Client Throttling Event ID 2915 – What It Really Means

Here I was truffling through the TechNet forums, and saw this thread.  I thought I’d share a little bit more detail around it, as the error text that is added to the event log entry is a little confusing.

While Exchange 2007 did have some throttling mechanisms, it was Exchange 2010 that really introduced a fully featured throttling framework.  This is implemented by configuring client throttling policies and assigning them to mailboxes.  When a client exceeds it’s defined throttle policy, an event may be written to the application event log.  In the example that is in the forum thread it is for one of the OWA components.  An event ID 2915 was logged stating the following:

Process w3wp.exe () (PID=6252). User 'Sid~contosaabcd~OWA~false' has gone over budget '14' times for component 'OWA' within a one minute period. Info: 'Policy:DefaultThrottlingPolicy_d7d68d93-9249-4fa7-cfoe-901ac837ae2f, Parts:AD:13;'. Threshold value: '10'.

What could possible be confusing with the above?  In this case it was the last portion of the message:

“  Threshold value: '10'.  ”

Most people assume that the threshold value, as shown in blue above, is an actual value as configured in the throttling policy.  So when the cmdlet  Get-ThrottlingPolicy is executed, and since 10 does not show up in the OWA section output head scratching ensues!

What is this mythical 10?  Is it in binary - no.   Is it in Hexadecimal – no.  The threshold value actually tells Exchange after how many occurrences should it write the 2915 event to the application log.  In other words, if the number of times a user exceeds the budget is higher than 10 in the last minute then we should create an Event 2915.

In this case the user had gone over budget 14 times in the last minute.  Since 14 exceeds the event writing threshold count of 10, then the 2915 event was created.

I should do some coverage on throttling policies in general, as there have been some issues with them recently and also historically.  

Please do add a comment if there is something that you would like to see posted here.  If you don’t want to add a public comment there is always the “Email Blog Author” button to the right of every page.

Cheers,

Rhoderick