The performance strings in the registry do not match the index values stored in the Perflib key. The Record Data contains the last index value from the Perflib key in DWORD 0 and the index of the last string used as DWORD 1.
This event occurred running Windows 2000 Server on a Dell Poweredge 4600. It was eliminated by running the following command:
lodctr /r: c:\winnt\system32\perfstringbackup.ini
Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.
Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.