Event ID 2011 Source Srv
| Event ID | 2011 |
| Source | Srv |
| Type | Error |
| Description | The Server's configuration parameter "IRPStackSize" is too small for the server to use a local device. Please increase the value of this parameter. |
| English, please! | This information is only available to subscribers. An example of English, please! |
| Comments |
Nikita Vernigora
If you use McAfee Virusscan v8.0 or v8.5, see the link to "McAfee Support Document ID: KB47899". Anonymous I believe that the IRPStackSize value (which is case-sensitive, according to M177078) is not present by default on Windows XP. I have read in the Symantec KB (linked to from M177078) that removing the value entirely allows Windows to control the IRP stack size. Mihai Andrei If you see this event after installing Norton AntiVirus, the default Windows settings for IRPStackSize have been changed. See the link to "Symantec Knowledge Base Document ID: 1999102015170006" to restore IRPStackSize to Windows default setting. See the link to "Symantec Knowledge Base Document ID: 2003041606221448" for additional information on this event. Ionut Marin As per Microsoft: "The server is configured with too many file system filter drivers (for example, Quota and anti-virus) and/or too many devices, or the irpstacksize parameter is set to less than the default of 15 stack frames. The irpstacksize represents the number of kernel modules that can store information in the input/output (I/O) Request Packet (IRP). The IRP is used to track I/O requests in the kernel". See MSW2KDB for more details. Depending on the hardware configuration of the specific computer, the default value may not be large enough for the SRV service to properly administer shared folders on some of the physical drives. See M225782 for more information. Installing Exchange Server 5.5 Service Pack 1 (SP1) on a computer running clustering services provided by Windows NT 4.0 Service Pack 4 (SP4) release candidate is not recommended. Setup may not work because the IrpStackSize parameter is too small. See M200490 for more details. If you are running McAfee NetShield 4.5 for Windows, then see "Network Associates Support Solution ID: nai8553". See the link to "Veritas Support Document ID: 244156" for additional information on this event. Adrian Grigorof As per Microsoft: "IBM AntiVirus 3.01N (Build 301.590) may cause this behavior.". See the link below for more details. This error can also appear on Windows NT Server or Terminal Server prior to SP 4. See the link. Why bother deciphering Event logs when GFI EventsManager can do everything for you? Free trial here! Tony Hinkle Any software that uses a file system filter driver will cause the system to use more IRP stack. Accordingly, this event may be seen after installing open file backup agents, antivirus software, quota software, replication software, etc. Dimitri Zavgorodny Same message could appear with Norton Antivirus 7.6 Corporate Edition on Windows 2000 Server. See M177078. Adrian Florin Moisei From a newsgroup post: "Windows XP, Windows 2000, and Windows NT all have an IRPStackSize value that controls how much physical storage space and RAM are available to new applications, and some new software installs incorrectly set this value. This value ranges from 11 to 50 for Windows 2000 and Windows XP and from 0x4 to 0xC (4-12) for Windows NT. M177078 has more details on the default values for the IRPStackSize key. If you set this value to a value smaller than the defauls value, you will receive an error message indicating that the system does not have enough server storage. As a result, clients will not be able to access network shares and this event will appear in the System log. To set the IRPStackSize back to the default value (15 Windows 2000 and XP, 0x4 for NT), perform the following steps: 1. Start the registry editor (e.g., regedit.exe). 2. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services \lanmanserver\parameters. 3. Double-click IRPStackSize (or if this registry setting does not exist, create it of type DWORD and ensure the case is correct). 4. Change the base to decimal (or HEXAdecimal in some cases), set the value to the default value for your OS, and click OK. 5. Reboot the computer or restart the "Server" service". See M106167 for additional information. |
| Links | M106167, M177078, M198386, M200490, M225782, Veritas Support Document ID: 244156, Network Associates Support Solution ID: nai8553, Symantec Knowledge Base Document ID: 1999102015170006, Symantec Knowledge Base Document ID: 2003041606221448, McAfee Support Document ID: KB47899, MSW2KDB |
| Search | Google Web - Microsoft Support - Bing - EventID.Net Queue - More links... |
| Custom search | The custom search information is available to subscribers only. |
| Feedback | Send comments - Notify me when updated |
| Print version |