Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 2022 Source: Srv

The server was unable to find a free connection <number> times in the last <number> seconds.
This problem occurs because a conflict between the Microsoft server device driver (Srv.sys) and a third-party filter driver creates a deadlock. See ME893374 for a hotfix applicable to Microsoft Windows 2000.

A special resource task in the Windows service uses the MinFreeConnections and MaxFreeConnections registry settings to preallocate connection objects. By default, you do not have to change the MinFreeConnections and MaxFreeConnections registry settings. However, under certain conditions, the demand for pre-allocated connection objects may exceed the default numbers that are automatically configured for these registry settings. In this case, event ID 2022 is usually logged in the System event log. See ME909262 to find out more about these registry values.

See ME245723, ME923360, "Dell Support Document Number: TT1061426", "JSI Tip 1012", "JSI Tip 2219", "JSI Tip 1043" and "JSI Tip 3406" for additional information about this event.
See ME830901 for a hotfix applicable to Microsoft Windows 2000.

From a newsgroup post: "I had this problem for months. It first appeared after I installed McAfee NetShield. Even though I uninstalled McAfee, it continued to freeze until I replaced the "srv.sys" file in the "winnt\system32\drivers" directory with the current one. Check the date stamp on yours. It will probably be 12/?/97, you need the one dated 5/?/98. The new "srv.sys" file is in WinNT SP4 and you can also get it from Microsoft or Mcafee. You don't even have to reboot, just copy the file while the server is running and it will never hang again".

If you are using McAfee ePolicy Orchestrator, then see the link to "Network Associates Support Solution ID: nai14213" for details on this event.

If clients cannot connect to server that is running VirusScan ASaP, the see the link to "Network Associates Support Solution ID: nai27043".

Also check ME308151, ME816071, ME821464, ME822219, ME892422, and the link to "EventID 2022 from source NCP Server" for more details.
Disabling Norton Antivirus Client service on the server stopped the error from occurring again.
This error was caused on Win2k Server by incorrect (invalid order) permissions set on "%windir%\system32" subfolders and files. Propagating permissions from system32 to all files and folders repaired this error.
This event may occur in various conditions. See the links below for some of them. Make sure you search again Microsoft site for the latest addtions.
The ME317249 article describes a method to troubleshoot issues that generate such events. In short here are the recommended steps (see the article for details):
1. Apply the Latest Service Pack
2. Examine the Hard Disks for Errors
3. Defragment the Hard Disk Drives (suggested also by several newsgroup posts)
4. Filter Drivers in the Disk I/O Stack and Other Programs
if these steps do not improve the situation then:
5. Edit the Registry to Maximize Server Service Performance

An old Q article (ME139607 - now removed from Microsoft's Knowledgebase) says that this event occurs on a Windows NT Server that is replicating files to 40 or 50 Windows NT Workstation. This appeared to be a bug in Windows NT 4.0 and there was no resolution suggested.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.