How to Troubleshoot Event ID 2009 Errors

ID: Q165815

The information in this article applies to:

Microsoft Windows NT Workstation versions 3.51, 4.0
Microsoft Windows NT Server versions 3.51, 4.0

IMPORTANT: This article contains information about editing the registry. Before you edit the registry, make sure you understand how to restore it if a problem occurs. For information about how to do this, view the "Restoring Registry" Help topic in Regedit.exe or the "Restoring a Registry Key" Help topic in Regedt32.exe.

SUMMARY

There are several ways to resolve the problems indicated by finding the following error logged in the System event log:


   Event Id: 2009
   Source: Srv
   Description: The server could not expand a table because the table
   reached the maximum size.

MORE INFORMATION

The Server service generates this error message when one of its internal tables in memory is full and cannot be expanded. These internal tables track active sessions, resource connections, open files, and open searches so this error message can be generated by many possible problems.

To determine which problem is responsible for generating the error, examine the Data section of the Event Detail dialog box for the error code parameter. In the following example, the error code is the final group (000003ea):


   0000: 00040000 00540001 00000000 c00007d9
   0010: 00000000 c000009a 00000000 00000000
   0020: 00000000 00000000 000003ea

The 11th DWORD at 0x28 is the actual Server service-specific error code. In the example above, the error code is 0x000003ea, but the error code varies depending on the Server service error.

Compare the following error code examples to your error codes to determine the cause of the event:

Error: 0x3e9 (SRV_TABLE_FILE)

This indicates that no more file IDs (FIDs) can be allocated to process the various open file server message blocks (SMBs) because of a shortage of available FIDs.

Monitor these performance monitor counters:

Server\Files Open - Currently Open Files Server\Files Open Total - Total of open files since system startup.

Start the Control Panel Server tool, and then click Users.

Examine each user listed in the connected users column; the number of open files is displayed on a per-user basis in the opens column.

-or-

Open a command prompt and type the following command from the server to save a list of open files.

NET FILE > FILE.TXT

This command will save a file with a list of all open files and their associated FIDs.

The example below is sample output from the NET FILES command:


   ID      Path                               User name       # Locks

   ------------------------------------------------------------------
   25      C:\acadflat                        user1                0
   31      C:\acadflat\setup.exe              user1                0
   35      C:\ACADFLAT\ACAD.PER               user1                0
   69      C:\acadflat                        user1                0
   70      C:\ACADFLAT\ACAD.MNX               user1                0

Error: 0x3ea (SRV_TABLE_SEARCH)

This error indicates that memory is allocated for Search, Find, and Transact2_FindFirst SMB calls to store the current search state, but no additional memory could be allocated for storing search buffers.

Applications that do not or cannot use the CloseSearch SMB (DOS applications or older applications that do not, make WIN32 calls) do not have a method for closing searches after they complete. In order to handle this situation, the LanmanServer service uses several search time parameters to clear the search handle and reclaim the memory allocated to the search buffers.

To change the search time parameters, perform the following steps:

WARNING: Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

For information about how to edit the registry, view the "Changing Keys And Values" Help topic in Registry Editor (Regedit.exe) or the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe. Note that you should back up the registry before you edit it.

Start Registry Editor (Regedt32.exe) and go to the following subkey:

HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters

Add or check the following values:
```
      REG_DWORD MaxGlobalOpenSearch
      REG_DWORD MaxKeepSearch
      REG_DWORD MinKeepSearch 
```
The MaxGlobalOpenSearch value determines the maximum number of open searches allowed by the LanmanServer service. The default value is 4096 with a maximum value of 65536. To allocate more search handles, increase the value of the MaxGlobalOpenSearch value to 16,000 (decimal).

The MaxKeepSearch value determines the maximum amount of time in seconds that a search will remain open. The default value is 1800 seconds. Decrease the value of MaxKeepSearch to 900 seconds (15 minutes).

The MinKeepSearch value determines the minimum amount of time in seconds that a search will remain open. The default value is 480 seconds. Decrease the value of MinKeepSearch to 240 seconds (4 minutes).

Monitor these performance monitor counters:
Server\File Directory Searches
Memory\Pool Paged Bytes
Server\Available Work Items

Check the value of the PagedPoolSize parameter in the following system registry key.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\MemoryManagement

NOTE: The above registry key is one path; it has been wrapped for readability.

The PagedPoolSize parameter should be set to 0x0. This allows Windows NT to dynamically calculate the size for Paged Pool memory.

Error: 0x3eb (SRV_TABLE_SESSION)

This indicates that no more user IDs (UIDs) exist to satisfy this BlockingSessionSetupAndX SMB.

Monitor these performance monitor counters:
Redirector\Server sessions
Redirector\Server sessions hung

To help eliminate this problem, check for unneeded user sessions on the server. This may include mapped drives in logon scripts or applications that automatically map drives to particular servers.

Error: 0x3ec (SRV_TABLE_TREE_CONNECT)

This indicates that no more free tree IDs (TIDs) exist to satisfy a TreeConnect SMB.

Monitor these performance monitor counters:
Redirector\Connects Core
Redirector\Connects Lan Manager 2.0
Redirector\Connects Lan Manager 2.1
Redirector\Connects Windows NT

If the problem persists, consider moving frequently accessed data to another server. This should help lower the number of active Tree Connections to a particular server.

Additional query words: srv

Keywords : kbnetwork ntprotocol NTSrvWkst
Version : WinNT:4.0
Platform : winnt
Issue type : kbhowto