250 Hello

Random Musings on Exchange and Virtualization

Client Throttling Event ID 2915 – What It Really Means

Client Throttling Event ID 2915 – What It Really Means

  • Comments 7
  • Likes

Here I was truffling through the TechNet forums, and saw this thread.  I thought I’d share a little bit more detail around it, as the error text that is added to the event log entry is a little confusing.

While Exchange 2007 did have some throttling mechanisms, it was Exchange 2010 that really introduced a fully featured throttling framework.  This is implemented by configuring client throttling policies and assigning them to mailboxes.  When a client exceeds it’s defined throttle policy, an event may be written to the application event log.  In the example that is in the forum thread it is for one of the OWA components.  An event ID 2915 was logged stating the following:

 

Process w3wp.exe () (PID=6252). User 'Sid~contosa\abcd~OWA~false' has gone over budget '14' times for component 'OWA' within a one minute period. Info: 'Policy:DefaultThrottlingPolicy_d7d68d93-9249-4fa7-cfoe-901ac837ae2f, Parts:AD:13;'. Threshold value: '10'.

 

 

What could possible be confusing with the above?  In this case it was the last portion of the message:

 

“  Threshold value: '10'.  ”

 

Most people assume that the threshold value, as shown in blue above, is an actual value as configured in the throttling policy.  So when the cmdlet  Get-ThrottlingPolicy is executed, and since 10 does not show up in the OWA section output head scratching ensues!

Exchange 2010 Throttling Policy Output Showing OWA Values

 

What is this mythical 10?  Is it in binary - no.   Is it in Hexadecimal – no.  The threshold value actually tells Exchange after how many occurrences should it write the 2915 event to the application log.  In other words, if the number of times a user exceeds the budget is higher than 10 in the last minute then we should create an Event 2915.

 

In this case the user had gone over budget 14 times in the last minute.  Since 14 exceeds the event writing threshold count of 10, then the 2915 event was created.

 

I should do some coverage on throttling policies in general, as there have been some issues with them recently and also historically.  

 

Please do add a comment if there is something that you would like to see posted here.  If you don’t want to add a public comment there is always the “Email Blog Author” button to the right of every page.

 

Cheers,

Rhoderick

 

Can You Help Us?  -- Yes !

If you would like to have Microsoft Premier Field Engineering (PFE) visit your company and assist with the topic(s) presented in this blog post, then please contact your Microsoft Premier Technical Account Manager (TAM) for more information on scheduling and our varied offerings!

If you are not currently benefiting from Microsoft Premier support and you’d like more information about Premier, please email the appropriate contact below, and tell them you how you got introduced!

US

Canada

For all other areas please use the US contact point.





Comments
  • Thank you Rhoderick, this is valuable for the beginner.

  • Thanks Jessie!

    Do let us know if there are any other topics that you think could do with coverage here please!

    Cheers,

    Rhoderick

  • seriously awesome explanation Rhoderick Milne

    Thanks.

  • I presume there is no way to know what threshold has been exceeded, ie there is no way to tell if the user exceeded OWAMaxConcurrency or OWAPercentTimeInAD?

  • Awesome, and like customers and I like it : straight to the point and you made a complicated issue simple to understand thanks to your post. Thanks !

  • Dafo,

    There should be sufficient detail in the message - the above example was in AD.

    Can you paste an example here?

    Cheers,
    Rhoderick

  • Thanks Sam - much appreciated.

    Cheers,
    Rhoderick

Your comment has been posted.   Close
Thank you, your comment requires moderation so it may take a while to appear.   Close
Leave a Comment
Post Comment Fixer