The maximum number of actively serviced connections that could be tracked by NLB is reached

Microsoft.Windows.NetworkLoadBalancing.6.2.The.maximum.number.of.actively.serviced.connections.that.could.be.tracked.by.NLB.is.reached (Rule)

Knowledge Base article:

Summary

The Network Load Balancing (NLB) driver on the host tracks connections to maintain client/network affinity configured on the NLB cluster. If the driver is not functioning properly, NLB may not be able to track TCP connections or may experience load distribution errors.

Resolutions

Address NLB connection tracking limits

The maximum number of active connections that Network Load Balancing (NLB) can track is reached. Although NLB will continue to accept new connections, it will not track the connection state until other connections are closed. This might result in breaking the affinity maintained by the driver during the connection.

To address the connection tracking limits, you can either add more hosts to the NLB cluster, which distributes the number of incoming connections across more cluster hosts, or increase the connection tracking limit.

Add a host to the NLB cluster

To add a host to the NLB cluster:

Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on your computer.

Increase the connection tracking limit by editing the registry key

To increase the connection tracking limit by editing the registry key:

Element properties:

TargetMicrosoft.Windows.NetworkLoadBalancing.6.2.ServerRole
CategoryAlert
EnabledTrue
Alert GenerateFalse
RemotableTrue

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.NetworkLoadBalancing.EventProvider Default
WA WriteAction Microsoft.Windows.NetworkLoadBalancing.6.2.GenerateAlert.SuppressByDescription Default
WriteToDB WriteAction Microsoft.Windows.NetworkLoadBalancing.6.2.CollectEvent Default

Source Code:

<Rule ID="Microsoft.Windows.NetworkLoadBalancing.6.2.The.maximum.number.of.actively.serviced.connections.that.could.be.tracked.by.NLB.is.reached" Enabled="onEssentialMonitoring" Target="Microsoft.Windows.NetworkLoadBalancing.6.2.ServerRole" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>Alert</Category>
<DataSources>
<DataSource ID="DS" TypeID="NLBLibrary!Microsoft.Windows.NetworkLoadBalancing.EventProvider">
<Criteria>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>19</Value>
</ValueExpression>
</SimpleExpression>
</Criteria>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="WA" TypeID="Microsoft.Windows.NetworkLoadBalancing.6.2.GenerateAlert.SuppressByDescription">
<Priority>1</Priority>
<Severity>1</Severity>
<AlertMessageId>$MPElement[Name="Microsoft.Windows.NetworkLoadBalancing.6.2.The.maximum.number.of.actively.serviced.connections.that.could.be.tracked.by.NLB.is.reached.AlertMessage"]$</AlertMessageId>
<EnableAlert>true</EnableAlert>
</WriteAction>
<WriteAction ID="WriteToDB" TypeID="Microsoft.Windows.NetworkLoadBalancing.6.2.CollectEvent">
<CollectEvent>false</CollectEvent>
</WriteAction>
</WriteActions>
</Rule>