How to fix Error 5348 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: Error 5348 — ERRORFILESECRET Cannot Be Specified with ERRORFILEDATA_SOURCE

Why This Error Happens

This error occurs when a BULK INSERT, OPENROWSET(BULK...), or external bulk load command simultaneously defines both the ERRORFILE_SECRET and ERRORFILE_DATA_SOURCE options in the same syntax block. SQL Server 2025 treats these two parameters as mutually exclusive because they represent two different authentication/access methods for writing error logs—one uses a Database Scoped Credential/Secret tied to cloud storage (like Azure Blob or S3-compatible storage), while the other relies on a predefined EXTERNAL DATA SOURCE object. Since the engine cannot determine which access path takes priority for routing the error output, it immediately throws a syntax validation error (5348) rather than guessing the connection method.

Step-by-Step Resolution Guide

Step 1: Identify the Conflicting Script

  • Locate the specific BULK INSERT or OPENROWSET statement in your T-SQL script or SSIS package that triggered Error 5348.
  • Look specifically for the WITH clause where error file options are being configured.
  • Example of the faulty syntax pattern to search for:
  WITH (
     ERRORFILE = 'errorlog.txt',
     ERRORFILE_DATA_SOURCE = 'MyExternalSource',
     ERRORFILE_SECRET = 'MySecretCredential'
  )

Step 2: Choose a Single Access Method

  • Decide whether you are authenticating via a Database Scoped Credential (Secret) or via a pre-configured External Data Source.
  • If you are using a Secret (common for direct cloud storage access via SAS tokens), remove the ERRORFILE_DATA_SOURCE parameter entirely from the command.
  • If you are using an External Data Source (common for pre-linked storage containers), remove the ERRORFILE_SECRET parameter entirely.

Step 3: Rewrite the Query Syntax

  • Modify the script to include only one of the two parameters alongside the standard ERRORFILE path.
  • Option A (Using Data Source):
  WITH (
     ERRORFILE = 'errorlog.txt',
     ERRORFILE_DATA_SOURCE = 'MyExternalSource'
  )
  • Option B (Using Secret):
  WITH (
     ERRORFILE = 'errorlog.txt',
     ERRORFILE_SECRET = 'MySecretCredential'
  )
  • Save the updated query file on your local drive (e.g., C:\Scripts\BulkLoad.sql).

Step 4: Validate Credential Permissions

  • If you chose the ERRORFILE_SECRET route, verify the associated credential exists in the database by running:
  SELECT * FROM sys.database_credentials;
  • Ensure the service account running the SQL Server 2025 instance on Windows Server 2025 has the necessary network permissions to write to the target error log path.

Step 5: Re-execute the Bulk Operation

  • Run the corrected script via SQL Server Management Studio (SSMS) or Azure Data Studio.
  • Monitor the “Messages” tab to confirm the command completes without throwing Error 5348.

Alternative or Verification Steps

  • Verification: Check the target storage container or local Windows directory path specified in ERRORFILE to confirm a new log file (or .error.txt) is generated only if row rejections occur during the bulk load.
  • Alternative Fix: If removing one parameter breaks connectivity to your specific storage blob, create a new External Data Source that already has the Secret/Credential embedded within its definition, allowing you to reference only ERRORFILE_DATA_SOURCE without needing a separate inline secret.