source: MSExchangeIS
Level: Error

The database has encountered a serious error.

Database: Mailbox Database 01
Error: -1018 (0xfffffc06)
Instance: Exchange
Page: 48526
Description: Database page checksum mismatch. Expected: 0x12AB34CD,
             Actual: 0x00000000. Page has been corrupted.

Additional context: Read operation failed at page 48526

# Search for disk/storage errors in last 24 hours
Get-EventLog -LogName System -After (Get-Date).AddHours(-24) |
    Where-Object { $_.EventID -in @(7, 11, 15, 51, 153) -and $_.EntryType -eq "Error" } |
    Select-Object TimeGenerated, EventID, Source, Message |
    Format-Table -AutoSize

# Event ID meanings:
# 7   = Device error (disk cannot complete I/O request)
# 11  = Controller error (disk controller reported hardware failure)
# 15  = Disk timeout (device did not respond within timeout period)
# 51  = Page file error (can indicate memory or disk issues)
# 153 = Disk failure warning (SMART threshold exceeded)

# If you see ANY of these errors near Event ID 215 time, hardware is involved

# Run Windows Management Instrumentation disk diagnostics
Get-WmiObject -Namespace root\wmi -Class MSStorageDriver_FailurePredictStatus |
    Select-Object InstanceName, PredictFailure, Reason

# PredictFailure = True means IMMINENT DISK FAILURE
# Immediately replace the disk and restore from backup

# For more detailed SMART data, use third-party tools:
# - CrystalDiskInfo (free, shows all SMART attributes)
# - HD Tune (detailed surface scan and health check)
# - Manufacturer tools (Western Digital Data Lifeguard, Seagate SeaTools)

# IMMEDIATELY dismount the database to stop corruption from spreading
Dismount-Database "Mailbox Database 01" -Confirm:$false

# Verify dismount succeeded
Get-MailboxDatabase "Mailbox Database 01" |
    Select-Object Name, Mounted, Server

# Database should now show Mounted: False
# This prevents users from accessing corrupt data and stops new corruption

# Navigate to database directory
cd "D:\ExchangeDBs\DB01"

# Run full integrity check (this takes 10-60 minutes depending on size)-60 minutes depending on size)
ESEUTIL /K DB01.edb

# Possible outcomes:
# "Operation completed successfully" = No corruption detected (check hardware)
# "Corruption detected at page XXXXX" = Database has physical corruption
# "Checksum error on page XXXXX" = -1018 corruption confirmed-1018 corruption confirmed

# Run database header check for quick state assessment
ESEUTIL /MH DB01.edb | Select-String "State|Last Attach|Last Detach"

# 1. Verify hardware errors are resolved
Get-EventLog -LogName System -After (Get-Date).AddHours(-2) |
    Where-Object { $_.EventID -in @(7, 11, 15, 153) -and $_.EntryType -eq "Error" } |
    Measure-Object
# Count should be 0 (no new hardware errors)

# 2. Confirm database integrity
cd "D:\ExchangeDBs\DB01"
ESEUTIL /K DB01.edb
# Should complete with "Operation completed successfully"

# 3. Check database state
ESEUTIL /MH DB01.edb | Select-String "State"
# Should show "State: Clean Shutdown"

# 4. Verify database mounts without errors
Mount-Database "Mailbox Database 01"
Get-MailboxDatabase "Mailbox Database 01" | Select-Object Name, Mounted

# 5. Test mailbox connectivity
Test-MAPIConnectivity -Database "Mailbox Database 01"

# 6. Monitor for new Event ID 215 errors215 errors
Get-EventLog -LogName Application -Source MSExchangeIS -After (Get-Date).AddHours(-1) |
    Where-Object { $_.EventID -eq 215 } |
    Select-Object TimeGenerated, Message

# 7. Run extended online maintenance to check for latent corruption
Get-MailboxDatabase "Mailbox Database 01" |
    Update-StoreMailboxState -Database $_.Name

# Save as Monitor-StorageHealth.ps1
# Schedule with Task Scheduler to run daily

$Results = @()

# Check SMART predictive failure status
$SmartStatus = Get-WmiObject -Namespace root\wmi -Class MSStorageDriver_FailurePredictStatus
foreach ($Disk in $SmartStatus) {
    if ($Disk.PredictFailure -eq $true) {
        $Results += "CRITICAL: Disk $($Disk.InstanceName) predicting failure! Replace immediately!"
    }
}

# Check for recent disk errors in System log
$DiskErrors = Get-EventLog -LogName System -After (Get-Date).AddHours(-24) |
    Where-Object { $_.EventID -in @(7, 11, 15, 153) -and $_.EntryType -eq "Error" }

if ($DiskErrors.Count -gt 0) {
    $Results += "WARNING: $($DiskErrors.Count) disk errors detected in last 24 hours"24 hours"
    $DiskErrors | ForEach-Object {
        $Results += "  Event ID $($_.EventID) at $($_.TimeGenerated): $($_.Message.Substring(0,100))..."$_.TimeGenerated): $($_.Message.Substring(0,100))..."
    }
}

# Check for Event ID 215 (database corruption)
$DBErrors = Get-EventLog -LogName Application -Source MSExchangeIS -After (Get-Date).AddHours(-24) |
    Where-Object { $_.EventID -eq 215 }

if ($DBErrors.Count -gt 0) {
    $Results += "CRITICAL: $($DBErrors.Count) Exchange database corruption errors (Event ID 215) detected!"215) detected!"
}

# Check disk free space
$Databases = Get-MailboxDatabase -Server $env:COMPUTERNAME
foreach ($DB in $Databases) {
    $DBPath = $DB.EdbFilePath.PathName
    $Drive = (Get-Item $DBPath).PSDrive
    $FreePercent = [math]::Round(($Drive.Free / $Drive.Used) * 100, 2)

    if ($FreePercent -lt 15) {
        $Results += "WARNING: Drive $($Drive.Name) hosting $($DB.Name) has only $FreePercent% free space"$DB.Name) has only $FreePercent% free space"
    }
}

# Send email if issues found
if ($Results.Count -gt 0) {
    $Body = $Results -join "\n"
    Send-MailMessage \
        -To "admin@company.com" \
        -From "exchange-monitor@company.com" \
        -Subject "Exchange Storage Health Alert - $($Results.Count) Issues Found" \
        -Body $Body \
        -SmtpServer "smtp.company.com"
} else {
    Write-Host "✓ All storage health checks passed" -ForegroundColor Green
}