How to gather data to troubleshoot Exchange virtual memory issues

This article provides information about different types of data gathering that may help you to diagnose virtual memory issues on Microsoft Exchange Server. To determine the root cause of the behavior described later in this section, you must gather data for analysis.

Virtual memory fragmentation occurs when the size and number of the contiguous blocks of available memory reaches a certain threshold. This behavior can adversely affect the performance of an Exchange Server and may prevent databases from mounting. For example, to mount a database requires a 10-megabyte (MB) block of contiguous virtual memory. If virtual memory is fragmented in such a way that the free virtual memory block sizes are at or below 10 MBs, the databases cannot be mounted without restarting the server.

Note On a Microsoft Exchange 2000 Server computer or on a Microsoft Exchange Server 2003 computer, the Store process is the most memory-intensive process. For more information about how Exchange 2000 Server allocates and uses memory, click the following article number to view the article in the Microsoft Knowledge Base:

Several tools are useful to troubleshoot virtual memory behaviors; the following is a list of the tools to use:

Note To gather the data, we recommend that you use the tools together to collect corresponding data simultaneously from the server, if this procedure is possible.

• System Monitor logs (also known as Performance Monitor logs)
• Event logs
• System Information file (WINMSD)
• Virtual Address Dump file
• Userdump.exe file

System Monitor Logs

The System Monitor tool that is included with Microsoft Windows 2000 is the administrative tool that replaces the Performance Monitor tool that is included with Microsoft Windows NT 4.0. A general guideline is to use System Monitor to create logs of the server performance when it is operating typically so that you can use these logs as a baseline to compare to the logs generated when the server has problems.

When you use System Monitor to troubleshoot virtual memory issues, it is important to gather performance data for a long enough period of time. This requires that you gather multiple logs over a period of hours or even days. If you save the logs periodically, this procedure makes sure that the size of the logs remains manageable.

There are a number of objects that you can add to the System Monitor log to track the memory usage on the Exchange server. Add all of the counters, for each of the following objects:

System Performance Objects

• Cache
• Database
• Memory
• Objects
• Paging file
• Process
• Processor
• System
• Threads
• PhysicalDisk

Exchange-specific Performance Objects

• MSExchangeIS
  
  NOTE: If you suspect that other Exchange Server components are the cause of virtual memory fragmentation, add the appropriate objects and their counters.

For more information about how to configure System Monitor, click the following article numbers to view the articles in the Microsoft Knowledge Base:

Event Logs

The Event Viewer provides the Application logs and System logs. The Event logs capture the activity for the same time period as the System Monitor logs. The Event logs provide a quick reference to activities that are occurring on the server and the Event logs indicate possible errors.

Virtual memory warnings or errors are generally logged in the Application log as an event ID 9582. This event ID can be either a warning or an error.

When the server reaches less than 32 MBs of contiguous virtual address space, the following warning event is logged: When the server reaches less than 16 MBs of contiguous virtual address space, this same event ID 9582 message is logged, but it is logged as an error message:

System Information File

A System Information report provides information about the server's configuration. To generate a System Information file:

1. Click Start, click Run, type WINMSD, and then click OK.
2. In the System Information window, right-click the System Information object, and then click Save as System Information File.
3. Type a file name, and then click Save.
   
   NOTE: The System Information file is saved with an .nfo extension.

Virtual Address Dump Utility

The Virtual Address Dump utility (Vadump.exe) is a utility that creates a report that contains information about the memory usage of a specified process. The list includes:

1. Each address and its size, state, protection, and type.
2. Total committed memory for the image, the .exe file, and each .dll file, which includes system .dll files.
3. Total mapped-committed memory, private-committed memory, and reserved memory.
4. Information about the working set and about paged and non-paged pool usage.

To capture information about the memory usage of Exchange Server's Store process, install the Vadump.exe file, and then at a command prompt run the following command: NOTE: The "storePID" in the command is the Store process ID. You can locate the process ID in Task Manager.

The Vadump.exe file is included in the Windows Server 2003 Resource Kit. Additionally, this utility is available for download. To download this utility, visit the following Microsoft Web sites.

Windows Server 2003

Userdump.exe Utility

Userdump.exe is a utility that you can use to generate a dump file to capture the state of a process. The information captured can include exceptions, call stack information and thread activity. To use Userdump.exe to troubleshoot Exchange Server virtual memory issues, run the Userdump.exe file when the symptoms cause adverse effects on the server's performance or when the server does not respond.

NOTE: Running Userdump.exe does not end the Store process. However, it can provide data that is very useful to determine the root cause of an issue.

To generate the dump file of the Exchange Server's Store process, install Userdump.exe, and then at a command prompt run the following command:NOTE: The "storePID" in this command is the Store process ID. You can locate the process ID in Task Manager. The dump file that results is located in the folder in which the command is run and is named Store.dmp. Make sure that the drive where the Store.dmp file is to be generated contains available space that is equal to, or larger than the memory installed on the server.

UserDump and its documentation are part of the OEM Support Tools package. A copy may be obtained at following Microsoft Web site: For more information about the use of Userdump.exe, click the following article numbers to view the articles in the Microsoft Knowledge Base: