Windows 2000 Perflib 1008 application eventlog error log multiple times every second

DennisPost used Ask the Experts™

This question already has been auto-deleted once with no comments.
Please try to help me out.

Recently I had to install .NET framework 2.0 on our Win2K (SP4+) DC for a new custom made service.
After doing so I started encountering application errors in the event logs.
I found a solution for those error, though only ended up replacing it with a new one.
This error is being recorded 2 - 7 times every second!!

Event Type:      Error
Event Source:      Perflib
Event Category:      None
Event ID:      1008
Date:            06/06/2008
Time:            12:32:53
User:            N/A
Computer:      TRAXXSERVER
The Open Procedure for service "PerfDisk" in DLL "C:\WINNT\system32\perfdisk.dll" failed.  Performance data for this service will not be available. Status code  returned is data DWORD 0.
0000: 68 10 00 00               h...    

I found this MS KB which describes it nearly perfectly, only the eventID is different.
After contacting MS they sent me the hotfix.
I installed it and rebooted. Still the errors are streaming in.

I have also run "DiskPerf -N" from the cmd.
Also no change.
How can I see if they really are disabled?

Can anyone give me a hand fixing this?

Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
To prevent the performance counter library (Perflib) from checking counters, you can disable the Extensible Performance Counters library or remove it (this will stop 1008 events in general)

Use the Extensible Counter tool (ExCtrlLst.exe) to disable the Perfctrs.dll performance counters, follow these steps:
1. Start the Exctrlst.exe tool. This tool is in the Microsoft Windows 2000 Resource Kit.  
2. Select the DLL (Perfctrs.dll) that did not open in the Extensible Performance Counters list box.  
3. Click to clear the Performance Counters Enabled check box.  
4. Restart the computer.  
i took these instructions from this semi-related KB

if you want me to take a look at the problem in person contact me through my profile

To verify whether the disk performance counters are actually off, you could use PERFMON.EXE to attempt to add the counter type of LOGICAL DISK.  If you don't have logical disks as a choice, that'd suggest that they are disabled.

Do you have access to the software developers who wrote the "New Custom Made Service"?

Do you know whether that service is attempting to read/write the perfdisk counters?

It might be time to break out with a couple of Sysinternals (MS) tools, FILEMON, REGMON and Process Explorer.

Especially useful here would be REGMON, since performance counters are usually stored in the local machine's registry.  With regmon open, you should see the various attempts by whichever application is attempting to read (and likely failing) the perfdisk counter section of the registry.

If the activity is too fast, you might want to set a filter to capture only registry info that contains a particular string--in this case, perfdisk would be a good one.  This way, you'll only see the registry accesses (or attempts to access) for the disk counters.

The error messages accumulating at several every second should produce a healthy capture of information, but whatever it is, you should be able to identify the process that's making the calls.  The error that you're getting is unfamiliar to me, it's hard to tell if it's indicating that the COUNTERS themselves are bad, or maybe the performance subsystem is not recognizing counters, or if the custom service itself is failing on attempting to access the counters.

Either way, you might want to attempt a repair on the performance counters system.  Here's a great article on Technet about a very useful MS tool, EXCTRLST:

Bob in the NOC


Hi bertlanq,

Thanks for commenting, and so quickly !! :-)

I had tried exctrlst.exe a few times before, but nothing happen. No application opened.
Just tried it again. This time it did open and I am able to disable perfdisk.dll.

I'll reboot the server during lunchtime (+/- 2 hours from now).

I'll follow your filemon, regmon tip while waiting to reboot.
btw, ProcessMonitor is the new combined version of filemon & regmon.

Thanks for your comments guys!!!
Starting with Angular 5

Learn the essential features and functions of the popular JavaScript framework for building mobile, desktop and web applications.

Process Monitor is a nice shiny new tool, but I still prefer Procexplorer for finer details.  I looked at Process Monitor when it was first released and immediately went back to Explorer.  I'm sure they've improved it since then, maybe I'll take another peek.

There were just some things that Monitor DIDN'T do at all that the separate apps do.  Not recalling which things at the moment.



Well here's a reason not to use process monitor, it's not responding, but is still using 50% cpu (System).
I can't close it.
"This program cannot be closed. If it is being debugged, please resume it or close the debugger first."

Any suggestions on how to close it?

btw, could you please tell me what filters I should use?



OK now I'm getting the errors again. :-(

Event Type:      Error
Event Source:      Perflib
Event Category:      None
Event ID:      1008
Date:            14/07/2008
Time:            17:27:08
User:            N/A
Computer:      SERVER
The Open Procedure for service "ASP.NET_2.0.50727" in DLL "C:\WINNT\Microsoft.NET\Framework\v2.0.50727\aspnet_perf.dll" failed.  Performance data for this service will not be available. Status code  returned is data DWORD 0.
0000: 05 40 00 80               .@.€    

I have also used exctrlst.exe to disable these, but have to wait till tomorrow before I can reboot again.
Is this safe?
I would like to get rid of the whole .net framework 2.0 if possible. Recently I delete all the update
uninstall folders in the windows folder as I had nearly no more space left.
Can I still uninstall it via Add/Remove Programs?



Thanks guys!

I don't know why ExCtrlLst.exe didn't open properly before, but this time it did and it was easy
to disable these troublesome dlls.

The ASP.NET errors seem to have disapeared as well by using ExCtrlLst.exe.

Thanks :-)

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial