0X0000097F Alert Table Full – What It Means and How to Fix It

Quick Answer

Clear the system event log in Event Viewer, then reboot. That flushes the alert queue. If it keeps coming back, track down the driver or service that's spamming alerts.

Why You're Seeing This

Windows uses a kernel-level alert table to track certain system events—like hardware failures, driver crashes, or security violations. This table has a fixed size, set by the kernel at boot. When something goes haywire and starts firing alerts faster than Windows can process them, the table fills up. The OS then returns STATUS_ALERT_TABLE_FULL (error code 0X0000097F).

This isn't a normal everyday error. You'll typically see it on a Windows Server running a load of monitored services, or on a workstation where a buggy driver or a misbehaving antivirus is hammering the alert system. The real trigger is almost always a piece of software that's generating alerts in a tight loop—think a failing disk driver that keeps reporting errors every millisecond, or a custom service that polls hardware status and raises alerts without rate-limiting.

The alert table itself is part of the I/O manager in the Windows kernel. It's designed to hold a limited number of pending notifications. Once it's full, new alerts are simply rejected—that's when you get the error. The fix isn't to enlarge the table (you can't without a kernel hack), it's to drain it and stop the flood.

Fix Steps

1. Clear the System Event Log – Open Event Viewer (eventvwr.msc), go to Windows Logs > System, right-click it, and choose Clear Log. This empties the event queue that feeds the alert table. The table will drain as events are processed. Reboot afterward to reset the kernel alert state.
2. Reboot into Safe Mode – If the error prevents normal operation, reboot and press F8 (or hold Shift while clicking Restart in Windows 10/11) to enter Safe Mode. The minimal driver set won't flood the table, letting you clear logs and diagnose.
3. Identify the Alert Source – After rebooting normally, open Event Viewer again and check System and Application logs for a repeating error or warning just before the 0X0000097F appears. Look for a specific source (like a driver name or service ID). That's your culprit.
4. Update or Remove the Causing Driver – If the source is a hardware driver (common with network adapters, storage controllers, or USB hubs), download the latest version from the manufacturer—not from Windows Update. Uninstall the old driver via Device Manager, check Delete the driver software for this device, then install the new one.
5. Stop or Reconfigure the Spamming Service – If the source is a third-party service (antivirus, monitoring tool, custom app), stop it temporarily with sc stop [service_name] or disable it in Services.msc. If that clears the error, contact the vendor for a fix or adjust the service's polling interval.

Alternative Fixes

If the steps above don't work, try these:

• Run SFC and DISM – Corrupted system files can cause erratic kernel behavior. Run sfc /scannow from an admin Command Prompt, then DISM /Online /Cleanup-Image /RestoreHealth. Reboot after.
• Check for Hardware Failure – A failing disk or memory module can generate constant alerts. Run chkdsk /f on your system drive and mdsched.exe to test RAM.
• Roll Back a Recent Update – If the error started after a Windows Update or driver update, roll it back via Settings > Update & Security > View update history > Uninstall updates.

Prevention Tip

The only way to prevent 0X0000097F from repeating is to stop whatever's flooding the alert table. That means keeping drivers updated, avoiding beta software that hooks into kernel eventing, and monitoring your event logs for alert storms. On servers, set up an alert threshold in Performance Monitor for System Alert Table % Usage (if available) so you catch it before it hits full.

This error is a symptom, not the disease. Fix the flooding, and the error disappears.