Monitor unlimited number of servers
Filter log events
Create email and web-based reports
Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content
Event ID: 9582 Source: MSExchangeIS
Source
Level
Description
The Virtual memory necessary to run your Exchange server is fragmented in such a way that normal operation may begin to fail. It is highly recommended that you restart all Exchange services to correct this issue.
English
Request a translation of the event description in plain English.
Concepts to understand
Comments
This event might occur when Microsoft Exchange Server 2003 receives Internet Message Access Protocol, Version 4rev1 (IMAP4) search requests. See ME904159 for a hotfix applicable to Microsoft Exchange Server 2003.
This problem also occurs because of a memory leak on the Exchange 2003 server. See ME932182 for a hotfix applicable to Microsoft Exchange Server 2003.
This issue occurs if virtual memory in the Web Storage System is fragmented. The Web Storage System may experience virtual memory fragmentation during typical operations. Virtual memory fragmentation can cause document management operations such as check-in tasks and check-out tasks to fail. See ME838683 to solve this problem.
This problem also occurs because of a memory leak on the Exchange 2003 server. See ME932182 for a hotfix applicable to Microsoft Exchange Server 2003.
This issue occurs if virtual memory in the Web Storage System is fragmented. The Web Storage System may experience virtual memory fragmentation during typical operations. Virtual memory fragmentation can cause document management operations such as check-in tasks and check-out tasks to fail. See ME838683 to solve this problem.
See ME838233, ME872776, and ME883527 for three hotfixes applicable to Microsoft Exchange 2000 Server.
As per Microsoft: "This problem may occur if the IMAP4 service assigns a value of 0xFFFF for the crowTotal field in the EcQueryRows function. This allocates memory in 9 megabyte (MB) portions as IMAP4 responds to client requests. Because of this, on a heavily loaded server, memory may become fragmented or exhausted". See ME817050 for detailed information.
ME266096 states that Exchange 2000 requires "/3GB" switch with more than 1 Gigabyte of physical RAM.
ME325044, ME317411, ME329864, ME822180, and ME823150 show how to troubleshoot virtual memory fragmentation in Exchange 2003 and Exchange 2000.
ME815372 shows you how to optimize memory usage in Exchange Server 2003.
See also ME298064, ME315406, ME816753, and ME835408 for more details about this event.
Check "Event ID 9582 (warning) from source MSExchangeIS" and MSEX2K3DB for additional information on this event.
From a newsgroup post: "This event is new to Exchange 2000 SP1. By default, if the contiguous free space in virtual memory drops below 32Mb of RAM, a 9582 Warning Event will be generated by the MSExchangeIS. If this further drops to below 16Mb, a 9582 Error Event will be generated. You should restart the store process (information store service) to resolve this".
As per Microsoft: "This problem may occur if the IMAP4 service assigns a value of 0xFFFF for the crowTotal field in the EcQueryRows function. This allocates memory in 9 megabyte (MB) portions as IMAP4 responds to client requests. Because of this, on a heavily loaded server, memory may become fragmented or exhausted". See ME817050 for detailed information.
ME266096 states that Exchange 2000 requires "/3GB" switch with more than 1 Gigabyte of physical RAM.
ME325044, ME317411, ME329864, ME822180, and ME823150 show how to troubleshoot virtual memory fragmentation in Exchange 2003 and Exchange 2000.
ME815372 shows you how to optimize memory usage in Exchange Server 2003.
See also ME298064, ME315406, ME816753, and ME835408 for more details about this event.
Check "Event ID 9582 (warning) from source MSExchangeIS" and MSEX2K3DB for additional information on this event.
From a newsgroup post: "This event is new to Exchange 2000 SP1. By default, if the contiguous free space in virtual memory drops below 32Mb of RAM, a 9582 Warning Event will be generated by the MSExchangeIS. If this further drops to below 16Mb, a 9582 Error Event will be generated. You should restart the store process (information store service) to resolve this".
We experienced the same issue with Sharepoint 2001. The version of Exchange Store installed on that box by Sharepoint is Exchange 5.5. Microsoft sent us the following information and fix:
”The Web Storage System may experience virtual memory fragmentation during normal operations. This fragmentation can cause document management operations such as check-in and check-out to fail. The Web Storage System included in SP 2 addresses this problem by introducing a registry key that can be set to prevent the memory fragmentation. The registry key is:
Key: HKLM\SYSTEM\CurrentControlSet\Services\MSExchangeIS\ParametersSystem.
Value: Max Buffers.
The proper DWORD value for this registry key depends on the amount of RAM for the server. The setting can be calculated using one of the following formulas:
- If the amount of RAM is less than 768 MB, then the DWORD value is the amount of RAM in bytes divided by 4096. For example, if the server has 256 MB of RAM, then the DWORD value is 256*1024*1024/4096 = 65, 536.
- If the amount of RAM is equal to or greater than 768 MB, then the DWORD value is 768MB in bytes divided by 4096. For example, if the server has 1024 MB of RAM, then the DWORD value is 768 * 1024 * 1024 / 4096 = 196, 608”.
Since we have 2 GB of RAM in your server, we set this registry key to a decimal value of 196, 608 and then rebooted the server. Since then our problem disappeared.
”The Web Storage System may experience virtual memory fragmentation during normal operations. This fragmentation can cause document management operations such as check-in and check-out to fail. The Web Storage System included in SP 2 addresses this problem by introducing a registry key that can be set to prevent the memory fragmentation. The registry key is:
Key: HKLM\SYSTEM\CurrentControlSet\Services\MSExchangeIS\ParametersSystem.
Value: Max Buffers.
The proper DWORD value for this registry key depends on the amount of RAM for the server. The setting can be calculated using one of the following formulas:
- If the amount of RAM is less than 768 MB, then the DWORD value is the amount of RAM in bytes divided by 4096. For example, if the server has 256 MB of RAM, then the DWORD value is 256*1024*1024/4096 = 65, 536.
- If the amount of RAM is equal to or greater than 768 MB, then the DWORD value is 768MB in bytes divided by 4096. For example, if the server has 1024 MB of RAM, then the DWORD value is 768 * 1024 * 1024 / 4096 = 196, 608”.
Since we have 2 GB of RAM in your server, we set this registry key to a decimal value of 196, 608 and then rebooted the server. Since then our problem disappeared.
I got this error when I was running Exchange 2000 SP3 Enterprise on a Win2K SP3 Server with 3GB of RAM. I called Microsoft PPS and there is a problem with that configuration. To fix it, I was told to use ASDIedit to modify the Information Store Properties more precisely: "ConfigContainer/CN=Config/CN=Server/CN=MSExch/CN=domain/CD=AdminGrp/CN=1stAdminGrp/CN=Servers/CN=servername/CN=informationstore" and to set the “msExchESEParamCacheSizeMax” to 147456. Each store will have to have this setting tweaked. I made the modification and it has been correctly allocating memory ever since.
If you are running Windows 2000 Server (not Advanced Server), it is best to keep your RAM to 2GB or less. I reduced my RAM from 3GB to 2GB and this error went away. Q30224 says: "IMPORTANT: Note that it is not recommended that you run Windows 2000 Server with anything more than 2 GB of memory (that is, do not use the /3GB switch), when you are running Exchange 2000 because anything over that amount is unused."
See event id: 9582, source: MSExchangeIS, type: Warning.
The message is fairly descriptive. Most of the users reporting this have had this problem fixed by rebooting the server.
Some other newsgroup posts mention that this event started after they installed antivirus software.
Another newsgroup post says: "This is still a bug in Exchange 2K. You can always set up performance counters in W2K to watch the Virtual memory to ensure it doesn't drop to a critical level. I confirmed this with MS today. It may be fixed in SP4 or a POST SP3 hotfix. The other options you were given in this post were useless. Re-installing won't fix anything."
Another potential reason for this is using the /3gb switch in the Boot.ini file. Most users agree that this should never be used on a Windows 2000 Server (Microsoft says that if the server is running Windows 2000 Advanced Server and if it has more than 1 gigabyte (GB) of RAM, make sure that the Boot.ini file does contain the /3gb switch).
If Exchange is running in a cluster configuration, see ME296073 on advice about monitoring for Exchange 2000 memory fragmentation. Also related to a cluster configuration is ME325467.
ME324331 presents a situation where this event may occur if you are running SharePoint Portal Server 2001 on Windows 2000 Server.
Some other newsgroup posts mention that this event started after they installed antivirus software.
Another newsgroup post says: "This is still a bug in Exchange 2K. You can always set up performance counters in W2K to watch the Virtual memory to ensure it doesn't drop to a critical level. I confirmed this with MS today. It may be fixed in SP4 or a POST SP3 hotfix. The other options you were given in this post were useless. Re-installing won't fix anything."
Another potential reason for this is using the /3gb switch in the Boot.ini file. Most users agree that this should never be used on a Windows 2000 Server (Microsoft says that if the server is running Windows 2000 Advanced Server and if it has more than 1 gigabyte (GB) of RAM, make sure that the Boot.ini file does contain the /3gb switch).
If Exchange is running in a cluster configuration, see ME296073 on advice about monitoring for Exchange 2000 memory fragmentation. Also related to a cluster configuration is ME325467.
ME324331 presents a situation where this event may occur if you are running SharePoint Portal Server 2001 on Windows 2000 Server.
Windows Event Log Analysis Splunk App
Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.
Cisco ASA Log Analyzer Splunk App
Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.