Friday, November 30, 2012

RPC Client Access Throttling Logging

By default, you have to use PerfMon counters to see how often throttling is occurring for RPC connections.

However, there is a way to have this information "properly" logged. To achieve this, modify the Microsoft.Exchange.RpcClientAccess.Service.exe.config file located in \Program File\Microsoft\Exchange Server\V14\Bin and add Throttling to the LoggingTag string so it looks like this:
<add key=”LoggingTag” value=”ConnectDisconnect, Logon, Failures, ApplicationData, Warnings, Throttling”/>

Now restart the RPC Client Access service and you will see this information in logs created in the “\Program Files\Microsoft\Exchange Server\V14\Logging\RPC Client Access” folder. When throttling happens, you will usually find the keyword “exceeded”.

This way, you can easily see when RPC Throttling kicks in, what it is doing and why!


  1. Hi Nuno,

    Are you sure that RPC Client access throttling logs will be display in application log? else it will find only in \Program Files\Microsoft\Exchange Server\V14\Logging\RPC Client Access folder.

    Please clarify this


  2. Hi David,

    My sincere apologies for the mistake in the post. You are correct, that information is ONLY logged in the folder you mentioned!
    I have corrected the post. Thank you very much for pointing this out.


  3. hi,
    We have add the throttling in the below path
    and restarted the RPC client access service.

    However we couldnot find the word exceeded in the log file (Program Files\Microsoft\Exchange Server\V14\Logging\RPC Client Access folder.)

    Is there any other way to check throttling is working


    1. Hi Cooper,

      You can use the Get-LogonStatistics cmdlet to see how many connections a particular user is establishing to Exchange and see if it is below or above the throttling limit.

      Another way is to create a new Throttling Policy with a much lower value, apply it to a test user and "go over it" by connecting multiple Outlook clients to that same mailbox for example. In this case you should see the keyword "exceeded" in the logs.

      Let me know how it goes!

      Regards, Nuno