Configuration of an email server involves many sizing considerations. One of those sizing considerations is called Virtual Memory. Virtual memory is used to temporarily swap operating system items in and out of memory during high memory usage periods. Swap space is usually set to be one to two times of available memory. The swap space consists of a swap file located on disk. All applications benefit from swap space as it allows the applications to run when otherwise they would be starved for memory. Exchange server as an application also benefits from virtual memory.

But the virtual memory blocks must be large enough to meet the needs of the memory requirements of the application processes. If the block sizes available are not large enough then the condition of virtual memory fragmentation occurs. Some of the causes can include the different duration times and different sizes of memory allocations that happen as a result of normal swap operations.

As time goes by large blocks of memory become harder to allocate and at some point will cause applications to fail. Warning and error messages are generated as the virtual memory space becomes more and more fragmented. Some of the warning messages can include event ID 9582 which will be logged in the application event log. This event does not mean that the situation has hit the critical stage but it can and it should be taken as a notification to review the swap file size and to monitor its usage.

The event ID 9582 can be recorded in the event log as follows:
 Source: MSExchangeIS
Category: Performance
ID: 9582
Type: Warning
Description: “The virtual memory necessary to run your Exchange server is fragmented in such a way that performance may be affected. It is highly recommended that you restart all Exchange services to correct this issue.”

This can occur if an Exchange server has less than 32MB of free contiguous virtual address space.

It is sometimes thought that by adding more memory then the low virtual memory problem can be resolved. But this is not the case because the amount of physical memory that is installed in the server and the amount of virtual memory that has been configured are not correlated with one another. So adding more memory is not a solution.

An indication that virtual memory is running low is when event ID 12800 is produced. This event ID is a notification that the low virtual memory situation has become critical. Event ID 12800 is a message-processing error and indicates that virtual memory is getting extremely low. This event should be addressed as soon as possible. Unless action is taken soon then system performance can slow down dramatically and cause unexpected results.

As already mentioned a server can get low on virtual memory and degrade system performance because of heavy swap utilization. One such reason for this situation is if additional users are added to the workload of the server which results in an over-burdened server with frequent and disparate memory usage. This can have an adverse effect on the Microsoft Exchange Information Store process (Store.exe). One of the warning messages that can be produced is the event ID 9582 that has already been previously mentioned.      

Virtual memory problems have a higher likelihood of occurring when clustering is being used. Environments such as a clustered Exchange 2003 configuration or a clustered Exchange 2000 configuration are typically used in large organization where thousands of users require access to a large number of databases and large amounts of data storage.

An administrator can monitor the virtual memory allocation and look for virtual memory fragmentation indications by reviewing the application event log of the Event Viewer. To monitor the virtual memory usage an administrator can use the Performance Logs and Alerts tool and to check for virtual memory fragmentation in Exchange 2000 and Exchange 2003.

The application event log of the Event Viewer can be monitored on a daily basis for event ID 9582 events. An event ID 9582 warning message will appear in the application event log when the following condition appears: the largest free block of virtual memory is decreased to thirty-two megabytes (32MB).

Using a monitoring tool an administrator can monitor the event log for those 9582 event ID’s and receive alerts whenever they are logged.