2

Client Throttling Event ID 2915 – What It Really Means

Here I was truffling through the TechNet forums, and saw this thread.  I thought I’d share a little bit more detail around it, as the error text that is added to the event log entry is a little confusing.

While Exchange 2007 did have some throttling mechanisms, it was Exchange 2010 that really introduced a fully featured throttling framework.  This is implemented by configuring client throttling policies and assigning them to mailboxes.  When a client exceeds it’s defined throttle policy, an event may be written to the application event log.  In the example that is in the forum thread it is for one of the OWA components.  An event ID 2915 was logged stating the following:

 

Process w3wp.exe () (PID=6252). User ‘Sid~contosaabcd~OWA~false’ has gone over budget ’14’ times for component ‘OWA’ within a one minute period. Info: ‘Policy:DefaultThrottlingPolicy_d7d68d93-9249-4fa7-cfoe-901ac837ae2f, Parts:AD:13;’. Threshold value: ’10’.

 

 

What could possible be confusing with the above?  In this case it was the last portion of the message:

 

“  Threshold value: ’10’.  ”

 

Most people assume that the threshold value, as shown in blue above, is an actual value as configured in the throttling policy.  So when the cmdlet  Get-ThrottlingPolicy is executed, and since 10 does not show up in the OWA section output head scratching ensues!

Exchange 2010 Throttling Policy Output Showing OWA Values

 

What is this mythical 10?  Is it in binary – no.   Is it in Hexadecimal – no.  The threshold value actually tells Exchange after how many occurrences should it write the 2915 event to the application log.  In other words, if the number of times a user exceeds the budget is higher than 10 in the last minute then we should create an Event 2915.

 

In this case the user had gone over budget 14 times in the last minute.  Since 14 exceeds the event writing threshold count of 10, then the 2915 event was created.

 

I should do some coverage on throttling policies in general, as there have been some issues with them recently and also historically.  

 

Please do add a comment if there is something that you would like to see posted here.  If you don’t want to add a public comment there is always the “Email Blog Author” button to the right of every page.

 

Cheers,

Rhoderick

Rhoderick Milne [MSFT]

2 Comments

  1. is their any work around to resolve this issue? we have tried by changing value of all concurrency to null and then 50 but it not worked for us. We also rebooted the servers but it not helped us.

    • What exactly are you troubleshooting here please?

      Cheers,
      Rhoderick

Leave a Reply

Your email address will not be published. Required fields are marked *