cache fault

Posted on 2011-10-19
Last Modified: 2012-06-21
Our Exchange 2007 server crashed and now I'm running perfmon on it.

Seeing that Cache Faults/sec on Average are at 700 and Page Faults/sec on average are at 850. Are those normal numbers?

Available MBytes (avg) = 5,773
% Commited Bytes In Use (avg) = 25
% Processor Time (avg) = 2.7

Anything else to look for?
Question by:InfoTechEE
    LVL 10

    Accepted Solution

    This is a normal behaviour, If exchange crashed it must create a dump file in %systemroot%memory.dmp, you can use windows dubbaging utility (free download from microsoft) to analyze the dump file for the possible cause of the crash, also what about the event logs, have you analyzed that.???
    LVL 20

    Expert Comment

    by:Hendrik Wiese
    LVL 12

    Assisted Solution

    In terms of Cache Faults/sec, this relates to how much information has to be fetched from data on disk as opposed to memory. In order to evaluate whether this number is high or low, you will want to monitor Cache Read Hit Ratio to see if it's increasing. As Exchange Server runs, more and more data can be maintained in memory and therefore performance will increase the longer the server runs. All together, these counters will determine how well your RAM is serving the Exchange system.

    Author Comment

    abhijitmdp: I did not find the memory dump, but I did analyze the event logs and it looks like the server ran out of memory. The server has 8GB of Ram but it has a pretty fast processor. The reason I was trying to run perfmon is to see why it crashed. Exchange is suppose to work with what it has. Granted it might be slower, but the Microsoft techblogs say that Exchange can run on even 2GB (I think).
    LVL 10

    Expert Comment

    Yes you are right at all but recommendations are always based on scenarios, it depends number of mailboxes, number oc connections to exchange server etc. if you have 50000+ mailbox user, you can not run an exchange server with only 2 GB of RAM. can you post the logs that you find in event viewer.

    Author Comment

    We have about 50 mailboxes and 8GB.

    The description for Event ID 0 from source .NET Runtime cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

    If the event originated on another computer, the display information had to be saved with the event.

    The following information was included with the event:

    .NET Runtime version : 2.0.50727.4216 - Application ErrorApplication has generated an exception that could not be handled.

    Process ID=0x13d8 (5080), Thread ID=0x1bac (7084).

    Watson report about to be sent to dw20.exe for process id: 4572, with parameters: E12, c-RTL-AMD64, 08.02.0254.000, MSExchangeTransport, M.E.Net, M.E.P.WorkerInstance.OnAsyncReadComplete, S.R.Remoting.RemotingException, 8439, 08.02.0254.000.  ErrorReportingEnabled: False

    Transport Mail Database: The database could not allocate memory. Close some applications to make sure that you have enough memory to run Microsoft Exchange. The exception is Microsoft.Exchange.Isam.IsamOutOfMemoryException: Out of Memory (-1011)
       at Microsoft.Exchange.Isam.?A0x4cb6fe23.HandleError(Int32 err)
       at Microsoft.Exchange.Isam.Interop.MJetCreateInstance(String name)
       at Microsoft.Exchange.Transport.Storage.DataSource.InitInstance().

    A transient failure has occurred. The problem may resolve itself in awhile. The service will retry in 56 seconds. Diagnostic information:

    Cannot open mailbox /o=Barkley Court Reporters/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=GIMLET/cn=Microsoft System Attendant.
    Microsoft.Exchange.Data.Storage.ConnectionFailedTransientException: Cannot open mailbox /o=Barkley Court Reporters/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=GIMLET/cn=Microsoft System Attendant. ---> Microsoft.Mapi.MapiExceptionNetworkError: MapiExceptionNetworkError: Unable to make connection to the server. (hr=0x80040115, ec=-2147221227)

    Unable to prepare message table for polling thread processing on virtual machine GIMLET. The error number is 0x80040115. Make sure that the Microsoft Exchange Information Store service is running.

    Failed to execute request because the App-Domain could not be created. Error: 0x80004005 Unspecified error  

    Process w3wp.exe (EWS) (PID=6268). Exchange Active Directory Provider received a request to connection to domain controller mojito.bcr.local but that domain controller is not available. Use the Ping or PathPing command-line tools to test network connectivity to local domain controllers. Run the Dcdiag command line tool to test domain controller health.

    LVL 10

    Expert Comment

    There was multiple errors occured at the time of system crash, you can not say that only exchange was faulty for that, if you notice, some domain controller was not available, errors with blank database, w3wp.exe was executing and killing a lot of memory, there are many resions for these but the most common is due to a communication gap between ad and your exchange, I would suggest you to setup a performance counter on exchange box for network monitoring, mempry monitoring and check if any process is killing more memory.

    Author Comment

    Any specific counters/monitors, there are so many that I'm not sure which are relevent?

    Under Network Interface:
    Bytes Received/sec, Bytes Sent/sec, Bytes Total/sec, Current Bandwidth, Output Queue Length, Packets Outbound Discarded, Packets Outbound Errors,  Packets Received Discarded, Packets Received Errors, Packets Received/sec, Packets Sent/sec, Packets/sec

    Under Memory:
    % Committed Bytes in Use
    Available Bytes
    Cache Bytes
    Cache Faults/sec
    Commit Limit
    Committed Bytes
    Demand Zero Faults/sec
    Page Reads/sec
    Page Writes/sec
    Pages Input/sec
    Pages Output/sec

    LVL 10

    Expert Comment

    Under memory set for available bytes and if it falls below 90% it should notify the administrator

    Under network, set on Bytes Received/sec and Bytes Sent/sec and also check for anything by which you can setup a counter for ad connectivity failure.

    SCOM is the best product from microsoft to configure  to monitor all connectivity and other alerts also.

    Featured Post

    Why You Should Analyze Threat Actor TTPs

    After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

    Join & Write a Comment

    This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…
    The video tutorial explains the basics of the Exchange server Database Availability groups. The components of this video include: 1. Automatic Failover 2. Failover Clustering 3. Active Manager

    754 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    21 Experts available now in Live!

    Get 1:1 Help Now