Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
Windows cannot load extensible counter DLL <counter>, the first DWORD in data section is the Windows error code.
|English: This information is only available to subscribers. An example of English, please!|
|Concepts to understand:|
What is a DLL?
What is a DWORD?
From a newsgroup post: "When you use the System Monitor tool, some counters may be missing or do not contain counter data. The base set of performance counter libraries may become corrupted and may need to be rebuilt along with any extensible counters. This behavior can occur if certain extensible counters corrupt the registry or if some Windows Management Instrumentation (WMI)-based programs modify the Registry". See the ME300956 - How to Manually Rebuild Performance Counter Library Values" for more information on this issue.
Counter : MSSQL$MS_ADMT - This issue is most likely caused by a permission issue. Try
following steps to confirm it:
1. Ensure permissions of C:\Windows\ADMT are set as following:
Authenticated Users: Read & Execute
Server Operators: Modify
Administrators: Full Control
SYSTEM: Full Control
CREATOR OWNER: Full Control
2. Give Read & Execute permission to Everyone account and full control permission to Administrators group for following file:
This solved the problem for me.
Counter MSSCNTRS - It only happened after updating our Exchange server (Hub and CAS) with Windows Update. We noticed that Windows Search was installed along with the updates. Uninstalling windows Search V4.0 solved the issue.
As mentioned by others, this is a known issue when running VMWare server on SBS. I resolved it by adding a DWORD "Disable PerformanceCounters" with a value of 1, to the following registry key: HKLM\SYSTEM\CurrentControlSet\Services\VMware\Performance.
- Counter: VMware - This is a known issue if VMWare server is installed on a Small Business Server 2003 machine. So far, a fix has not released for the issue. The error can be ignored, or you can rename the registry key KEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VMware\Performance to stop the DLL from trying to load, and therefore to stop the error from appearing in the event viewer.
- Counter: MSSQLSERVER - In our case, giving "Performance Log Users" and "Performance Monitor Users" the "Read" and "Read & Execute" permissions on \Microsoft SQL Server\MSSQL\Binn\sqlctr80.dll solved the problem.
- Counter: TermService - Run "lodctr tslabels.ini".
- Counter: MSSQL$SHAREPOINT and MSSQL$SBSMONITORING - Inspired by PaulD's solution and a newsgroup post, I did a search in "program files" for sqlctr80.dll. I found two copies, one for each MSSQL instance listed above, in the following locations:
C:\Program Files\Microsoft SQL Server\MSSQL$SBSMONITORING\Binn
C:\Program Files\Microsoft SQL Server\MSSQL$SHAREPOINT\Binn
For each file, I modified the Properties, selected the Security tab and added "Everyone" with "Read & Execute" rights. My application event log stopped recording these events immediately.
- Counter: McAfee GroupShield - McAfee Solution ID kb43499 states that incorrect or missing permissions for the "Network Service" account on the "GroupShield\Bin" Directory seems to cause this problem. Go to the "McAfee Knowledge Search" page and search for the specified solution to read the article.
This problem can also appear if BlackBerryRouterPerf.dll is not referenced in the HKEY_LOCAL_MACHINE\SYSTEM\Current Control Set\Services\BlackBerry Router\Performance registry key. See "BlackBerry Support Article Number: KB-05443" for details on fixing this issue.
See ME912399 for additional information about this event.
- Counter: MSSQLSERVER - Ensure that the "SYSTEM" account has Full Control access to the "C:\MSSQL" directory.
- Counter: MSSQL$MSAC - See ME891330 for a hotfix applicable to Microsoft Windows Server 2003 Service Pack 1 and Microsoft Application Center 2000 Service Pack 2.
In my case the <counter> was “MSSQL$INSTANCE1”, and the DWORD data section was 05000000 i.e. 0x5 = “Access denied”. I fixed this by doing the following:
1. Found registry entry HKLM\SYSTEM\CurrentControlSet\Services\MSSQL$INSTANCE1\Performance
2. Granted user (for which the error was generated) rights at least “Read” for MSSQL$~2, BINN and for SQLCTR80.DLL.
Convert the DWORD data into decimal and use "net helpmsg <decimal>" to obtain a more detailed error description.
|Private comment: Subscribers only. See example of private comment|
|Links: McAfee Knowledge Search, BlackBerry Support Article Number: KB-05443|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (1) - More links...|
|Custom search for *****: Google - Bing - Microsoft - Yahoo|
Send comments or solutions
- Notify me when updated