Performance monitor counter failure messages repeatedly appear in Windows event log.

(Last modified: 23Jan2004)

This document (10090593) is provided subject to the disclaimer at the end of this document.

fact

Novell ZENworks for Servers 3.0 - ZfS 3.0

Novell ZENworks for Servers 3.0.2

symptom

Performance monitor counter failure message repeatedly appear in Windows event log.

After installing Server Management Agent for Windows, lot of performance monitor counter failure message repeatedly may be logged into Windows event log (events with event ids 1008, 1009, 2001, 2002).

An example event could be "The Open Procedure for service "RemoteAccess" in DLL "C:\WINNT\System32\rasctrs.dll" failed. Performance data for this service will not be available. Status code returned is data DWORD 0."

cause

Trending Agent (NTTREND) of Server Management Agent uses Performance counters to get performance data. When using performance counters to collect data, Performance Monitor checks the availability of all counters listed in the registry. So either a service is installed but its performance counters are disabled or performance counters are enabled and service is disabled, these events are logged into Windows Event log.

Refer to following links for more information.

http://support.microsoft.com/default.aspx?kbid=178887  [no longer available]

http://www.jsiinc.com/SUBM/tip6200/rh6218.htm  [no longer available]

http://support.microsoft.com/default.aspx?kbid=811066  [no longer available]

http://support.microsoft.com/default.aspx?scid=kb;EN-US;226494  [no longer available]

http://www.eventid.net/display.asp?eventid=1008&eventno=70  [no longer available]

fix

1. Apply latest service pack for the specific windows platform.

2. Note down the performance counter events you are repeatedly getting in Windows Event Log.

2. For Windows 2000 and onwards download exctrlst_setup.exe

http://www.microsoft.com/windows2000/techinfo/reskit/tools/existing/exctrlst-o.asp

and for NT download resource kit which contains exctrlst.exe

http://www.microsoft.com/ntserver/nts/downloads/recommended/ntkit/default.asp

3. Install the exctrlst_setup.exe incase of Windows2000 or resource kit incase of NT .

4. Now run exctrlst.exe tool from the installed directory.

5. For each event do the following.

For example if an event looks like

"The Open Procedure for service "RemoteAccess" in DLL "C:\WINNT\System32\rasctrs.dll" failed. Performance data for this service will not be available. Status code returned is data DWORD 0."

then, this means RAS is installed but might have disabled. But performance counters are enabled. So the solution is to enable the RAS service to function correctly or disable the performance counters using exctrlst.exe utility. Select service in exctrlst window and select the option "Remote Access" and uncheck the "Performance Counters Enabled" check box.

For example if an event looks like "The Collect Procedure for the "Tcpip" service in DLL "C:\WINNT\system32\Perfctrs.dll" generated an exception or returned an invalid status."

then mostly performance counters for this tcpip service might have been disabled. So enable the performance counters using exctrlst.exe utility. Select service in exctrlst window and select the option "Tcpip" and check the "Performance Counters Enabled" check box.

6. Shutdown and restart the machine.

document

Document Title:	Performance monitor counter failure messages repeatedly appear in Windows event log.
Document ID:	10090593
Solution ID:	NOVL95016
Creation Date:	23Jan2004
Modified Date:	23Jan2004
Novell Product Class:	management products

disclaimer

The Origin of this information may be internal or external to Novell. Novell makes all reasonable efforts to verify this information. However, the information provided in this document is for your information only. Novell makes no explicit or implied claims to the validity of this information.
Any trademarks referenced in this document are the property of their respective owners. Consult your product manuals for complete trademark information.