Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1015 Source: Perflib

The timeout waiting for the performance data collection function "<function name>" in the "<dll name>" Library to finish has expired. There may be a problem with this extensible counter or the service it is collecting data from or the system may have been very busy when this call was attempted.
Registering the system performance libraries with the "winmgmt /resyncperf" command, might solve the problem.
See ME839264 for a hotfix applicable to Microsoft Windows 2000.

As per Microsoft: "The performance counter provider for this service could not return performance counter data within the specified collect timeout period. Either there is a problem with this performance counter provider or the service it is collecting data from, or the system was too busy when this call was made". See MSW2KDB for more details on this issue.

From a newsgroup post: "You might want to download the following program (see the link below) and use it to disable the performance counters that are giving you the problem (or even all of them). I recently had this problem and just disabled all my performance counters. I'm not sure why they were enabled by default, because it seems they were only needed for testing purposes".
PerfOS - C:\WINNT\system32\perfos.dll - In my case, this happened because the system was very busy. You might want to see the comments about the "Collect Timeout" registry value.
Termservice - We were getting these errors just before the server on our Citrix farm crashed. They are a symptom of a problem rather than the cause. In our case this was caused by incorrect network drivers on the servers. Updated with most recent drivers (Dell 2550 Intel/PRO) and no more crashes, although the error does occur occasionaly it does not cause any issues.
Pop3connector - I got this error on MS SBS using the pop3connector. After restating the pop3connector service the error was gone.

Various function/dll combinations:

TermService - C:\WINNT\System32\perfts.dll - Perflib "Collect Timeout" registry value sets up a timeout procedure internally. If the Collect function of a Performance Monitor Extension DLL does not return within the time specified, in milliseconds, in this registry value an event (1015) is posted to the Event Log.

PerfProc - C:\WINNT\System32\perfproc.dll - This dll represents the "Windows System Process Performance Objects DLL". Some newsgroup posts suggest that this error may occur when beta software from Microsoft is upgraded to production versions. The suggestion in this case was to remove the beta version and then install the new one.
W3SVC - C:\WINNT\system32\w3ctrs.dll - It may help to unregister and reregister w3ctrs.dll and then restart. Also try to reinstall IIS 4.0 performance monitor counters. See ME226512.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.