Exchange administrators have to manage and monitor numerous facets of their servers so that their user community is never kept waiting for messages. It used to be that server administrators had to also manage settings that affected the memory usage of their systems. A couple of those settings involved the use of page files and virtual memory.

Virtual memory is a concept that has been around for some time. Systems are configured with memory whose size is the result of analysis, computations and sometimes a best-guess estimate of the memory requirements for the applications. When there is insufficient memory available in RAM to run an application then other areas of memory are paged out to disk space and later retrieved when needed. The paged memory that is stored on the disk drives is commonly referred to as a “swap file”. But the official terminology is to refer to this data as “virtual memory”.

Exchange Server is also an application with memory needs. And so Exchange Server also relies on virtual memory for its successful execution. Unfortunately just as a disk drive can get fragmented over time virtual memory can also get fragmented over time. And when virtual memory fragmentation happens then administrators, and their end users, will see degradation in the performance of Exchange Server.

Administrators should monitor their Exchange Server as much as possible. It is important to continuously monitor the server so as to establish a baseline of virtual memory usage. Once a baseline has been established then administrators will be able to notice any unusual patterns or trends of virtual memory allocation. When virtual memory is available then their Exchange Server is ready for larger workloads. Likewise less workload can be added to the Exchange Server when there is less virtual memory available.  In parallel with these higher or lower workloads is performance. When virtual memory becomes fragmented then performance gets adversely affected especially on Exchange clusters.

Virtual memory issues tend to show up more often in clustered Exchange 2000 or 2003 configurations where there are multiple thousands of users. Clustered Exchange Server environments will typically contain multiple storage groups and multiple messaging databases. Additionally, virtual memory errors and virtual memory fragmentation issues can be exhibited on Active/Active server clusters as well as Active/Passive server clusters. But even standalone Exchange Servers can experience virtual memory errors and virtual memory fragmentation issues.

Virtual memory fragmentation issues can result in message processing problems and message conversion problems. Users may also experience performance issues and may not be able to access their messages.

The warning or error messages that are typically logged by Exchange Server in the Application event log will usually include Event ID 9582, Event ID 9665 or Event ID 12800. Event ID 9582 can look similar to the following error message:

Event Type: Error
Event Source: MSExchangeIS
Event Category: Performance
Event ID: 9582
Date: 07/21/2004
Time: 9:30:18 PM
User: N/A
Computer: EX2K3
Description: The virtual memory necessary to run your Exchange server is fragmented in such a way that normal operation may begin to fail. It is highly recommended that you restart all Exchange services to correct this issue.

For event ID 9582, a monitoring tool can be used to alert the administrator whenever this event ID shows up in the application event log. Event ID 9582 will occur when the largest free block of virtual memory decreases to 32 megabytes (MB). When this event occurs an administrator should prepare to shut down the server and perform a restart within 36 to 72 hours.

An administrator can use the Performance Logs and Alerts tool to monitor the “VM Total Large Free Block Bytes” counter for the MSExchangeIS performance object. Using this data, an administrator can estimate an appropriate time to shut down and restart the server.

When Exchange Server 2003 is being used and the Store.exe process is started, then Exchange Server will run an optimal memory configuration check. An event ID 9665 warning message will be logged if the memory settings are not optimal. When this happens, an administrator should check the SystemPages setting and the HeapDeCommitFreeBlockThreshold setting in the registry. They should also verify the “/3GB” switch and the “/userva” switch in the Boot.ini file.

Event ID 12800 error messages are generated when virtual memory is heavily fragmented. If the following error message is repeated often and within seconds of itself then this can be an indication of extreme virtual memory fragmentation:
Source: MSExchangeIS
Category: Content Engine
ID: 12800
Type: Error
Description:
Message processing failed because there is not enough available memory (8007000E-82000387).

It is important to note that simply adding more memory to the system will not alleviate the problem. Decreasing the load on the system can help. And administrators can offload some of the applications – that are sharing the resources of the Exchange server – onto a different system. They can also spend time on looking at the processes that are running on the Exchange Server to see if there are any runaway processes consuming inordinate amounts of memory. But adding more memory to an overloaded, memory constrained system will only prolong the amount of time before the system runs out of virtual memory and begins to fragment again.