Microsoft KB Archive/317411

= How to gather data to troubleshoot Exchange virtual memory issues =

Article ID: 317411

Article Last Modified on 2/28/2007

-

APPLIES TO


 * Microsoft Exchange 2000 Server Standard Edition
 * Microsoft Exchange Server 2003 Standard Edition

-



This article was previously published under Q317411



SUMMARY
This article provides information about different types of data gathering that may help you to diagnose virtual memory issues on Microsoft Exchange Server. To determine the root cause of the behavior described later in this section, you must gather data for analysis.

Virtual memory fragmentation occurs when the size and number of the contiguous blocks of available memory reaches a certain threshold. This behavior can adversely affect the performance of an Exchange Server and may prevent databases from mounting. For example, to mount a database requires a 10-megabyte (MB) block of contiguous virtual memory. If virtual memory is fragmented in such a way that the free virtual memory block sizes are at or below 10 MBs, the databases cannot be mounted without restarting the server.

Note On a Microsoft Exchange 2000 Server computer or on a Microsoft Exchange Server 2003 computer, the Store process is the most memory-intensive process. For more information about how Exchange 2000 Server allocates and uses memory, click the following article number to view the article in the Microsoft Knowledge Base:

302254 Computer that is running Exchange 2000 and Windows 2000 Server may run out of virtual memory with event ID 12800



MORE INFORMATION
Several tools are useful to troubleshoot virtual memory behaviors; the following is a list of the tools to use:

Note To gather the data, we recommend that you use the tools together to collect corresponding data simultaneously from the server, if this procedure is possible.
 * System Monitor logs (also known as Performance Monitor logs)
 * Event logs
 * System Information file (WINMSD)
 * Virtual Address Dump file
 * Userdump.exe file

System Monitor Logs
The System Monitor tool that is included with Microsoft Windows 2000 is the administrative tool that replaces the Performance Monitor tool that is included with Microsoft Windows NT 4.0. A general guideline is to use System Monitor to create logs of the server performance when it is operating typically so that you can use these logs as a baseline to compare to the logs generated when the server has problems.

When you use System Monitor to troubleshoot virtual memory issues, it is important to gather performance data for a long enough period of time. This requires that you gather multiple logs over a period of hours or even days. If you save the logs periodically, this procedure makes sure that the size of the logs remains manageable.

There are a number of objects that you can add to the System Monitor log to track the memory usage on the Exchange server. Add all of the counters, for each of the following objects:

System Performance Objects

 * Cache
 * Database
 * Memory
 * Objects
 * Paging file
 * Process
 * Processor
 * System
 * Threads
 * PhysicalDisk

Exchange-specific Performance Objects

 * MSExchangeIS

NOTE: If you suspect that other Exchange Server components are the cause of virtual memory fragmentation, add the appropriate objects and their counters.

For more information about how to configure System Monitor, click the following article numbers to view the articles in the Microsoft Knowledge Base:

248345 How to create a log using System Monitor in Windows

296073 Monitoring for Exchange 2000 memory fragmentation

Event Logs
The Event Viewer provides the Application logs and System logs. The Event logs capture the activity for the same time period as the System Monitor logs. The Event logs provide a quick reference to activities that are occurring on the server and the Event logs indicate possible errors.

Virtual memory warnings or errors are generally logged in the Application log as an event ID 9582. This event ID can be either a warning or an error.

When the server reaches less than 32 MBs of contiguous virtual address space, the following warning event is logged:

Event Source: MSExchangeIS

Event Category: Performance

Event ID: 9582

Type: Warning

Description: The virtual memory necessary to run your Exchange server is fragmented in such a way that performance may be affected. It is highly recommended that you restart all Exchange services to correct this issue.

When the server reaches less than 16 MBs of contiguous virtual address space, this same event ID 9582 message is logged, but it is logged as an error message:

Event Source: MSExchangeIS

Event Category: Performance

Event ID: 9582

Type: Error

Description: The virtual memory necessary to run your Exchange server is fragmented in such a way that normal operation may begin to fail. It is highly recommended that you restart all Exchange services to correct this issue.

System Information File
A System Information report provides information about the server's configuration. To generate a System Information file:
 * 1) Click Start, click Run, type WINMSD, and then click OK.
 * 2) In the System Information window, right-click the System Information object, and then click Save as System Information File.
 * 3) Type a file name, and then click Save.

NOTE: The System Information file is saved with an .nfo extension.

Virtual Address Dump Utility
The Virtual Address Dump utility (Vadump.exe) is a utility that creates a report that contains information about the memory usage of a specified process. The list includes:
 * 1) Each address and its size, state, protection, and type.
 * 2) Total committed memory for the image, the .exe file, and each .dll file, which includes system .dll files.
 * 3) Total mapped-committed memory, private-committed memory, and reserved memory.
 * 4) Information about the working set and about paged and non-paged pool usage.

To capture information about the memory usage of Exchange Server's Store process, install the Vadump.exe file, and then at a command prompt run the following command:

vadump -v -p storePID >outputfile.txt

NOTE: The &quot;storePID&quot; in the command is the Store process ID. You can locate the process ID in Task Manager.

The Vadump.exe file is included in the Windows 2000 Resource Kit and in the Windows Server 2003 Resource Kit. Additionally, this utility is available for download. To download this utility, visit the following Microsoft Web sites.

Windows 2000
http://www.microsoft.com/WINDOWS2000/techinfo/reskit/tools/existing/vadump-o.asp

Windows Server 2003
http://www.microsoft.com/downloads/details.aspx?FamilyID=9d467a69-57ff-4ae7-96ee-b18c4790cffd&DisplayLang=en

Userdump.exe Utility
Userdump.exe is a utility that you can use to generate a dump file to capture the state of a process. The information captured can include exceptions, call stack information and thread activity. To use Userdump.exe to troubleshoot Exchange Server virtual memory issues, run the Userdump.exe file when the symptoms cause adverse effects on the server's performance or when the server does not respond.

NOTE: Running Userdump.exe does not end the Store process. However, it can provide data that is very useful to determine the root cause of an issue.

To generate the dump file of the Exchange Server's Store process, install Userdump.exe, and then at a command prompt run the following command:

userdump storePID

NOTE: The &quot;storePID&quot; in this command is the Store process ID. You can locate the process ID in Task Manager. The dump file that results is located in the folder in which the command is run and is named Store.dmp. Make sure that the drive where the Store.dmp file is to be generated contains available space that is equal to, or larger than the memory installed on the server.

UserDump and its documentation are part of the OEM Support Tools package. A copy may be obtained at following Microsoft Web site:

http://download.microsoft.com/download/win2000srv/Utility/3.0/NT45/EN-US/Oem3sr2.zip

For more information about the use of Userdump.exe, click the following article numbers to view the articles in the Microsoft Knowledge Base:

241215 How to use the Userdump.exe tool to create a dump file

250509 How to use Userdump.exe to capture the state of the information store

Additional query words: e2k perfmon 9582

Keywords: kbdownload kbinfo KB317411

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.