Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1000 Source: FTPCtrs

Unable to collect the FTP performance statistics. The error code returned by the service is data DWORD 0.
From a newsgroup post: "Probably the FTP service is not running. If so, you can disable the counter to stop the error generation. Use the extensible performance counter list tool (Exctrlst.exe) for help on this task".
This event is sometimes generated when the FTP service is stopped while using the Performance Monitor. If you do not use the FTP performance counters, then you can disable them using the exctrlst.exe utility (from the Windows 2000 Resource Kit) - the service name is "MSFTPSVC".

You may also try reinstalling the performance counters as specified in ME226512:

How to Reinstall IIS 4.0 Performance Monitor Counters

This article provides detailed instructions for reinstalling or removing and reinstalling the Windows NT Option Pack (NTOP) Performance Monitor Counters.

Three files are required to install Performance Monitor Counters for NTOP services. One file is a .ini file that contains the installation instructions for the counters, another is a .h file that contains the symbolic and offset information for the counters, and the third file is the .dll file that maintains the counters statistics. These three files must reside in the %windir%\system32 directory before they can be installed for use with Performance Monitor.

If the main Performance Monitor data files (Perfc009.dat and Perfh009.dat) have become corrupted, you can use ME127207.

The following list provides a list of all NTOP Performance Monitor Objects, their corresponding .ini, .h, and .dll files, their registry key name, and the .cab file on the NTOP compact disc where the files are located:
Format: (Object name, .ini file name, .h file name, .dll file name, Services registry key name, .cab file name)
Radius Server, Authperf.ini, Authperf.h, Authperf.dll, AuthSrv,  
PBServer Monitor, Regsym.ini, Regsym.h, Pbsmon.dll, PBServerMonitor,  
MSMQ Exchange Connector, Counters.ini, Counters.h, Gwperf.dll, MSEXGW,  
MSMQ Service, Mqperf.ini, Perfsym.h, Mqperf.dll, MSMQ,  
Content Index, Perfci.ini, Ciperfm.h, Qperf.dll, ContentIndex,  
Content Index Filter, Perffilt.ini, Filtperf.h, Qperf.dll, ContentFilter,  
HTTP Content Index, Perfwci.ini, Perfwci.h, Qperf.dll, ISAPISearch,  
NNTP Server, Nntpctrs.ini, Nntpctrs.h, Nntpctrs.dll, NNTPSVC,  
SMTP Server, Smtpctrs.ini, Smtpctrs.h, Smtpctrs.dll, SMTPSVC,  
Active Server Pages, Axperf.ini, Axctrnm.h, Aspperf.dll, ASP,  
FTP Service, Ftpctrs.ini, Ftpctrs.h, Ftpctrs2.dll, MSFTPSVC,  
Internet Information Services Global, Infoctrs.ini, Infoctrs.h, Infoctrs.dll, Inetinfo,  
Web Service, W3ctrs.ini, W3ctrs.h, W3ctrs.dll, W3SVC,  

Use the following instructions to install or reinstall Performance Monitor Counters for the NTOP services:
To install an object's counters, the object's .ini, .h, and .dll files must reside in the %windir%\system32 directory. Using the above table determine which .ini, .h, and .dll files you need for the object you want to install. Determine if the .ini, .h, and .dll files are in the %windir%\system32 directory. If they are not, you can use the latest version of WinZip to extract the files to the %windir%\system32 directory from the appropriate .cab file on the NTOP compact disc.

Open a Command Prompt and change directory to %windir%\system32. Type the following:

lodctr <.ini file name for object to install>

If you receive the following message:
Counters for <object name> are already installed Unable to update the system registry

type the following:
unlodctr <services registry key name> and re-type:
lodctr <.ini file name for object to install>

Repeat Steps 1 through 3 for each object that you want to install Performance Monitor Counters for.
To disable the FTP Performance counters add the following REG_DWORD registry value:
Add Disable Performance Counters
and set its value to 1
Error: "Access is denied." The problem was that the user group "Everyone" had been removed from the system root (c:\winnt). Restoring "everyone" with full permissions fixed the problem.
Article ME267831 (as already suggested) can be useful when you want to reload IIS performance DLLs. Just make sure that when you unload a DLL (by using the unlodctr command) you get an Event ID 1001 from LoadPerf stating that the service was successfully removed. When you reload the DLL (by using the lodctr command), make sure you get an Event ID 1000 from LoadPerf stating that the counters for the service where successfully loaded.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.