Virtual memory is fragmented

[This topic is intended to address a specific issue called out by the Exchange Server Analyzer Tool. You should apply it only to systems that have had the Exchange Server Analyzer Tool run against them and are experiencing that specific issue. The Exchange Server Analyzer Tool, available as a free download, remotely collects configuration data from each server in the topology and automatically analyzes the data. The resulting report details important configuration issues, potential problems, and nondefault product settings. By following these recommendations, you can achieve better performance, scalability, reliability, and uptime. For more information about the tool or to download the latest versions, see "Microsoft Exchange Analyzers" at]  

Topic Last Modified: 2007-02-15

The Microsoft Exchange Analyzer Tool queries the Win32_NTLogEvent Microsoft Windows Management Instrumentation (WMI) class to determine whether an Event 9582 error has been logged for MSExchangeIS within the last 24 hours.

If the Exchange Analyzer finds that an Event 9582 has been logged in the past 24 hours, the Exchange Analyzer displays an error.

This error indicates that the virtual memory that is required to run the Exchange server is fragmented.

In 32-bit Microsoft Windows systems, there are two kinds of memory:

  • Physical memory   Amount of actual memory installed in the system

  • Virtual memory address space   A virtualized 4-GB memory space

Regardless of how much physical memory is installed on the system, the total size of the virtual address space is always the same: 4 GB. Although it is not the case for all 32-bit applications, for Exchange Server, virtual address space equals virtual memory. The terms are used interchangeably.

During the normal course of its operations, the Exchange store will repeatedly allocate, use, and deallocate virtual memory. When virtual memory is allocated, used, and deallocated frequently, virtual memory fragmentation can result. Virtual memory fragmentation is similar to file system fragmentation that can occur over time. After a while, allocated segments of virtual memory are no longer contiguous, and performance begins to suffer. In the file system, you can run an application that performs defragmentation of the file system. In most cases, defragmentation of the file system can be done while the system is online and being accessed. With virtual memory fragmentation, there is no defragmentation tool. Instead, to correct the problem, you must stop and start the Microsoft Exchange Information Store service or restart the system.

To address this issue:

  • Virtual memory fragmentation can be caused by third-party software running in the store/inetinfo processes. Make sure that you have the latest drivers for any third-party applications.

  • Use the Performance Logs and Alerts tool to monitor the VM Total Large Free Block Bytes counter for the MSExchangeIS performance object. Use the data collect from this counter to determine the best window, within the next 36 to 72 hours, to shut down and then restart the server.


If this is a clustered server, stop and restart the passive node before you move cluster resources to it to make sure that the target virtual memory address space is clean.

  • If the problem is reproduced after restarting, consider disabling third-party software.

  • Consider moving user mailboxes to another server to reduce server load and see whether the problem stops. For more information, see Move User Mailboxes to Another Server.

For More Information