Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1011 Source: Perflib

The library file "<file name>" specified for the "<service name>" service could not be opened. Performance data for this service will not be available. Status code is data DWORD 0.
Generally, this indicates that the performance extentions dll specified for a service could not be opened. The registry key\value holding the dll name/path is:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\<log name>\<service name>\EventMessageFile

Verify if the information specified there  is correct.

Reported file names/services:

- D:\SMSLOGON\I386\SMSPERF.dll - SMSPerfCountersForD:_SMSLOGON_I386_SMSPERF.DLL - This behavior occurs because of a conflict between compaq Insight Manager (or other type of performance data gathering software), and the Smsperf.dll file. Another possible cause for this behavior is that DLLs associated with performance monitor have hung. Perflib uses LoadLibrary to open performance extensions. If LoadLibrary fails the status code from GetLastError is posted in the data field of the event. For example, 7e means the DLL could not be found or the library Name in the registry is not correct. See the links below for more details.
- Service: SMSPerfCountersFor<Drive>:_SMSLOGON_I386_SMSPERF.DLL - This issue may occur because when you install Microsoft Systems Management Server 2.0 SP2 existing SMSPerf registry keys are not removed from the registry, although they are no longer used. See ME267971 for details.
- Service: MSSQLServer - This problem may occur because the counters are missing. See ME227662 for more information.
File name: "beperfdll.dll", service: "backup exec" - This error occurs because the beperfdll.dll  file is either missing or corrupted. The beperfdll.dll is associated with the performance counters in Backup Exec for Windows NT and Windows 2000. To resolve this issue, reinstall VERITAS Backup Exec for Windows NT and Windows 2000.See Veritas TechNote ID: 195882 link.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.