NLB Timer Starvation Messages

V, Mike 1

I have a two node web cluster setup that uses Microsoft NLB to distribute web requests on Windows Server 2019 (IIS 10). On and off, both servers recently have the following message in their system event logs.

NLB cluster []: Timer starvation has been detected. This might be due to a denial of service attack or a very high server load. During this period, some connections might fail. If this problem recurs frequently, analyze the threat and take appropriate measures and/or add more servers to the cluster. An informational event log entry will be logged when the attack has subsided.

A few seconds later, a log entry notes that timer starvation has subsided. This is repeated continuously for days until it stops and then starts again.

I see no indication of a DDoS nor any failed requests or performance issues with IIS. My cluster is not under high load.

What is the cause of these messages?

Sam Wu-MSFT 7,036 Reputation points Microsoft Vendor

2022-06-27T03:07:18.803+00:00

@V, Mike It is difficult to reproduce your problem based on your description, I suggest you open a case via: https://support.microsoft.com.