Directory event log event 2917

Have you ever seen event 2917 in your Client Access server’s event log? It might look something like this:

Process w3wp.exe (PID=1234). A budget charge was encountered that exceeded the limit of '2.768900000' minutes.  Budget Owner: 'SomeUser', Component: 'EWS, CostType: 'CAS'.

Sounds scary, doesn’t it? The wording is a bit odd (feel free to blame me) and can lead one to assume that there is some strange throttling limit of 2.7689 minutes (or some other equally non-integer-like number) lurking inside Exchange. There is no such limit – that value indicates when the condition was discovered, not what the limit is. This is really more of a warning message, but is completely un-actionable and will be removed from a future release of the product. 

All this event is saying is that the throttling infrastructure noted that a given operation has taken longer than expected, and it wanted you to know about it. This could be the result of an overloaded mailbox server, intense periods of garbage collection, a domain controller issue, and so on… It does not suggest that the “budget owner” has done anything wrong or nefarious nor does it suggest that the user in question was throttled. You can ignore this event log and look forward to the days when it will no longer darken the doorstep of your event log.

David Sterling
Exchange Web Services
Inside Microsoft Exchange Server 2007 Web Services