Windows 2000 does not send out alert messages over the network in real-time. Instead, it checks for available alerts after a certain length of time, or sends alerts when a certain threshold of pending alerts is reached. The length of time and the event threshold are both administrator-settable, but only by editing the Registry.
To change the length of time between alert checks, open the Registry and navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ Services\LanmanServer\Parameters.. Add or edit a DWORD key named AlertSched, which controls how often in minutes the system will check for alerts. The default value is 5 minutes. This can be set as high as 65535, or as low as 0 (i..e, to stop polling).
Add or edit a DWORD key named ErrorThreshold, which controls how many errors will crop up before an alert is triggered in the time before AlertSched elapses. For instance, if ErrorThreshold is set to 10, and 10 alerts come up before AlertSched minutes elapse, the alerts are all sent. The default for this value is 10.
Add or edit the DWORD value NetworkErrorThreshold. This indicates the percentage of failed network operations that will trigger an alert, again before the time indicated in AlertSched elapses. The default is 5 (5%) and the range is 1-100.
There are a few reasons for changing these values. One, you may want to restrict alerting entirely so that the system's alert conditions are only polled on demand or through a third-party tool that does the polling differently. Two, you may want to increase the frequency of alerts to provide something closer to real-time polling, even though the finest granularity available for alert polling is one minute. Three, by lowering the frequency of events on crowded networks, you can reduce network chatter.
Serdar Yegulalp is the editor of the Windows 2000 Power Users Newsletter. Check out his Windows 2000 blog for his latest advice and musings on the world of Windows network administrators – please share your thoughts as well!