Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
Unable to collect the FTP performance statistics. The error code returned by the service is data DWORD 0.
|English: Request a translation of the event description in plain English.|
|Concepts to understand:|
What is a service?
What are the performance counters?
What is FTP?
What is a DWORD?
|Our approach: This information is only available to subscribers. An example of Our approach|
From a newsgroup post: "Probably the FTP service is not running. If so, you can disable the counter to stop the error generation. Use the extensible performance counter list tool (Exctrlst.exe) for help on this task".
This event is sometimes generated when the FTP service is stopped while using the Performance Monitor. If you do not use the FTP performance counters, then you can disable them using the exctrlst.exe utility (from the Windows 2000 Resource Kit) - the service name is "MSFTPSVC".
You may also try reinstalling the performance counters as specified in ME226512:
How to Reinstall IIS 4.0 Performance Monitor Counters
This article provides detailed instructions for reinstalling or removing and reinstalling the Windows NT Option Pack (NTOP) Performance Monitor Counters.
Three files are required to install Performance Monitor Counters for NTOP services. One file is a .ini file that contains the installation instructions for the counters, another is a .h file that contains the symbolic and offset information for the counters, and the third file is the .dll file that maintains the counters statistics. These three files must reside in the %windir%\system32 directory before they can be installed for use with Performance Monitor.
If the main Performance Monitor data files (Perfc009.dat and Perfh009.dat) have become corrupted, you can use ME127207.
The following list provides a list of all NTOP Performance Monitor Objects, their corresponding .ini, .h, and .dll files, their registry key name, and the .cab file on the NTOP compact disc where the files are located:
Format: (Object name, .ini file name, .h file name, .dll file name, Services registry key name, .cab file name)
Radius Server, Authperf.ini, Authperf.h, Authperf.dll, AuthSrv, Rasics.cab
PBServer Monitor, Regsym.ini, Regsym.h, Pbsmon.dll, PBServerMonitor, Rasics.cab
MSMQ Exchange Connector, Counters.ini, Counters.h, Gwperf.dll, MSEXGW, Msmqocm.cab
MSMQ Service, Mqperf.ini, Perfsym.h, Mqperf.dll, MSMQ, Msmqocm.cab
Content Index, Perfci.ini, Ciperfm.h, Qperf.dll, ContentIndex, Is20.cab
Content Index Filter, Perffilt.ini, Filtperf.h, Qperf.dll, ContentFilter, Is20.cab
HTTP Content Index, Perfwci.ini, Perfwci.h, Qperf.dll, ISAPISearch, Is20.cab
NNTP Server, Nntpctrs.ini, Nntpctrs.h, Nntpctrs.dll, NNTPSVC, Ins.cab
SMTP Server, Smtpctrs.ini, Smtpctrs.h, Smtpctrs.dll, SMTPSVC, Ims.cab
Active Server Pages, Axperf.ini, Axctrnm.h, Aspperf.dll, ASP, Iis4_03.cab
FTP Service, Ftpctrs.ini, Ftpctrs.h, Ftpctrs2.dll, MSFTPSVC, Iis4_03.cab
Internet Information Services Global, Infoctrs.ini, Infoctrs.h, Infoctrs.dll, Inetinfo, Iis4_01.cab
Web Service, W3ctrs.ini, W3ctrs.h, W3ctrs.dll, W3SVC, Iis4_01.cab
Use the following instructions to install or reinstall Performance Monitor Counters for the NTOP services:
To install an object's counters, the object's .ini, .h, and .dll files must reside in the %windir%\system32 directory. Using the above table determine which .ini, .h, and .dll files you need for the object you want to install. Determine if the .ini, .h, and .dll files are in the %windir%\system32 directory. If they are not, you can use the latest version of WinZip to extract the files to the %windir%\system32 directory from the appropriate .cab file on the NTOP compact disc.
Open a Command Prompt and change directory to %windir%\system32. Type the following:
lodctr <.ini file name for object to install>
If you receive the following message:
Counters for <object name> are already installed Unable to update the system registry
type the following:
unlodctr <services registry key name> and re-type:
lodctr <.ini file name for object to install>
Repeat Steps 1 through 3 for each object that you want to install Performance Monitor Counters for.
To disable the FTP Performance counters add the following REG_DWORD registry value:
Add Disable Performance Counters
and set its value to 1
Error: "Access is denied." The problem was that the user group "Everyone" had been removed from the system root (c:\winnt). Restoring "everyone" with full permissions fixed the problem.
Article ME267831 (as already suggested) can be useful when you want to reload IIS performance DLLs. Just make sure that when you unload a DLL (by using the unlodctr command) you get an Event ID 1001 from LoadPerf stating that the service was successfully removed. When you reload the DLL (by using the lodctr command), make sure you get an Event ID 1000 from LoadPerf stating that the counters for the service where successfully loaded.
|Private comment: Subscribers only. See example of private comment|
|Links: ME201638, ME127207, ME226512, ME267831, Exctrlst.exe: Extensible Performance Counter List|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
Send comments or solutions
- Notify me when updated