General discussion

Locked

Event ID 2009 - User sessions

By J_S ·
I get system event error 2009.
I've looked it up on Microsoft's site which states the following:

Error: 0x3eb (SRV_TABLE_SESSION)
This indicates that no more user IDs (UIDs) exist to satisfy this BlockingSessionSetupAndX SMB.
Monitor these performance monitor counters:


Redirector\Server sessions
Redirector\Server sessions hung

To help eliminate this problem, check for unneeded user sessions on the server. This may include mapped drives in logon scripts or applications that automatically map drives to particular servers.

I did as it said and it gave me the number of server sessions as 1750.
We only have 25 devices on the network, we do have logon scripts as well which map 3 drives.
I also entered the event id over at http://www.eventid.net/search.asp which gives me the following as a comment:
Apparently, a client opened too many files or had too many active directory searches on the server. The client should either close some files or limit the number of simultaneous directory searches on the server. This behavior can also occur if a third-party program has leaked memory and/or resources.
Can anyone advise me how to go about fixing this. It started very recently and nothing has changed on the server whatsoever.

Thanks in advance for any suggestions.

This conversation is currently closed to new comments.

11 total posts (Page 1 of 2)   01 | 02   Next
| Thread display: Collapse - | Expand +

All Comments

Collapse -

Event ID 2009 - User sessions

by Mackem In reply to Event ID 2009 - User sess ...

Hi Happy New Year.
There is a utility in the NTResource kit called Net Watch. This enables you to keep a check on all drive mappings and which files and folders are being accessed. You can add or delete shares and you can stop a network share for auser or users.
You could also try setting up auditing on some of your shares to find out who is making multiple connections.
This may not solve your problem, but it may help you to find the cause.
Best of luck
JV.

Collapse -

Event ID 2009 - User sessions

by J_S In reply to Event ID 2009 - User sess ...

Poster rated this answer

Collapse -

Event ID 2009 - User sessions

by Ann777 In reply to Event ID 2009 - User sess ...

http://www.eventid.net/search.asp

Event I 2009
Source Srv
Type Error
Description The server could not expand a table because the table reached the maximum size.

Comments
Apparently, a client opened too many files or had too many active directory searches on the server. The client should either close some files or limit the number of simultaneous directory searches on the server. This behavior can also occur if a third-party program has leaked memory and/or resources.More info
MSKB Q165815

Collapse -

Event ID 2009 - User sessions

by Ann777 In reply to Event ID 2009 - User sess ...

Error: 0x3eb (SRV_TABLE_SESSION)

This indicates that no more user IDs (UIDs) exist to satisfy this BlockingSessionSetupAndX SMB.

Monitor these performance monitor counters:

Redirector\Server sessions
Redirector\Server sessions hung
To help eliminate this problem, check for unneeded user sessions on the server. This may include mapped drives in logon scripts or applications that automatically map drives to particular servers.

Collapse -

Event ID 2009 - User sessions

by Ann777 In reply to Event ID 2009 - User sess ...

IT SOUNDS LIKE ONE OF YOUR USERS HAS INSTALLED A PROGRAM THAT MAY HAVE A MEMORY LEAK.

Collapse -

Event ID 2009 - User sessions

by Ann777 In reply to Event ID 2009 - User sess ...

SMB = server message block.... I'd recommend you look for instant messenger or chat/e-mail type of problems. If none of those occur, then start looking for a faulty nic.

Collapse -

Event ID 2009 - User sessions

by J_S In reply to Event ID 2009 - User sess ...

Poster rated this answer

Collapse -

Event ID 2009 - User sessions

by maxwell edison In reply to Event ID 2009 - User sess ...

0281 ? Event Id: 2009, Source: Srv, ..table reached maximum size.
Double click the error to locate the error code in the 11th DWORD at 0x28.

0000: 00040000 00540001 00000000 c00007d9
0010: 00000000 c000009a 00000000 00000000
0020: 00000000 00000000 000003e9 <- Error code

3e9 Too many open files. Type net file > toomany.txt and examine the toomany.txt file.

3ea Too many unsatisfied SMB searches. Edit the registry at:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters

Edit or Add Value of type REG_DWORD for value names:
MaxGlobalOpenSearch - default: 4096, max: 65536, recommend: 16384
MaxKeepSearch - default: 1800, recommend: 900
MinKeepSearch - default: 480,recommend: 240
Set PagedPoolSize at tip 279 to 0.

3eb Too many user sessions (mapped drives or redirector hung). Use Server Manager or if you're in a hurry, see tip 159

3ec No more free Tree Ids (TIDs) to satisfy a TreeConnect SMB. Theonly solution is to offload highly accessed data.

------------------------------

The preceding came from:

http://www.jsiinc.com/SUBA/tip0200/rh0281.htm

------------------------------

(continued in comments...)

Collapse -

Event ID 2009 - User sessions

by maxwell edison In reply to Event ID 2009 - User sess ...

.
.
The aforementioned resolution mentioned "tip 159". The text of that tip is as follows:

159 ? Use a batch file to disconnect user sessions.

You can manually disconnect users in Server Manager and you can set logon time restrictions (with forced Logoff) in User Manager for Domains, but I prefer to use a batch file due to the enhanced flexibily it offers and the ability to schedule it. Here is a sample (note - a leading : is the same as REM):
ausing the Netlogon service prevent this"server" from processing new logons.
:If you have other logon servers, they can still process logons.
net pause Netlogon
ausing the Server service prevents new logons and new connections on this "server".
net pause Server
net send /domain "Your session(s) will be disconnected in 5 minutes, please logoff."
:Sleep is a resource kit utility.
sleep 300
:net session /delete /y will terminate all sessions/connections with this "server".
net session /delete /y
:
:
erform other usefull work here like stopping services, backing up, starting the services.
: To get the service names, browse the registry at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
: Example: net stop RemoteAccess
:
:
:Enable the Service and/or Netlogonservices that you paused.
net continue Server
net continue Netlogon
net send /domain "Logons and connections are now enabled."
exit

(REMOVE SPACES from the pasted URL.)

Best of luck and have a GREAT 2002!

Maxwell

Collapse -

Event ID 2009 - User sessions

by J_S In reply to Event ID 2009 - User sess ...

Poster rated this answer

Back to Windows Forum
11 total posts (Page 1 of 2)   01 | 02   Next

Related Discussions

Related Forums