Topic Last Modified: 2007-02-15
The Microsoft Exchange Analyzer Tool queries the Win32_NTLogEvent Microsoft Windows Management Instrumentation (WMI) class to determine whether an Event 9582 error has been logged for MSExchangeIS within the last 24 hours.
If the Exchange Analyzer finds that an Event 9582 has been logged in the past 24 hours, the Exchange Analyzer displays an error.
This error indicates that the virtual memory that is required to run the Exchange server is fragmented.
In 32-bit Microsoft Windows systems, there are two kinds of memory:
- Physical memory Amount of actual memory
installed in the system
- Virtual memory address space A
virtualized 4-GB memory space
Regardless of how much physical memory is installed on the system, the total size of the virtual address space is always the same: 4 GB. Although it is not the case for all 32-bit applications, for Exchange Server, virtual address space equals virtual memory. The terms are used interchangeably.
During the normal course of its operations, the Exchange store will repeatedly allocate, use, and deallocate virtual memory. When virtual memory is allocated, used, and deallocated frequently, virtual memory fragmentation can result. Virtual memory fragmentation is similar to file system fragmentation that can occur over time. After a while, allocated segments of virtual memory are no longer contiguous, and performance begins to suffer. In the file system, you can run an application that performs defragmentation of the file system. In most cases, defragmentation of the file system can be done while the system is online and being accessed. With virtual memory fragmentation, there is no defragmentation tool. Instead, to correct the problem, you must stop and start the Microsoft Exchange Information Store service or restart the system.
To address this issue:
- Virtual memory fragmentation can be caused by third-party
software running in the store/inetinfo processes. Make sure that
you have the latest drivers for any third-party applications.
- Use the Performance Logs and Alerts tool to monitor the VM
Total Large Free Block Bytes counter for the
MSExchangeIS performance object. Use the data collect from
this counter to determine the best window, within the next 36 to 72
hours, to shut down and then restart the server.
 Note: |
|---|
| If this is a clustered server, stop and restart the passive node before you move cluster resources to it to make sure that the target virtual memory address space is clean. |
- If the problem is reproduced after restarting, consider
disabling third-party software.
- Consider moving user mailboxes to another server to reduce
server load and see whether the problem stops. For more
information, see Move User Mailboxes to
Another Server.
For More Information
- For more information about MSExchangeIS Event 9852, see the
"Events and Errors Message Center: Event Details" (http://go.microsoft.com/fwlink/?LinkId=83209).
- For more information about Exchange Server performance, see the
Exchange Server 2003 Performance and Scalability Guide
(http://go.microsoft.com/fwlink/?LinkId=47576).
- For more information about how to troubleshoot Exchange Server
performance issues, see Troubleshooting Microsoft Exchange
Server 2003 Performance (http://go.microsoft.com/fwlink/?LinkId=47588).
- For more information about how to troubleshoot virtual memory
fragmentation in Microsoft Exchange Server 2003 and
Exchange 2000 Server, see Microsoft Knowledge Base article
325044, "How to troubleshoot virtual memory fragmentation in
Exchange Server 2003 and Exchange 2000 Server" (http://go.microsoft.com/fwlink/?LinkId=3052&kbid=325044).
- For more information about how to optimize virtual memory
usage, see Microsoft Knowledge Base article 815372, "How to
optimize memory usage in Exchange Server 2003" (http://go.microsoft.com/fwlink/?linkid=3052&kbid=815372).
- For more information about how to move user mailboxes to reduce
server load, see Move User Mailboxes to
Another Server.