Directory event log event 2917

Have you ever seen event 2917 in your Client Access server’s event log? It might look something like this:

Process w3wp.exe (PID=1234). A budget charge was encountered that exceeded the limit of '2.768900000' minutes.  Budget Owner: 'SomeUser', Component: 'EWS, CostType: 'CAS'.

Sounds scary, doesn’t it? The wording is a bit odd (feel free to blame me) and can lead one to assume that there is some strange throttling limit of 2.7689 minutes (or some other equally non-integer-like number) lurking inside Exchange. There is no such limit – that value indicates when the condition was discovered, not what the limit is. This is really more of a warning message, but is completely un-actionable and will be removed from a future release of the product. 

All this event is saying is that the throttling infrastructure noted that a given operation has taken longer than expected, and it wanted you to know about it. This could be the result of an overloaded mailbox server, intense periods of garbage collection, a domain controller issue, and so on… It does not suggest that the “budget owner” has done anything wrong or nefarious nor does it suggest that the user in question was throttled. You can ignore this event log and look forward to the days when it will no longer darken the doorstep of your event log.

David Sterling
Exchange Web Services
Inside Microsoft Exchange Server 2007 Web Services

Comments

• Anonymous
  October 14, 2010
  Is it true that this can still occur in the final released product?

• Anonymous
  October 18, 2010
  @Erik - Nope, this was removed in the final release.  It was a beta only event :)

• Anonymous
  October 18, 2010
  @Erik - Nope, this was removed in the final release (2010 SP1).  

• Anonymous
  January 03, 2011
  The comment has been removed

• Anonymous
  January 23, 2011
  I'm seeing this in the final product. Along with a bunch of topology errors.