Error Recored on Windows 2003 DC Application Log

Posted on 2010-11-08
Last Modified: 2012-05-10
Please see hte following log entry

Any help is appreciated

Event Type:      Error
Event Source:      Perflib
Event Category:      None
Event ID:      1008
Date:            11/5/2010
Time:            10:37:44 AM
User:            N/A
Computer:      SRV2CTS
The Open Procedure for service "IAS" in DLL "C:\WINNT\System32\iasperf.dll" failed. Performance data for this service will not be available. The Status code returned is the first DWORD in the attached data.

For more information, see Help and Support Center at
0000: 02 00 00 00               ....    

Question by:ProtechCT
  • 2

Expert Comment

ID: 34085188
That file is used in Windows Performance monitoring.

Check this link out for possible fixes:

Author Comment

ID: 34086018
Unfortunatly you link does not help me as that is a paid service  Anytime i click a link with-in it wants me to subscribe.

Has anybody else had this issue?

Accepted Solution

ThaVWMan earned 500 total points
ID: 34086263
I am not a subscriber to that site, and I am able to see information....

Here is a copy of the text...

 Adrian Grigorof
This event may occur for various applications. When the performance monitor reads all counters for the first time, the extension's Open Procedure is called. A typical task for the Open procedure is to read what range of object indexes it supports from the registry. These index values are stored in the First Counter, First Help, Last Counter, and Last Help registry values under the application's performance key. If this Open procedure fails to read the data (i.e. those entries don’t exist or have been deleted by an uninstall procedure) the 1008 event is recorded in the event log (see M247226 for more details). See M247226 on how to fully install the Performance Monitor Extentions

In order to remove such orphaned entries typically one has to follow these steps:
Start Registry Editor (Regedt32.exe or Regedit.exe)and go to the following subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<service name>:\Performance
Delete the value " Open ."
Restart your computer for this change to take effect.

If you do not need the performance counters for the service mentioned in the event you can disabled them using the exctrlst.exe tool (Extensible Performance Counter List) - see the link below in the links section for the download location.

UPS - apcctrs.dll - The UPS Service with PowerChoute software. See the explanation for event ID 2000 from "appctrs" source

pcAnywhere - PcaPerfCtrs.dll - See the link to pcAnywhere Knowledge base.

Mihai Andrei
- Service: ASP.NET, dll: aspnet_perf.dll - See M944746 for a hotfix applicable to Microsoft .NET Framework 1.0.
- Service: ESE, dll: eseperf.dll - Microsoft article M273177 may help.
- Service: MSDTC, dll: msdtcui.dll - See M282293.
- Service: AppleTalk, dll: atkctrs.dll - See M924208 and "Citrix Support Document ID: CTX214884".
- Service: NwlnkNb, dll: perfctrs.dll - From a newsgroup post: "Open the SBS Admin console and then expand the following: Health Monitor -> All Monitored Computers -> Server -> Health Monitor Sample Monitors -> Windows 2000 Performance Monitors and then open up the appropriate file and stop the Performance Monitor that is running. You can also do this in the registry by deleting all of the Perfmons. I believe the M226494 article will help you do this".

- Service: PSched, dll: pschdprf.dll - This problem occurs because the system removes the Pschdprf.dll file but does not remove some registry values when the QoS Packet Scheduler is removed. See M942393 for a solution.

Ionut Marin
- Service: MSExchangeDSAccess, dll: dscperf.dll - See M307613.
- Service: MSSQLServerOLAPService, dll: msmdctr80.dll - See M296147.
- Service: MSExchangeDS, dll: perfdsa.dll -  See M174690.
- Service: MSExchangeIMC, dll: gwperf.dll - See M163727.
- Service: MSExchangeIMC, dll: imsperf.dll - See M256927.
- Service: w3pcache, dll: Mspmon.dll - See M159001 and M176696.
- Service: w3proxy, dll: Mspmon.dll - See M159001 and M176696.
- Service: wspsrv, dll: Mspmon.dll - See M176696.
- Service: WSPSrv, dll: WSPPERF.DLL - See M159001.
- Service: notestat, dll: nnotes.dll - See M287264.
- Service: PerfDisk, dll: perfdisk.dll - See M811066.
- Service: BTSSvc, dll: CISPERF.dll - See M812477.
- Service: RemoteAccess, dll: rasctrs.dll - See M830459 and M835446.
- Service: Nbf, dll: Perfctrs.dll - See M828872.
- Service: McShield - See "Network Associates Support Solution ID: nai15090", "Network Associates Support Solution ID: nai6288", and "Network Associates Support Solution ID: nai19416".
- Service: AvExchange - Search for "Solution ID: 1.0.14526446.2706559", "Solution ID: nai26839", and "Solution ID: nai26840" on the "Network Associates Support" page.
- Service: MSMQ, dll: MQPERF.DLL - See M267316.

See "Small Business Server Setup Troubleshooting" for additional information on this event.

Curtis Hays
- Service: ASP.NET_2.0.50727 - I installed the Extensible Performance Counter List tool from Microsoft, and I disabled the performance counters for "ASP.NET_2.0.50727".
 x 4

Why bother deciphering Event logs when GFI EventsManager can do everything for you? Free trial here!

- Service: McShield, dll: dssdata.dll - See "Network Associates Support Solution ID: nai19304".

Dag Staale Jenssen
In my case, I had EventID 2003 from source Perflib occurring three times with w3ctrs.dll, infoctrs.dll, and aspperf.dll. The events appeared at every boot of my SBS 2000 SP4 box. I found M267831 and decided to run the commands stated in the article. On reboot, my event log was filling up with EventID 1001 from source IISInfoCtrs and EventID 1008 from source Perflib, the last one referring to a failure of the open procedure for service infoctrs.dll. I came to think of the Health Monitor service that it is constantly monitoring performance counters on the box. It must be hard for the system to remove and reinstall performance counter on the same time as they are monitored. I therefore disabled the Health Monitor service. This stopped the events from reappearing in the event log. I then ran the commands all over (M267831), giving the system some time to execute and fix the individual commands. Health Monitor was then restarted and it was reporting that the system was OK. The errors had stopped reappearing in the log and they did not return upon reboot.

Anne Jan Elsinga
I’ve seen this event a lot when using Big Brother monitoring software on Windows NT4 SP6 servers. As stated in the readme file from Big Brother, you can suppress error messages from performance counters by entering EventLogLevel into the registry (see M226494). This did the trick for me.

This began appearing after disabling diskperf using the command line "diskperf -n", which was a recommended solution for "EventID 2001 from source PerfDisk". After I ran "diskperf -y" and rebooted the system both errors stopped appearing. See the link to "EventID 2001 from source PerfDisk" for details on the diskperf command.

M. Schioldan
I had one bad or defective extensible performance DLL that rendered the performance monitoring features of the operating system inoperative. I was able to alleviate this problem by using the ExCtrLst tool. See the links to “ - Perf” and “Exctrlst.exe: Extensible Performance Counter List” for details on this tool.

Woodrow Wayne Collins
M226494 describes how to control the error checking and reporting by registry settings and list the possible event information. This is useful for testing and validating a Performance Monitor Extension. This is also helpful to diagnose problems with performance monitor extensions that are installed as part of a vendor's server application or device driver.
"Tcpip" - Perfctrs.dll - See M186713.
"ISAPIsearch" - QPerf.dll - See M228747.
"ContentIndex" - QPerf.dll - See M228747.

- Data: 00001068 = 4200 decimal = ERROR_WMI_GUID_NOT_FOUND - The GUID passed was not recognized as valid by a WMI data provider. (net helpmsg 4200) - See M307331 for details on this error code.

Steve Crumbaugh
Service: "ISAPISearch", dll: "C:\W2KS\System32\query.dll" is usually due an NNTP installation failure. "C:\W2KS\system32\perfwci.ini" is corrupt (file size = 0) on Cisco's install CD. This file sets registry entries for the "ISAPISearch" service during the NNTP installation. Since the file is corrupted, the registry will contain incorrect information after NNTP installation. Follow these steps to replace the corrupted "perfwci.ini" file:
1. Download the "perfwci.ini" file.
2. On the Unity SPE, open Windows Explorer.
3. Browse to locate the downloaded "perfwci.ini" file.
4. Copy the downloaded "perfwci.ini" to the "C:\W2KS\system32\" directory to replace the corrupted "perfwci.ini" file.
5. Click Start > Run, enter "cmd", and click OK to open a command window.
6. Enter "cd %windir%\system32", and press Enter.
7. Enter "unlodctr perfwci.ini", and press Enter.
8. Enter "lodctr perfwci.ini", and press Enter.
9. Enter "exit", and close the command window.
This will reset the registry settings and get rid of those annoying errors in the event log. See the link to Cisco Website for the "perfwci.ini" file.

ESE, eseperf.dll - This is due to a damaged registry setting that causes Exchange 2000 setup to believe that the counters for the database engine are already installed. I found it best that you replace the eseperf.dll, eseperf.hxx, and eseperf.ini in the <path> exchsrvr\bin dir. Then run lodctr eseperf.ini from the bin directory. This fixed the problem for me.

Terry Brady
Nbf - perfctrs.dll. This error appeared every 3 seconds on SBS2000 after I updated the Intel network software from the MS Update site. The update apparently "unsynched" things because un- and re-installing the Netbeui protocol solved the problem.

Why bother deciphering Event logs when GFI EventsManager can do everything for you? Free trial here!

Kris Van Dijck
AVExch32Service, GSPerf.dll - AVExch32Service is part of McAfee GroupShield for Exchange (GSE). You may try to remove and reinstall.

Thomas Dorn
Just replace the mentioned file(s) i*.dll in system32 directory with the correct versions (copy from a servicepack or a different comparable system). It worked in my case.

Jason S. Rundle
"RemoteAccess" - rasctrs.dll - See M811089.

Brad Pears
"Nwlnknb" - perfctrs.dll - To remedy this situation, I simply went into my network settings and enabled both the NWLink NetBIOS protocol and the NWLink IPX/SPX/Netbios compatible Transport Portocol. As soon as this was completed, no more #1008 errors were being logged. Then, I went back in and disabled both protocols and everything was good.

Adrian Florin Moisei
"FileReplicaSet" - "NTFRSPRF.dll". As per Microsoft the error was fixed in Windows 2000 Service Pack 3. See M324939.

"ContentFilter" - "Qperf.dll". For Small Business Server 4.5 as per Microsoft this event does not cause problems. See M228747. It occurs when Performance Monitor counters are not properly implemented for Indexing Service. The  solution is to reinstall IIS 4.0 Performance Monitor Counters. See M226512 for details.

"ODBC" - "ODBC32.DLL". This event is followed by event id: 0 with source ODBC. From a newsgroup post: The following steps can help:
1. Backup HKLM\SYSTEM\CurrentControlSet\Services\ODBC.
2. Delete HKLM\SYSTEM\CurrentControlSet\Services\ODBC\Performance
3. Re-enable the ODBC performance counters through 'Data Sources (ODBC)' applet under the Administrative Tools. For details see M216950.

"Nbf" - "perfctrs.dll". "Nbf" means "NetBIOS Frame protocol" and relates to Netbeui (NetBios Enhanced User Interface). Removing Netbeui can solve the problem. However Netbeui is very fast for small LAN communications and removing it can decrease the network performance.

Jason Chai-Onn
I had this error with DNS and NTFRS after promoting a member server to a DC. This turned out to be directly related some software that we use called ITO and ERMS. Basically, ERMS monitors services and performance counters and based on a configuration file, it will generate alerts that ITO forwards to a paging service we have. When these were running, the c:\winnt\system32\perfc009.dat file was locked. According to Microsoft, in a system that will not experience these problems, this file will not be locked. After stopping the services associated with my offending application, I tried to rename this file and was successful. I then renamed it back to the original name and tried to re-register the performance counters and sure enough, it worked. I know that not everyone will be running ITO and ERMS, but if you have an application that interfaces with the performance counters such as ERMS, this could work for you to. That file being locked would be a dead giveaway.

Connie Taylor
Adding the following dword in the registry solved my problem: KEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<service name>\Performance\Disable Performance Counters - with a value of 0x1. This will disable the performance counters for that service (replace <service name> with the service that generates the errors. Of course, this won't help if you need the performance counters!

Craig Macdonald
It is not necessary to restart the machine for the changes to take effect: restarting the remote registry service is sufficient.

Robert M
McShield - dssdata.dll - You may recieve an error in event viewer about Mcaffe's Perfmon Counter's under NT4 Terminal server. To fix, research the following SolutionID: nai6288 under Mcaffe's web site.

Why bother deciphering Event logs when GFI EventsManager can do everything for you? Free trial here!

Victor Maynard
SiteScope - I had a similar trouble on an NT4/SP6 machine using SiteScope as monitoring tool; the matter was that the SiteScope user used for checking was not a member of the local administrators group and so it has not full control access on the performace subkey. I give specified grant to the user on the subkey using regdt32.

Bob Neary
Tcpip - Perfctrs.dll - This problem is caused by the failure of Inetmib1.dll to initialize properly upon loading where memory is allocated during initialization, but not de-allocated during clean-up. To resolve this problem, obtain the latest service pack for Windows NT 4.0 or Windows NT Server 4.0, Terminal Server Edition. See M193899.

Michael Schriver
The best way to repair PerfLib 1008 errors is to use Microsoft Article M300956. It explains everything from rebuilding the standard library to reinstalling the extensible counters.

FileReplicaSet, FileReplicaConn - NTFRSPRF.dll. As per a call to Microsoft and their internal documentation to fix this service do the following:  
To work around this behavior, force the File Replication service to re-create the registry keys that point to the system monitor counters for the File Replication service:
1. Type the "net stop NTFRS" (without the quotation marks) command at a command prompt to stop the File Replication service.
2. Start Registry Editor, and then delete the following registry keys:
a. Delete the FileReplicaConn folder and all the subfolders, which are located under the HKLM\System\CurrentControlSet\Services key.
b. Delete the FileReplicaSet folder and all the subfolders, which are located under the HKLM\System\CurrentControlSet\Services key.
3. Restart the File Replication service to place the two keys back in the registry.
4. Restart the server.

Adam Judd
I'm running SBS server 2000. The only way that I found to stop these events filling my logs was to disable these health monitors.

P Harris
If you feel that disabling a counter is the solution you can also use this tool to disable it without editing the registry: "Extensible Performance Counter List", aka "exctrlst.exe", found in the W2K Resource Kit.

Quoc Hoang
Content Filter - Qperf.dll. See M201984.

Franklin Eekhout
DNS - dnsperf.dll - After a little bit of research I found that in HKEY_LOCAL_MACHINE\SYSTEM\currentControlSet\Services\DNS\Performance there seemed to be missing the Last Counter, Last Help, First Counter, First Help, WbemAdapFileTime, WbemAdapFileSize & WbemAdapStatus values. I copied the values from a month old SBS2K server that did not run any reports or performance tests and 1008 has gone away.

"FileReplicaConn" - NTFRS.dll. I started getting this error when I added Remote Install Services. Soon as I removed the service, the event cleared.

"MSDTC" - msdtcui.DLL - no info.
"isactrl" - no info.

Why bother deciphering Event logs when GFI EventsManager can do everything for you? Free trial here!

Dimitri Zavgorodny
"PSched" - pschdprf.dll - According to Microsoft: The performance logging feature in Application Center uses Performance Data Helper (PDH) to collect performance data every 10 seconds. If any performance counter object in the performance library is not available, the error message occurs. The error message references the affected performance counter service name and counter DLL. Because of this, performance counters that are related to this error may not be functioning.
And here is a resolution:
1. Obtain latest Windows 2000 Service Pack.
2. Reinstall the affected service performance counters.
3. Reinstall the product that is associated with PDH that is named in dll path.
4. Change the identity of the Application Center Performance Log consumer (com+ component) to an account with administrative rights. Some performance counters, such as Internet Information Services (IIS) counters, require administrative rights. The Microsoft Application Center Performance Log consumer collects performance data by using a non-administrative account with low privileges (ACL_computername). Therefore, changing the identity of this COM+ component to an account with administrative rights may resolve this issue. Keep in mind that this may produce a security risk. More information: M299059, also check M248993.

There are two additional ways to resolve this problem:
- Dr. Watson Does Not Run with Certain Extensible Counters, M234860
- Troubleshooting Performance Monitor Counter Problems, M152513.

To disable one or more extensible counter DLL(s):
1. Start the Registry Editor (RegEdt32.exe).
2. Navigate to the following registry subtree:
3. Click Find Key on the View menu.
4. Type Performance as the search string, then search down from there.
5. At each Performance entry you find, select the Library value and modify the library name by prefixing it with two x''s: for example, change OrigLib.dll to xxOrigLib.dll
6. When you have done each Performance entry under the CurrentControlSet \Services key, restart Perfmon to see whether it works. If it does, then repeat the above two steps, only restoring the original library name and trying Perfmon after each change to see which library causes the fault.
For more information see M152513.
Private comment Subscribers only. See example of private comment  
Links The Windows Event Log fills with error messages after installing pcAnywhere, Cisco Website, Network Associates Support Solution ID: nai15090, Network Associates Support Solution ID: nai19304, Network Associates Support Solution ID: nai6288, Network Associates Support, Network Associates Support Solution ID: nai19416, - Perf, Exctrlst.exe: Extensible Performance Counter List, Small Business Server Setup Troubleshooting, EventID 2001 from source Perfdisk, EventID 2003 from source Perflib, EventID 1001 from source IISInfoCtrs
Search Google Web - Microsoft Support - Bing - EventID.Net Queue - More links...  
Custom search The custom search information is available to subscribers only.  
Feedback Send comments - Notify me when updated  
  Print version

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Learn about cloud computing and its benefits for small business owners.
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

820 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question