Client Throttling Event ID 2915 – What It Really Means

Here I was truffling through the TechNet forums, and saw this thread.  I thought I’d share a little bit more detail around it, as the error text that is added to the event log entry is a little confusing.

While Exchange 2007 did have some throttling mechanisms, it was Exchange 2010 that really introduced a fully featured throttling framework.  This is implemented by configuring client throttling policies and assigning them to mailboxes.  When a client exceeds it’s defined throttle policy, an event may be written to the application event log.  In the example that is in the forum thread it is for one of the OWA components.  An event ID 2915 was logged stating the following:


Process w3wp.exe () (PID=6252). User 'Sid~contosa\abcd~OWA~false' has gone over budget '14' times for component 'OWA' within a one minute period. Info: 'Policy:DefaultThrottlingPolicy_d7d68d93-9249-4fa7-cfoe-901ac837ae2f, Parts:AD:13;'. Threshold value: '10'.



What could possible be confusing with the above?  In this case it was the last portion of the message:


“  Threshold value: '10'.  ”


Most people assume that the threshold value, as shown in blue above, is an actual value as configured in the throttling policy.  So when the cmdlet  Get-ThrottlingPolicy is executed, and since 10 does not show up in the OWA section output head scratching ensues!

Exchange 2010 Throttling Policy Output Showing OWA Values


What is this mythical 10?  Is it in binary - no.   Is it in Hexadecimal – no.  The threshold value actually tells Exchange after how many occurrences should it write the 2915 event to the application log.  In other words, if the number of times a user exceeds the budget is higher than 10 in the last minute then we should create an Event 2915.


In this case the user had gone over budget 14 times in the last minute.  Since 14 exceeds the event writing threshold count of 10, then the 2915 event was created.


I should do some coverage on throttling policies in general, as there have been some issues with them recently and also historically.  


Please do add a comment if there is something that you would like to see posted here.  If you don’t want to add a public comment there is always the “Email Blog Author” button to the right of every page.




Comments (12)
  1. anonymouscommenter says:

    Thank you Rhoderick, this is valuable for the beginner.

  2. Thanks Jessie!

    Do let us know if there are any other topics that you think could do with coverage here please!



  3. anonymouscommenter says:

    seriously awesome explanation Rhoderick Milne


  4. anonymouscommenter says:

    I presume there is no way to know what threshold has been exceeded, ie there is no way to tell if the user exceeded OWAMaxConcurrency or OWAPercentTimeInAD?

  5. anonymouscommenter says:

    Awesome, and like customers and I like it : straight to the point and you made a complicated issue simple to understand thanks to your post. Thanks !

  6. Dafo,

    There should be sufficient detail in the message – the above example was in AD.

    Can you paste an example here?


  7. Thanks Sam – much appreciated.


  8. anonymouscommenter says:

    Good explanation, thanks.

  9. Andy Blooman says:

    Can i confirm, a user might go over budget 500 times when sending a press pack to external parties. Does this mean those emails are queued and then delivered or is there any chance in emails getting lost?

    1. Andy this is not SMTP, this RPC Client access. It is way before the email makes it way to transport.


  10. Thiem says:

    Please Help me, I want to fix it.
    Process w3wp.exe () (PID=7428). User ‘Sid~VPTCC\vithivu~OWA~false’ has gone over budget ’17’ times for component ‘OWA’ within a one minute period. Info: ‘Policy:DefaultThrottlingPolicy_5e021eb5-d474-4985-b7f5-3ec28b7ee2fa, Parts:CAS:16;’. Threshold value: ’10’.

    1. Call up that user and ask what they were doing at that time. I also wonder if there are browser plug-ins for OWA as well for some 3rd party apps.


Comments are closed.

Skip to main content