KnowledgeBase Archive

An Archive of Early Microsoft KnowledgeBase Articles

View on GitHub
Q165815: How to Troubleshoot Event ID 2009 Errors

Article: Q165815
Product(s): Microsoft Windows NT
Version(s): 2000,3.51,4.0
Operating System(s): 
Keyword(s): kbnetwork
Last Modified: 08-APR-2002

-------------------------------------------------------------------------------
The information in this article applies to:

- Microsoft Windows NT Workstation versions 3.51, 4.0 
- Microsoft Windows NT Server versions 3.51, 4.0 
- Microsoft Windows 2000 Server 
-------------------------------------------------------------------------------

IMPORTANT: This article contains information about editing the registry.
Before you edit the registry, make sure you understand how to restore it
if a problem occurs. For information about how to do this, view the
"Restoring Registry" Help topic in Regedit.exe or the "Restoring a
Registry Key" Help topic in Regedt32.exe.

SUMMARY
=======

There are several ways to resolve the problems indicated by finding the
following error logged in the System event log:

  Event Id: 2009
  Source: Srv
  Description: The server could not expand a table because the table
  reached the maximum size.

MORE INFORMATION
================

The Server service generates this error message when one of its internal tables
in memory is full and cannot be expanded. These internal tables track active
sessions, resource connections, open files, and open searches so this error
message can be generated by many possible problems.

To increase the size of an existing table, a new block of memory is allocated to
hold the existing table space plus the increased table space. The old table is
then copied into this new block of memory and the old table space is freed back
to the operating system.

For instance, the existing file handle table has 1000 entries and needs to grow
by an additional 10 entries. The operating system first allocates enough memory
for a new table of size 1010 entries. The old table of 1000 entries is then
copied to this new table. After the table has been copied, the old table of 1000
entries is freed back to the operating system. However during the course of
growing the existing table, enough memory has to exist to handle 2010 total
entries which can exceed the amount of available memory, generating a 2009
server error. In cases where this problem does not generate a 2009 error, a
single table may have attempted to exceed the maximum limit allowed in which
case the service specific error code may pinpoint the cause.

To determine which problem is responsible for generating the error, examine the
Data section of the Event Detail dialog box for the error code parameter. In the
following example, the error code is the final group (000003ea):

  0000: 00040000 00540001 00000000 c00007d9
  0010: 00000000 c000009a 00000000 00000000
  0020: 00000000 00000000 000003ea

The 11th DWORD at 0x28 is the actual Server service-specific error code. In the
example above, the error code is 0x000003ea, but the error code varies depending
on the Server service error.

Compare the following error code examples to your error codes to determine the
cause of the event:

Error: 0x3e9 (SRV_TABLE_FILE)
-----------------------------

This indicates that no more file IDs (FIDs) can be allocated to process the
various open file server message blocks (SMBs) because of a shortage of
available FIDs.

1. Monitor these performance monitor counters:

  Server\Files Open - Currently Open Files
  Server\Files Open Total - Total of open files since system startup.
  The maximum number of Open files per Session cannot exceed 2048.

2. Start the Control Panel Server tool, and then click Users.

3. Examine each user listed in the connected users column; the number of open
  files is displayed on a per-user basis in the opens column.

  -or-

  Open a command prompt and type the following command from the server to save a
  list of open files.

  NET FILE > FILE.TXT

  This command saves a file with a list of all open files and their associated
  FIDs.

  The example below is sample output from the NET FILES command:

  ID      Path                               User name       # Locks

  ------------------------------------------------------------------
  25      C:\acadflat                        user1                0
  31      C:\acadflat\setup.exe              user1                0
  35      C:\ACADFLAT\ACAD.PER               user1                0
  69      C:\acadflat                        user1                0
  70      C:\ACADFLAT\ACAD.MNX               user1                0

Error: 0x3ea (SRV_TABLE_SEARCH)
-------------------------------

This error indicates that memory is allocated for Search, Find, and
Transact2_FindFirst SMB calls to store the current search state, but no
additional memory could be allocated for storing search buffers.


Applications that do not or cannot use the CloseSearch SMB (DOS applications or
older applications that do not, make WIN32 calls) do not have a method for
closing searches after they complete. In order to handle this situation, the
LanmanServer service uses several search time parameters to clear the search
handle and reclaim the memory allocated to the search buffers.

To change the search time parameters, perform the following steps:

WARNING: Using Registry Editor incorrectly can cause serious problems that may
require you to reinstall your operating system. Microsoft cannot guarantee that
problems resulting from the incorrect use of Registry Editor can be solved. Use
Registry Editor at your own risk.

For information about how to edit the registry, view the "Changing Keys And
Values" Help topic in Registry Editor (Regedit.exe) or the "Add and Delete
Information in the Registry" and "Edit Registry Data" Help topics in
Regedt32.exe. Note that you should back up the registry before you edit it.

1. Start Registry Editor (Regedt32.exe) and go to the following subkey:

  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters

2. Add or check the following values:

     MaxGlobalOpenSearch: REG_DWORD 
     MaxKeepSearch: REG_DWORD 
     MinKeepSearch: REG_DWORD 

  The MaxGlobalOpenSearch value determines the maximum number of open searches
  allowed by the LanmanServer service. The default value is 4096 with a maximum
  value of 65536. To allocate more search handles, increase the value of the
  MaxGlobalOpenSearch value to 16,000 (decimal).

  The MaxKeepSearch value determines the maximum amount of time in seconds that
  a search will remain open. The default value is 1800 seconds. Decrease the
  value of MaxKeepSearch to 900 seconds (15 minutes).

  The MinKeepSearch value determines the minimum amount of time in seconds that
  a search will remain open. The default value is 480 seconds. Decrease the
  value of MinKeepSearch to 240 seconds (4 minutes).

3. Monitor these performance monitor counters:

  Server\File Directory Searches
  Memory\Pool Paged Bytes
  Server Work Queues\Available Work Items

4. Check the value of the PagedPoolSize parameter in the following system
  registry key.

  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session
  Manager\MemoryManagement

  NOTE: The above registry key is one path; it has been wrapped for
  readability.

  The PagedPoolSize parameter should be set to 0x0. This allows Windows NT to
  dynamically calculate the size for Paged Pool memory.

Error: 0x3eb (SRV_TABLE_SESSION)
--------------------------------

This indicates that no more user IDs (UIDs) exist to satisfy this
BlockingSessionSetupAndX SMB.

1. Monitor these performance monitor counters:

  Redirector\Server sessions
  Redirector\Server sessions hung


2. To help eliminate this problem, check for unneeded user sessions on the
  server. This may include mapped drives in logon scripts or applications that
  automatically map drives to particular servers.

Error: 0x3ec (SRV_TABLE_TREE_CONNECT)
-------------------------------------

This indicates that no more free tree IDs (TIDs) exist to satisfy a TreeConnect
SMB.

1. Monitor these performance monitor counters:

  Redirector\Connects Core
  Redirector\Connects Lan Manager 2.0
  Redirector\Connects Lan Manager 2.1
  Redirector\Connects Windows NT


2. If the problem persists, consider moving frequently accessed data to another
  server. This should help lower the number of active Tree Connections to a
  particular server.

NOTE: If you are using Windows NT 4 Terminal Server Edition, the following
Microsoft Knowledge Base article may help resolve this problem:

  Q190162 Terminal Server and the 2048 Open File Limitation

Server Communications Limits
----------------------------

For Windows 2000 Client to Windows 2000 Server communications the limit is
16384.

For Legacy Clients to Windows 2000 Server communications the limit is 8192.

For all Clients to Windows NT 4.0 Server communications the limit is 2048.

Additional query words: srv

======================================================================
Keywords          : kbnetwork 
Technology        : kbWinNTsearch kbWinNTWsearch kbWinNTW400 kbWinNTW400search kbWinNT351search kbWinNT400search kbWinNTW351search kbWinNTW351 kbwin2000Serv kbWinNTSsearch kbWinNTS400search kbWinNTS400 kbWinNTS351 kbwin2000ServSearch kbwin2000Search kbWinNTS351search
Version           : :2000,3.51,4.0
Hardware          : x86
Issue type        : kbhowto

=============================================================================
THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.