event id 9582 on exchange server - Techist - Tech Forum

Go Back   Techist - Tech Forum > Computer Software > Microsoft Windows and Software
Click Here to Login
Closed Thread
 
Thread Tools Display Modes
 
Old 06-01-2006, 03:43 PM   #1 (permalink)
True Techie
 
Join Date: Feb 2006
Posts: 228
Send a message via ICQ to selina Send a message via Yahoo to selina
Question event id 9582 on exchange server

i took a look at it when one of my users told that he was getting the following message in his outlook 2003, and saw event id 9582 in application log on exchange server. as i read about 9582, it apparently has something to do with MS exchange information store service taking up the virtual memory. but since we are running exchange 2000 on standard 2000 server, it doesn't have /3gb support for it to 'reserve' some virtual address memory. so if you are running exchange 2000 on standard win server 2000 with more than 1gb ram, this event id is bound to happen.
so one thing we can do is to restart MS information store service. but we have restarted the server itself since we started noticing this application log. (for some other reasons) but we still see 9582 logged every hour.
wouldn't restarting the entire server free up virtual memory?

---------------------------------
Requesting data from Microsoft Exchange…

Outlook is retrieving data from the Microsoft Exchange Server “MPIWP9”. You can cancel the request or minimize this message to the Windows taskbar until Outlook closes the message automatically.

[ ] Always minimize this message when a delay occurs.

{Cancel Request}
-----------------------------------
__________________

selina is offline  
Old 06-01-2006, 07:21 PM   #2 (permalink)
Techie Beyond Description
 
Osiris's Avatar
 
Join Date: Jan 2005
Location: Kentucky
Posts: 36,817
Send a message via ICQ to Osiris Send a message via AIM to Osiris Send a message via MSN to Osiris Send a message via Yahoo to Osiris
Default

9582 Event ID Errors. Hey Exchange admins, does that ring a bell?! 9582 events have been a huge call generator for PSS. I know- my group troubleshoots them all the time with Exchange 2000 support cases, not to mention I see the topic come up a good bit on the public newsgroups I regularly check. Even though the 9582's are not something relatively new, I find there is still a huge misunderstanding around the topic. I want to use this log entry to talk a little about the infamous 9582 events that appear on many of the Exchange 2000 servers out there (note: 2003 has a lot of built-in self tuning that I’ll talk about in one of my next weblogs). First of all, the 9582 events started showing up with Exchange 2000, but only the event IDs were added to the code in E2K SP1. Virtual Memory Fragmentation (I’ll refer to it as "VMF") has been around long before Exchange.

Ok- With today’s servers easily containing more than 1GB RAM, let’s talk about the confusion around the /3GB switch on an Exchange 2000 Server… one point of confusion is taken right from a KB article, “Exchange 2000 requires /3GB switch with more than 1-GB of physical RAM”. The reason why we state this is because when the Information Store process starts up it goes through some calculations. Some of the variables within this calculation take into account how much physical memory, how many CPUs, etc., are installed on the system. For the purpose of my point, the important one here is obviously the amount of RAM. That is, “How much physical memory is in the box?” When the server has 1GB of RAM or more, the Exchange Store.exe assumes that this must be a pretty beefy box… "Because I (Store.exe) have a lot of physical memory, I want to take advantage of more virtual memory too."

This leads me to a quick review of Virtual Address (VA) space in the NT OS’s. Windows 2000/2003 implement a virtual memory system based on a flat, linear 32-bit address space; 32 bits of address space translates into 4 GB of virtual memory. On most systems, Windows 2000/2003 allocates half of this address space, the lower half, to individual processes for their unique private storage, and it uses the other half, the upper half of the address space, for its own protected operating system memory utilization. The mappings of the lower half change to reflect the virtual address space of the currently executing process. But the mapping of the upper half always consists of the operating system's virtual memory. This VA can be modified by using a few special switches in the Boot.ini. The /3GB “switch” can be placed in the Boot.ini file (Note: Windows 2000 Standard does NOT support the /3GB). This gives a 3-GB private address space to processes running specially marked executables with the “large address aware” flag set in the header of the executable, leaving 1 GB for the OS. This option allows applications, such as database servers (e.g., Exchange and SQL Server) to keep larger portions of the database in the process address space. Being able to keep more of the database in memory keeps some pressure off of the disk subsystem.

Anyways, the above is why the 9582’s are generated frequently on Exchange 2000 Servers running on Windows 2000 Standard Servers with >=1GB of RAM. Without the option to use the /3GB switch, the Store is restricted to just 2GB of VA. (Remember, the /3GB switch can not be used on Windows 2000 Standard edition, but ALL versions of Windows 2003 support it! Whoot!!) It's almost like a double-edged sword... Upon startup, the Store sees 1GB+ of RAM installed and it wants to take advantage of more virtual addresses by caching more of the database information, but with W2K Standard edition, we can't use the /3GB switch. Therefore, when the Store caches more data in the VA, that leaves less free VA to map in and out of during runtime. With less free VA, it takes less time for the VA to become fragmented. So you're options are somewhat limited. It's not an operating system limitation. There are a handful of tweaks, but the major one in this case is unavailable for a server running on Windows 2000 Standard. Unfortunately, there are a lot of customers running in that configuration. Keep in mind too that the 9582 warning is generated when the Store.exe determines the largest contiguious block of memory in the VA is less than 32MB. If the largest block is less than 16MB, the 9582 error is generated. When the error is generated, immediate action is required like restarting the Store service.

Allow me to review what VMF is. It has long been the focus of research by mathematicians and scientists. It occurs over time because of the varying size of memory allocations in conjunction with the varying lifetimes of those allocations. When I talk to customers about virtual memory fragmentation, I like to use the example of a hard drive in a PC. For example, I have a PC at home for which I just bought a 60-GB hard drive. I just installed it into my PC. The first thing I'm going to do, obviously, is load Windows XP on it. After that I'm going copy family photos, MP3s, and install other files and applications. All of those files, more than likely, are going to be different sizes. And many of those files I might keep forever and some of those files I might delete after X-amount of time. It's the same concept as VMF- that here are different-sized files that I'm keeping for different amounts of time. So what would happen after, say, six months or a year, when I run the Windows Disk Defragmenter utility? When I analyze my hard disk, it's going to be very colorful. It's going to have a lot of red and green, right? In other words, the hard disk is going to be fragmented. The same sort of thing happens in virtual memory as well. With your hard disk, you combat the problem by running a disk defrag tool. In memory, you combat the problem by restarting the processes/system to clear the VA and start over.

Since most 32-bit applications are built on the theory of utilizing different size memory chunks, fragmentation will continue to be a pain point. However, since Exchange relies a lot on memory, VMF seems to show up more often. Well, there are some steps that you can take to prolong the affects of VMF if your E2K box is generating 9582s. Going back to what I mentioned above, one thing to keep in mind is planning for it ahead of time… for instance, not setting up an Exchange 2000 server on Windows 2000 Standard with 1GB or more of RAM. With all versions of Windows 2003 supporting the /3GB, we shouldn’t have that limitation too much more in future deployments with W2K3 and E2K3. But, for those still running Exchange 2000 on W2k Std w/1GB+, there are things that can be done, plenty actually. But, don’t take this literally and go rip out a stick or two of RAM from your server! That’s never a good solution. If you are getting the 9582 errors on your Exchange 2000 Server then check out *the* KB article on troubleshooting VMF, Q325044. This KB is setup as a guide. It has a handful of VMF-related tweaks that can be made on the server, plus other things like what to monitor, links to other KBs, etc.

The combination of Exchange 2003 and Windows 2003 have a lot to offer in terms of prolonging the negatives of VMF. So much so that I haven't heard of one case in PSS yet where an E2K3 Server was generating 9582's! I think this is a good pausing place for now...
__________________

Osiris is offline  
Old 06-02-2006, 12:29 PM   #3 (permalink)
True Techie
 
Join Date: Feb 2006
Posts: 228
Send a message via ICQ to selina Send a message via Yahoo to selina
Default

thx, warez, but i've already read this site...
when i monitor vm in performance, it doens't read the bytes right. i gives me 1016 warning with liberary is not alligned on an 8-byte boundary... *sigh*
so the only thing i can think of doing at this point is to restart ms exchange information store service. but here's my questions:
we have restarted the server itself since 9582's started appearing in application log. now, i know that store.exe hogs the vm at bootup. so is retarting info store service by itself make a difference from server reboot????
selina is offline  
Old 06-02-2006, 11:45 PM   #4 (permalink)
Techie Beyond Description
 
Osiris's Avatar
 
Join Date: Jan 2005
Location: Kentucky
Posts: 36,817
Send a message via ICQ to Osiris Send a message via AIM to Osiris Send a message via MSN to Osiris Send a message via Yahoo to Osiris
Default

im not sure where to go with this but it doesnt sound like it will make a difference if you do or dont. how big is your company?
Osiris is offline  
Old 06-08-2006, 10:14 AM   #5 (permalink)
True Techie
 
Join Date: Feb 2006
Posts: 228
Send a message via ICQ to selina Send a message via Yahoo to selina
Default

the company has about 100 employees with 5 offices around the US. it's a spin-off company of a huge japanese trading company. they splited from this parent company 5-6 years ago. but when they did, the domain wasn't createt properly. (well, in my opinion anyways) so even tho win2k servers has a lotta problems that were left alone til upgrade to 2k3, alot should've been done differently at initial point.
anyways, thank god, we are upgrading their system now. so hopefully, this error on mse2k will be solved when it's upgraded to 2k3... i just hope it won't crash before that!
selina is offline  
Old 06-08-2006, 10:55 AM   #6 (permalink)
Techie Beyond Description
 
Osiris's Avatar
 
Join Date: Jan 2005
Location: Kentucky
Posts: 36,817
Send a message via ICQ to Osiris Send a message via AIM to Osiris Send a message via MSN to Osiris Send a message via Yahoo to Osiris
Default

The virtual memory necessary to run your Exchange server is fragmented in such a way that normal operation may begin to fail. It is highly recommended that you restart all Exchange services to correct this issue.


Following are some of the several reasons:

1. When an Exchange server has less than 32 MB of free contiguous virtual address space, the above" warning" event message will be logged in to the application event log.

2. When an Exchange server has less than 16 MB of free contiguous virtual address space, the above "error" message will be logged in to the application event log.

3. If you are running SharePoint Portal Server 2001 on Windows 2000 Server, the above event ID messages may be logged in the Application event log. Following is the workaround for this issue
Perform one of the following procedures that applies to the type of server that you are using:
If the server is running Windows 2000 Server, remove the /3gb switch from the Boot.ini file.
-or-
If the server is running Windows 2000 Advanced Server and if it has more than 1 gigabyte (GB) of RAM, make sure that the Boot.ini file contains the /3gb switch.
If you use the /3gb switch, there must be at least 1 GB of physical memory available on the computer.

Another
Osiris is offline  
Old 06-08-2006, 11:10 AM   #7 (permalink)
True Techie
 
Join Date: Feb 2006
Posts: 228
Send a message via ICQ to selina Send a message via Yahoo to selina
Default

thx, warez.
i guess you went to the same site as me. i read this one.

anyways, it's a dump question, but i must. to set the boot.ini, i have to go to msconfig, right? well, it's not accessible. is there any other way to set boot.ini in win2k server?
selina is offline  
Old 06-08-2006, 11:34 AM   #8 (permalink)
Techie Beyond Description
 
Osiris's Avatar
 
Join Date: Jan 2005
Location: Kentucky
Posts: 36,817
Send a message via ICQ to Osiris Send a message via AIM to Osiris Send a message via MSN to Osiris Send a message via Yahoo to Osiris
Default

http://support.microsoft.com/kb/311578
Osiris is offline  
Old 06-08-2006, 01:01 PM   #9 (permalink)
Techie Beyond Description
 
Osiris's Avatar
 
Join Date: Jan 2005
Location: Kentucky
Posts: 36,817
Send a message via ICQ to Osiris Send a message via AIM to Osiris Send a message via MSN to Osiris Send a message via Yahoo to Osiris
Default

did you get the site from the email i sent you?
Osiris is offline  
Old 06-08-2006, 03:54 PM   #10 (permalink)
True Techie
 
Join Date: Feb 2006
Posts: 228
Send a message via ICQ to selina Send a message via Yahoo to selina
Default

ya.
it's great!
thx~~
__________________

selina is offline  
Closed Thread

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off




Copyright 2002- Social Knowledge, LLC All Rights Reserved.

All times are GMT -5. The time now is 12:31 PM.


Powered by vBulletin® Version 3.8.8 Beta 1
Copyright ©2000 - 2017, vBulletin Solutions, Inc.