General discussion

  • Creator
    Topic
  • #2126290

    Event ID 2009 – User sessions

    Locked

    by j_s ·

    I get system event error 2009.
    I’ve looked it up on Microsoft’s site which states the following:

    Error: 0x3eb (SRV_TABLE_SESSION)
    This indicates that no more user IDs (UIDs) exist to satisfy this BlockingSessionSetupAndX SMB.
    Monitor these performance monitor counters:

    Redirector\Server sessions
    Redirector\Server sessions hung

    To help eliminate this problem, check for unneeded user sessions on the server. This may include mapped drives in logon scripts or applications that automatically map drives to particular servers.

    I did as it said and it gave me the number of server sessions as 1750.
    We only have 25 devices on the network, we do have logon scripts as well which map 3 drives.
    I also entered the event id over at http://www.eventid.net/search.asp which gives me the following as a comment:
    Apparently, a client opened too many files or had too many active directory searches on the server. The client should either close some files or limit the number of simultaneous directory searches on the server. This behavior can also occur if a third-party program has leaked memory and/or resources.
    Can anyone advise me how to go about fixing this. It started very recently and nothing has changed on the server whatsoever.

    Thanks in advance for any suggestions.

All Comments

  • Author
    Replies
    • #3441162

      Event ID 2009 – User sessions

      by mackem ·

      In reply to Event ID 2009 – User sessions

      Hi Happy New Year.
      There is a utility in the NTResource kit called Net Watch. This enables you to keep a check on all drive mappings and which files and folders are being accessed. You can add or delete shares and you can stop a network share for auser or users.
      You could also try setting up auditing on some of your shares to find out who is making multiple connections.
      This may not solve your problem, but it may help you to find the cause.
      Best of luck
      JV.

    • #3439976

      Event ID 2009 – User sessions

      by ann777 ·

      In reply to Event ID 2009 – User sessions

      http://www.eventid.net/search.asp

      Event ID: 2009
      Source Srv
      Type Error
      Description The server could not expand a table because the table reached the maximum size.

      Comments
      Apparently, a client opened too many files or had too many active directory searches on the server. The client should either close some files or limit the number of simultaneous directory searches on the server. This behavior can also occur if a third-party program has leaked memory and/or resources.More info
      MSKB Q165815

      • #3439975

        Event ID 2009 – User sessions

        by ann777 ·

        In reply to Event ID 2009 – User sessions

        Error: 0x3eb (SRV_TABLE_SESSION)

        This indicates that no more user IDs (UIDs) exist to satisfy this BlockingSessionSetupAndX SMB.

        Monitor these performance monitor counters:

        Redirector\Server sessions
        Redirector\Server sessions hung
        To help eliminate this problem, check for unneeded user sessions on the server. This may include mapped drives in logon scripts or applications that automatically map drives to particular servers.

      • #3439972

        Event ID 2009 – User sessions

        by ann777 ·

        In reply to Event ID 2009 – User sessions

        IT SOUNDS LIKE ONE OF YOUR USERS HAS INSTALLED A PROGRAM THAT MAY HAVE A MEMORY LEAK.

      • #3439969

        Event ID 2009 – User sessions

        by ann777 ·

        In reply to Event ID 2009 – User sessions

        SMB = server message block…. I’d recommend you look for instant messenger or chat/e-mail type of problems. If none of those occur, then start looking for a faulty nic.

      • #3440750

        Event ID 2009 – User sessions

        by j_s ·

        In reply to Event ID 2009 – User sessions

        Poster rated this answer

    • #3439974

      Event ID 2009 – User sessions

      by maxwell edison ·

      In reply to Event ID 2009 – User sessions

      0281 ? Event Id: 2009, Source: Srv, ..table reached maximum size.
      Double click the error to locate the error code in the 11th DWORD at 0x28.

      0000: 00040000 00540001 00000000 c00007d9
      0010: 00000000 c000009a 00000000 00000000
      0020: 00000000 00000000 000003e9 <- Error code 3e9 Too many open files. Type net file > toomany.txt and examine the toomany.txt file.

      3ea Too many unsatisfied SMB searches. Edit the registry at:

      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters

      Edit or Add Value of type REG_DWORD for value names:
      MaxGlobalOpenSearch – default: 4096, max: 65536, recommend: 16384
      MaxKeepSearch – default: 1800, recommend: 900
      MinKeepSearch – default: 480,recommend: 240
      Set PagedPoolSize at tip 279 to 0.

      3eb Too many user sessions (mapped drives or redirector hung). Use Server Manager or if you’re in a hurry, see tip 159

      3ec No more free Tree Ids (TIDs) to satisfy a TreeConnect SMB. Theonly solution is to offload highly accessed data.

      ——————————

      The preceding came from:

      http://www.jsiinc.com/SUBA/tip0200/rh0281.htm

      ——————————

      (continued in comments…)

      • #3439968

        Event ID 2009 – User sessions

        by maxwell edison ·

        In reply to Event ID 2009 – User sessions

        .
        .
        The aforementioned resolution mentioned “tip 159″. The text of that tip is as follows:

        159 ? Use a batch file to disconnect user sessions.

        You can manually disconnect users in Server Manager and you can set logon time restrictions (with forced Logoff) in User Manager for Domains, but I prefer to use a batch file due to the enhanced flexibily it offers and the ability to schedule it. Here is a sample (note – a leading : is the same as REM):
        :Pausing the Netlogon service prevent this”server” from processing new logons.
        :If you have other logon servers, they can still process logons.
        net pause Netlogon
        :Pausing the Server service prevents new logons and new connections on this “server”.
        net pause Server
        net send /domain “Your session(s) will be disconnected in 5 minutes, please logoff.”
        :Sleep is a resource kit utility.
        sleep 300
        :net session /delete /y will terminate all sessions/connections with this “server”.
        net session /delete /y
        :
        :
        :Perform other usefull work here like stopping services, backing up, starting the services.
        : To get the service names, browse the registry at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
        : Example: net stop RemoteAccess
        :
        :
        :Enable the Service and/or Netlogonservices that you paused.
        net continue Server
        net continue Netlogon
        net send /domain “Logons and connections are now enabled.”
        exit

        (REMOVE SPACES from the pasted URL.)

        Best of luck and have a GREAT 2002!

        Maxwell

      • #3440748

        Event ID 2009 – User sessions

        by j_s ·

        In reply to Event ID 2009 – User sessions

        Poster rated this answer

    • #3440747

      Event ID 2009 – User sessions

      by j_s ·

      In reply to Event ID 2009 – User sessions

      This question was closed by the author

Viewing 3 reply threads