Topic Last Modified: 2007-02-15

The Microsoft Exchange Analyzer Tool queries the Win32_NTLogEvent Microsoft Windows Management Instrumentation (WMI) class to determine whether an Event 9582 error has been logged for MSExchangeIS within the last 24 hours.

If the Exchange Analyzer finds that an Event 9582 has been logged in the past 24 hours, the Exchange Analyzer displays an error.

This error indicates that the virtual memory that is required to run the Exchange server is fragmented.

In 32-bit Microsoft Windows systems, there are two kinds of memory:

Regardless of how much physical memory is installed on the system, the total size of the virtual address space is always the same: 4 GB. Although it is not the case for all 32-bit applications, for Exchange Server, virtual address space equals virtual memory. The terms are used interchangeably.

During the normal course of its operations, the Exchange store will repeatedly allocate, use, and deallocate virtual memory. When virtual memory is allocated, used, and deallocated frequently, virtual memory fragmentation can result. Virtual memory fragmentation is similar to file system fragmentation that can occur over time. After a while, allocated segments of virtual memory are no longer contiguous, and performance begins to suffer. In the file system, you can run an application that performs defragmentation of the file system. In most cases, defragmentation of the file system can be done while the system is online and being accessed. With virtual memory fragmentation, there is no defragmentation tool. Instead, to correct the problem, you must stop and start the Microsoft Exchange Information Store service or restart the system.

To address this issue:

If this is a clustered server, stop and restart the passive node before you move cluster resources to it to make sure that the target virtual memory address space is clean.

For More Information