PerfCounters & Similar Errors

Dan Carp
Dan Carp used Ask the Experts™
on
On our Windows 2008 x64 Exchange server, we're getting a number of recurring errors in our event log (listed below).  One suggestion I've found repeatedly while searching is to run the following set of commands:

unlodctr w3svc
unlodctr msftpsvc
unlodctr asp
unlodctr inetinfo
lodctr w3ctrs.ini
lodctr ftpctrs.ini
lodctr axperf.ini
lodctr infoctrs.ini

I can unload the counters successfully, but when I attempt to reload, the commands fail.  I've looked in my %SystemRoot%\System32 folder and found that these .ini files don't exist.

Any thoughts on the commands above, and resolving the errors below in general?  Thanks!


Log Name:      Application
Source:        IISInfoCtrs
Date:          5/22/2012 7:53:26 AM
Event ID:      1001
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      server.domain.com
Description:
Unable to read the first counter index value from the registry.  The error code returned by the registry is data DWORD 0.

Log Name:      Application
Source:        Microsoft-Windows-IIS-W3SVC-PerfCounters
Date:          5/22/2012 7:53:47 AM
Event ID:      2002
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      server.domain.com
Description:
Setting up Web Service counters failed, please make sure your Web Service counters are registered correctly.

Log Name:      Application
Source:        Microsoft-Windows-Perflib
Date:          5/22/2012 7:53:47 AM
Event ID:      1008
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      server.domain.com
Description:
The Open Procedure for service "W3SVC" in DLL "C:\Windows\system32\inetsrv\w3ctrs.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

Log Name:      Application
Source:        Microsoft-Windows-Perflib
Date:          5/22/2012 8:45:59 AM
Event ID:      2003
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      server.domain.com
Description:
The configuration information of the performance library "C:\Windows\system32\infoctrs.dll" for the "InetInfo" service does not match the trusted performance library information stored in the registry. The functions in this library will not be treated as trusted.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Jeffrey Kane - TechSoEasyPrincipal Consultant
Most Valuable Expert 2016
Top Expert 2014

Commented:
Generally the fix for all of the above is to restart the W3SVC from an elevated CMD prompt.

Please see this as an example:
http://technet.microsoft.com/en-us/library/cc735241(v=ws.10)

Jeff
TechSoEasy
Dan CarpIT Director

Author

Commented:
Jeff - thanks for the suggestion.  I restarted W3SVC this morning per the technet article and am still receiving the same Event ID 2002 as above (none of the others have appeared yet, but this is only over the course of a few hours).  The event claims that Web Service counters failed, yet when I try to load any of the counters in the Performance monitor listed under "W3SVC_W3WP", they all seem to load successfully.
Jeffrey Kane - TechSoEasyPrincipal Consultant
Most Valuable Expert 2016
Top Expert 2014

Commented:
Can you post the text of one of the error messages?

Jeff
TechSoEasy
11/26 Forrester Webinar: Savings for Enterprise

How can your organization benefit from savings just by replacing your legacy backup solutions with Acronis' #CyberProtection? Join Forrester's Joe Branca and Ryan Davis from Acronis live as they explain how you can too.

Dan CarpIT Director

Author

Commented:
Certainly, Jeff - see the three recurring errors below.  Thanks again.

Log Name:      Application
Source:        Microsoft-Windows-Perflib
Date:          6/4/2012 9:41:42 AM
Event ID:      1008
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      server.domain.com
Description:
The Open Procedure for service "W3SVC" in DLL "C:\Windows\system32\inetsrv\w3ctrs.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Perflib" Guid="{13B197BD-7CEE-4B4E-8DD0-59314CE374CE}" EventSourceName="Perflib" />
    <EventID Qualifiers="49152">1008</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2012-06-04T13:41:42.000Z" />
    <EventRecordID>39343</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>hermes.pca.com</Computer>
    <Security />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="Perflib">
      <param1>W3SVC</param1>
      <param2>C:\Windows\system32\inetsrv\w3ctrs.dll</param2>
      <binaryDataSize>4</binaryDataSize>
      <binaryData>02000000</binaryData>
    </EventXML>
  </UserData>
</Event>

Log Name:      Application
Source:        Microsoft-Windows-IIS-W3SVC-PerfCounters
Date:          6/4/2012 10:15:06 AM
Event ID:      2002
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      server.domain.com
Description:
Setting up Web Service counters failed, please make sure your Web Service counters are registered correctly.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-IIS-W3SVC-PerfCounters" Guid="{90303B54-419D-4081-A683-6DBCB532F261}" EventSourceName="W3CTRS" />
    <EventID Qualifiers="49152">2002</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2012-06-04T14:15:06.000Z" />
    <EventRecordID>39347</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>hermes.pca.com</Computer>
    <Security />
  </System>
  <EventData>
    <Binary>02000780</Binary>
  </EventData>
</Event>

Log Name:      Application
Source:        Microsoft-Windows-Perflib
Date:          6/4/2012 11:47:07 AM
Event ID:      2003
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      server.domain.com
Description:
The configuration information of the performance library "C:\Windows\system32\perf-MSSQL$SQLEXPRESS-sqlctr10.0.1600.22.dll" for the "MSSQL$SQLEXPRESS" service does not match the trusted performance library information stored in the registry. The functions in this library will not be treated as trusted.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Perflib" Guid="{13B197BD-7CEE-4B4E-8DD0-59314CE374CE}" EventSourceName="Perflib" />
    <EventID Qualifiers="32768">2003</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2012-06-04T15:47:07.000Z" />
    <EventRecordID>39360</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>hermes.pca.com</Computer>
    <Security />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="Perflib">
      <param1>C:\Windows\system32\perf-MSSQL$SQLEXPRESS-sqlctr10.0.1600.22.dll</param1>
      <param2>MSSQL$SQLEXPRESS</param2>
    </EventXML>
  </UserData>
</Event>
Jeffrey Kane - TechSoEasyPrincipal Consultant
Most Valuable Expert 2016
Top Expert 2014

Commented:
Thanks for that.  Have you rebooted this server since running the loadctr commands?

If not, please reboot.

Jeff
TechSoEasy
Dan CarpIT Director

Author

Commented:
In case I hadn't done so, I rebooted this morning.  I've seen event ID 2002 occur a couple of times since the reboot.  Prior to the most recent error, the following error popped up in case this helps:

Log Name:      Application
Source:        Microsoft-Windows-Perflib
Date:          6/5/2012 9:20:50 AM
Event ID:      1010
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      server.domain.com
Description:
The Collect Procedure for the "ASP.NET_64_2.0.50727" service in DLL "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_perf.dll" generated an exception or returned an invalid status. The performance data returned by the counter DLL will not be returned in the Perf Data Block. The first four bytes (DWORD) of the Data section contains the exception code or status code.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Perflib" Guid="{13B197BD-7CEE-4B4E-8DD0-59314CE374CE}" EventSourceName="Perflib" />
    <EventID Qualifiers="49152">1010</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2012-06-05T13:20:50.000Z" />
    <EventRecordID>39930</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>server.domain.com</Computer>
    <Security />
  </System>
  <UserData>
    <EventXML xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="Perflib">
      <param1>ASP.NET_64_2.0.50727</param1>
      <param2>C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_perf.dll</param2>
      <binaryDataSize>4</binaryDataSize>
      <binaryData>C7040000</binaryData>
    </EventXML>
  </UserData>
</Event>
Principal Consultant
Most Valuable Expert 2016
Top Expert 2014
Commented:
I really can't say for sure, but it does seem as though you may want to manually rebuild the counters.  You can follow this KB article for that:  http://support.microsoft.com/kb/300956

Jeff
TechSoEasy
Dan CarpIT Director

Author

Commented:
Today I finally had the chance to work on the server during off-hours - and strangely, when I checked the event log to see if the events were still piling up, they had stopped completely.  So I'm uncertain what resolved it, but your last suggestion would have been the next piece and likely would have been the end of the problems.  Thanks for all of your help on this, Jeff!

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial