rhianne
asked on
Event Viewer Perflib Errors
Recently, I have installed Inoculan anti-virus software on one of my exchange servers. After that installation, i keep getting numerous errors (every ten minutes) as follows:
The Collect Procedure for the "MSExchangeMTA" service in DLL "C:\EXCHSRVR\bin\mtaperf.d ll" generated an exception or returned an invalid status. Performance data returned by counter DLL will be not be returned in Perf Data Block. Exception or status code returned is DWORD 0.
I have searched Microsoft Technet but failed to find anything. Can someone shed any light on this?
The Collect Procedure for the "MSExchangeMTA" service in DLL "C:\EXCHSRVR\bin\mtaperf.d
I have searched Microsoft Technet but failed to find anything. Can someone shed any light on this?
ASKER
Hi Henning,
Details as follows:
Event ID : 1010
Source : Perflib
Type : Error
Category : None
Data : 0000: 05 00 00 c0 ...A
I am running Exchange 5.5 with SP4.
Operating System : Windows NT 4 Server 4.0 with SP6a.
The errors came out every ten minutes are I installed Inoculan Anti-Virus.
Any ideas?
-Rhi
Details as follows:
Event ID : 1010
Source : Perflib
Type : Error
Category : None
Data : 0000: 05 00 00 c0 ...A
I am running Exchange 5.5 with SP4.
Operating System : Windows NT 4 Server 4.0 with SP6a.
The errors came out every ten minutes are I installed Inoculan Anti-Virus.
Any ideas?
-Rhi
I forgot what SP does the exchange server use?
Henning
Henning
ASKER
Hi! I have included the details for you. ;-)
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Hi,
I have seen a similar problem with Tivoli Storage Manager (TSM) Client software. The problem does not originate on the Operating system, it originates from faulty software. The solution for TSM was to remove the registry keys for the event reporting, but its not a good idea with Anti Virus software. Try searching for a solution on the Cheyenne website http://supportsearch.ca.com/query.html and they will probably assist you because you purchased (hopefully) their software.
Squimp
I have seen a similar problem with Tivoli Storage Manager (TSM) Client software. The problem does not originate on the Operating system, it originates from faulty software. The solution for TSM was to remove the registry keys for the event reporting, but its not a good idea with Anti Virus software. Try searching for a solution on the Cheyenne website http://supportsearch.ca.com/query.html and they will probably assist you because you purchased (hopefully) their software.
Squimp
Source : perflib
Type : Error
Description :
-----------
The Collect Procedure for the (service name) service in DLL (DLL name) generated an exception or returned an invalid status. Performance data returned by counter DLL will not be returned in Perf Data Block. Exception or status code returned is DWORD 0.
Comments:
---------
This event can occur when an application was uninstalled but references to its performance counters remained. Also, improper registration of the counters dll may have the same effect as well as corrupted dlls..
Suggestions from newsgroups:"First, make sure the dll file exists, and exist in the proper locations. Once you've confirmed the location of the DLL, type REGSVR32 /U to unregister the DLL, then drop the /U and run it again to re-register the DLL in its current location. When you unregister the DLL, use the path from the Event Viewer. When you register it, use the path of the file in its current location. That should work."
Another newsgroup post provided a way to stop this error from occuring by removing the references to these performance counters from the registry: "Goto: HKEY_LOCAL_MACHINE\System\ ControlSet 001\Servic es and find the mentioned service(s). There should be a sub-key called "Performance" and in it should be the offending DLL under 'Library'. I find by just clearing out this key, it stops the messages."
More info : Q226494
My source : www.eventid.net (search for event 1010)
Take Care,
F
Type : Error
Description :
-----------
The Collect Procedure for the (service name) service in DLL (DLL name) generated an exception or returned an invalid status. Performance data returned by counter DLL will not be returned in Perf Data Block. Exception or status code returned is DWORD 0.
Comments:
---------
This event can occur when an application was uninstalled but references to its performance counters remained. Also, improper registration of the counters dll may have the same effect as well as corrupted dlls..
Suggestions from newsgroups:"First, make sure the dll file exists, and exist in the proper locations. Once you've confirmed the location of the DLL, type REGSVR32 /U to unregister the DLL, then drop the /U and run it again to re-register the DLL in its current location. When you unregister the DLL, use the path from the Event Viewer. When you register it, use the path of the file in its current location. That should work."
Another newsgroup post provided a way to stop this error from occuring by removing the references to these performance counters from the registry: "Goto: HKEY_LOCAL_MACHINE\System\
More info : Q226494
My source : www.eventid.net (search for event 1010)
Take Care,
F
Sorry for the typo it is as Forenzixbe suggest the article Q226494 that holds interest. I would do as Squimperooo suggest and contact the software company (if it doesn't help to reaply the servicepack 4 for exchange), MS also suggest that. And the error is probably an access violation that are easily dealt with.
I wouldn't start messing around in the registry just to stop the message from apearing unless I was 120% certain that it wouldn't harm anything else. And working as a system consultant in a software company I also know the default reaction when a customer has been tinkering somewhere they shouldn't; "Its gonna cost you stupid....." They have messed up so let them cleanup again.
Henning
I wouldn't start messing around in the registry just to stop the message from apearing unless I was 120% certain that it wouldn't harm anything else. And working as a system consultant in a software company I also know the default reaction when a customer has been tinkering somewhere they shouldn't; "Its gonna cost you stupid....." They have messed up so let them cleanup again.
Henning
ASKER
Thank you very much for all your valuable inputs!!
I decided not to mess around with the registry (since it is a production server) but tried the unregistering/re-registeri ng of the DLL file. That didn't work. I got the following error:
"mtaperf.dll was loaded, but DLLunregisterServer entry point was not found.
DllUnregisterServer may not be exported, or a corrupt version of mtaperf.dll may be in memory. Consider using Pview to detect and remove it."
Tried Pview to detect it but not found to remove it. Strange! Any advise on this?
Since we are not running Inoculan anti-virus on a full scale yet (due some issues with other servers in the network), I have decided to uninstall it. After the uninstallation, the errors on the Event Viewer are not piling up. Except a few (three to be exact since the reboot) with the following:
The instance length of an object returned by Extensible Counter DLL "C:\EXCHSRVR\bin\mtaperf.d ll" for the "MSExchangeMTA" service was incorrect. The sum of the instance lengths plus the object definition structures did not match the size of the object. Performance data returned by counter DLL will be not be returned in Perf Data Block. The object title index of the bad object is data DWORD 0.
I have checked eventid.net but there isn't any answer on that one. The event ID is : 1004, Source : Perflib. Do you guys have any ideas what the above error means?
Thanks again!
I decided not to mess around with the registry (since it is a production server) but tried the unregistering/re-registeri
"mtaperf.dll was loaded, but DLLunregisterServer entry point was not found.
DllUnregisterServer may not be exported, or a corrupt version of mtaperf.dll may be in memory. Consider using Pview to detect and remove it."
Tried Pview to detect it but not found to remove it. Strange! Any advise on this?
Since we are not running Inoculan anti-virus on a full scale yet (due some issues with other servers in the network), I have decided to uninstall it. After the uninstallation, the errors on the Event Viewer are not piling up. Except a few (three to be exact since the reboot) with the following:
The instance length of an object returned by Extensible Counter DLL "C:\EXCHSRVR\bin\mtaperf.d
I have checked eventid.net but there isn't any answer on that one. The event ID is : 1004, Source : Perflib. Do you guys have any ideas what the above error means?
Thanks again!
Hi rhianne,
Try (re)installing last Service Pack for Exchange ?
Longbow.
Try (re)installing last Service Pack for Exchange ?
Longbow.
ASKER
Excellent Job to all of you who has contributed to this question! I've learnt so much!! Thank you!
Do you have an event ID?
Is it exchange 5.5?
What OS do you run and SP?
Henning