Windows 2000 Perflib 1008 application eventlog error log multiple times every second

Hi,

This question already has been auto-deleted once with no comments.
Please try to help me out.

Recently I had to install .NET framework 2.0 on our Win2K (SP4+) DC for a new custom made service.
After doing so I started encountering application errors in the event logs.
I found a solution for those error, though only ended up replacing it with a new one.
This error is being recorded 2 - 7 times every second!!

Event Type:      Error
Event Source:      Perflib
Event Category:      None
Event ID:      1008
Date:            06/06/2008
Time:            12:32:53
User:            N/A
Computer:      TRAXXSERVER
Description:
The Open Procedure for service "PerfDisk" in DLL "C:\WINNT\system32\perfdisk.dll" failed.  Performance data for this service will not be available. Status code  returned is data DWORD 0.
Data:
0000: 68 10 00 00               h...    

I found this MS KB which describes it nearly perfectly, only the eventID is different.
After contacting MS they sent me the hotfix.
I installed it and rebooted. Still the errors are streaming in.

I have also run "DiskPerf -N" from the cmd.
Also no change.
How can I see if they really are disabled?

Can anyone give me a hand fixing this?

Thanks
LVL 2
DennisPostAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

bertlanqCommented:
To prevent the performance counter library (Perflib) from checking counters, you can disable the Extensible Performance Counters library or remove it (this will stop 1008 events in general)

Use the Extensible Counter tool (ExCtrlLst.exe) to disable the Perfctrs.dll performance counters, follow these steps:
1. Start the Exctrlst.exe tool. This tool is in the Microsoft Windows 2000 Resource Kit.  
2. Select the DLL (Perfctrs.dll) that did not open in the Extensible Performance Counters list box.  
3. Click to clear the Performance Counters Enabled check box.  
4. Restart the computer.  
 
i took these instructions from this semi-related KB
http://support.microsoft.com/?kbid=828872

if you want me to take a look at the problem in person contact me through my profile

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
BobintheNocCommented:
To verify whether the disk performance counters are actually off, you could use PERFMON.EXE to attempt to add the counter type of LOGICAL DISK.  If you don't have logical disks as a choice, that'd suggest that they are disabled.

Do you have access to the software developers who wrote the "New Custom Made Service"?

Do you know whether that service is attempting to read/write the perfdisk counters?

It might be time to break out with a couple of Sysinternals (MS) tools, FILEMON, REGMON and Process Explorer.

Especially useful here would be REGMON, since performance counters are usually stored in the local machine's registry.  With regmon open, you should see the various attempts by whichever application is attempting to read (and likely failing) the perfdisk counter section of the registry.

If the activity is too fast, you might want to set a filter to capture only registry info that contains a particular string--in this case, perfdisk would be a good one.  This way, you'll only see the registry accesses (or attempts to access) for the disk counters.

The error messages accumulating at several every second should produce a healthy capture of information, but whatever it is, you should be able to identify the process that's making the calls.  The error that you're getting is unfamiliar to me, it's hard to tell if it's indicating that the COUNTERS themselves are bad, or maybe the performance subsystem is not recognizing counters, or if the custom service itself is failing on attempting to access the counters.

Either way, you might want to attempt a repair on the performance counters system.  Here's a great article on Technet about a very useful MS tool, EXCTRLST:

http://technet2.microsoft.com/windowsserver/en/library/48edd368-2bde-4647-9fea-1b5f28a23ca91033.mspx?mfr=true

Bob in the NOC
DennisPostAuthor Commented:
Hi bertlanq,

Thanks for commenting, and so quickly !! :-)

I had tried exctrlst.exe a few times before, but nothing happen. No application opened.
Just tried it again. This time it did open and I am able to disable perfdisk.dll.

I'll reboot the server during lunchtime (+/- 2 hours from now).

Bobinthenoc,
I'll follow your filemon, regmon tip while waiting to reboot.
btw, ProcessMonitor is the new combined version of filemon & regmon.

Thanks for your comments guys!!!
Get a highly available system for cyber protection

The Acronis SDI Appliance is a new plug-n-play solution with pre-configured Acronis Software-Defined Infrastructure software that gives service providers and enterprises ready access to a fault-tolerant system, which combines universal storage and high-performance virtualization.

BobintheNocCommented:
Process Monitor is a nice shiny new tool, but I still prefer Procexplorer for finer details.  I looked at Process Monitor when it was first released and immediately went back to Explorer.  I'm sure they've improved it since then, maybe I'll take another peek.

There were just some things that Monitor DIDN'T do at all that the separate apps do.  Not recalling which things at the moment.

Bob
DennisPostAuthor Commented:
Well here's a reason not to use process monitor, it's not responding, but is still using 50% cpu (System).
I can't close it.
"This program cannot be closed. If it is being debugged, please resume it or close the debugger first."

Any suggestions on how to close it?

btw, could you please tell me what filters I should use?

Thanks
DennisPostAuthor Commented:
OK now I'm getting the asp.net errors again. :-(

Event Type:      Error
Event Source:      Perflib
Event Category:      None
Event ID:      1008
Date:            14/07/2008
Time:            17:27:08
User:            N/A
Computer:      SERVER
Description:
The Open Procedure for service "ASP.NET_2.0.50727" in DLL "C:\WINNT\Microsoft.NET\Framework\v2.0.50727\aspnet_perf.dll" failed.  Performance data for this service will not be available. Status code  returned is data DWORD 0.
Data:
0000: 05 40 00 80               .@.€    

I have also used exctrlst.exe to disable these, but have to wait till tomorrow before I can reboot again.
Is this safe?
I would like to get rid of the whole .net framework 2.0 if possible. Recently I delete all the update
uninstall folders in the windows folder as I had nearly no more space left.
Can I still uninstall it via Add/Remove Programs?

Thanks



DennisPostAuthor Commented:
Thanks guys!

I don't know why ExCtrlLst.exe didn't open properly before, but this time it did and it was easy
to disable these troublesome dlls.

The ASP.NET errors seem to have disapeared as well by using ExCtrlLst.exe.

Thanks :-)
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Server OS

From novice to tech pro — start learning today.