How to Troubleshoot Event ID 2009 Errors (165815)

MORE INFORMATION

The Server service generates this error message when one of its internal tables in memory is full and cannot be expanded. These internal tables track active sessions, resource connections, open files, and open searches so this error message can be generated by many possible problems.

To increase the size of an existing table, a new block of memory is allocated to hold the existing table space plus the increased table space. The old table is then copied into this new block of memory and the old table space is freed back to the operating system.

For instance, the existing file handle table has 1000 entries and needs to grow by an additional 10 entries. The operating system first allocates enough memory for a new table of size 1010 entries. The old table of 1000 entries is then copied to this new table. After the table has been copied, the old table of 1000 entries is freed back to the operating system. However during the course of growing the existing table, enough memory has to exist to handle 2010 total entries which can exceed the amount of available memory, generating a 2009 server error. In cases where this problem does not generate a 2009 error, a single table may have attempted to exceed the maximum limit allowed in which case the service specific error code may pinpoint the cause.

To determine which problem is responsible for generating the error, examine the Data section of the Event Detail dialog box for the error code parameter. In the following example, the error code is the final group (000003ea):

   0000: 00040000 00540001 00000000 c00007d9
   0010: 00000000 c000009a 00000000 00000000
   0020: 00000000 00000000 000003ea

The 11th DWORD at 0x28 is the actual Server service-specific error code. In the example above, the error code is 0x000003ea, but the error code varies depending on the Server service error.

Compare the following error code examples to your error codes to determine the cause of the event:

Error: 0x3e9 (SRV_TABLE_FILE)

This indicates that no more file IDs (FIDs) can be allocated to process the various open file server message blocks (SMBs) because of a shortage of available FIDs.

Monitor these performance monitor counters:

Server\Files Open - Currently Open Files
Server\Files Open Total - Total of open files since system startup.
The maximum number of Open files per Session cannot exceed 2048.
Start the Control Panel Server tool, and then click Users.

Examine each user listed in the connected users column; the number of open files is displayed on a per-user basis in the opens column.

-or-

Open a command prompt and type the following command from the server to save a list of open files.

NET FILE > FILE.TXT

This command saves a file with a list of all open files and their associated FIDs.

The example below is sample output from the NET FILES command:

   ID      Path                               User name       # Locks

   ------------------------------------------------------------------
   25      C:\acadflat                        user1                0
   31      C:\acadflat\setup.exe              user1                0
   35      C:\ACADFLAT\ACAD.PER               user1                0
   69      C:\acadflat                        user1                0
   70      C:\ACADFLAT\ACAD.MNX               user1                0

Error: 0x3ea (SRV_TABLE_SEARCH)

This error indicates that memory is allocated for Search, Find, and Transact2_FindFirst SMB calls to store the current search state, but no additional memory could be allocated for storing search buffers. Applications that do not or cannot use the CloseSearch SMB (DOS applications or older applications that do not, make WIN32 calls) do not have a method for closing searches after they complete. In order to handle this situation, the LanmanServer service uses several search time parameters to clear the search handle and reclaim the memory allocated to the search buffers.

To change the search time parameters, perform the following steps:

WARNING: Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

For information about how to edit the registry, view the "Changing Keys And Values" Help topic in Registry Editor (Regedit.exe) or the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe. Note that you should back up the registry before you edit it.

Start Registry Editor (Regedt32.exe) and go to the following subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters
Add or check the following values:
```
      MaxGlobalOpenSearch: REG_DWORD 
      MaxKeepSearch: REG_DWORD 
      MinKeepSearch: REG_DWORD 
```
The MaxGlobalOpenSearch value determines the maximum number of open searches allowed by the LanmanServer service. The default value is 4096 with a maximum value of 65536. To allocate more search handles, increase the value of the MaxGlobalOpenSearch value to 16,000 (decimal).

The MaxKeepSearch value determines the maximum amount of time in seconds that a search will remain open. The default value is 1800 seconds. Decrease the value of MaxKeepSearch to 900 seconds (15 minutes).

The MinKeepSearch value determines the minimum amount of time in seconds that a search will remain open. The default value is 480 seconds. Decrease the value of MinKeepSearch to 240 seconds (4 minutes).
Monitor these performance monitor counters:
Server\File Directory Searches
Memory\Pool Paged Bytes
Server Work Queues\Available Work Items
Check the value of the PagedPoolSize parameter in the following system registry key.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\MemoryManagement
NOTE: The above registry key is one path; it has been wrapped for readability.

The PagedPoolSize parameter should be set to 0x0. This allows Windows NT to dynamically calculate the size for Paged Pool memory.

Error: 0x3eb (SRV_TABLE_SESSION)

This indicates that no more user IDs (UIDs) exist to satisfy this BlockingSessionSetupAndX SMB.

Monitor these performance monitor counters:
Server\Server sessions
Server\Server sessions hung
To help eliminate this problem, check for unneeded user sessions on the server. This may include mapped drives in logon scripts or applications that automatically map drives to particular servers.

Error: 0x3ec (SRV_TABLE_TREE_CONNECT)

This indicates that no more free tree IDs (TIDs) exist to satisfy a TreeConnect SMB.

Monitor these performance monitor counters:
Redirector\Connects Core
Redirector\Connects Lan Manager 2.0
Redirector\Connects Lan Manager 2.1
Redirector\Connects Windows NT
If the problem persists, consider moving frequently accessed data to another server. This should help lower the number of active Tree Connections to a particular server.

NOTE: If you are using Windows NT 4 Terminal Server Edition, the following Microsoft Knowledge Base article may help resolve this problem:

190162 Terminal Server and the 2048 Open File Limitation

Server Communications Limits

For Windows 2000 Client to Windows 2000 Server communications the limit is 16384.

For Legacy Clients to Windows 2000 Server communications the limit is 8192.

For all Clients to Windows NT 4.0 Server communications the limit is 2048.