Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
Unable to find the Open Procedure name in the registry for service "<service>". Please check the application event log to make sure there were no problems encountered during installation of the "<service>" service and re-install its performance counter DLL.
|English: Request a translation of the event description in plain English.|
|Concepts to understand:|
What is a DLL?
- Service: PSched - A standalone Windows 2003 Enterprise server had this Application Log event entered 10 times over the last 13 days, only once on any given day, generally occurring 24 hours plus 15-30 minutes after the last event. Performance was not being monitored. %SystemDirectory%\Drivers\PSched.sys seems to be the Packet Scheduler for QoS, and can be performance monitored. This computer does not have Qos installed. This machine has recently been locking up (touchpad memory violations) and has had corrupted Registry hives restored at reboot.
I found a bad Registry setting at HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\windows\Psched. NonBestEffortLimit was set to 0xfffffffb(4294967291). By default, it should be 0x00000014(20). Even at 100% bandwidth it would only be 0x00000014(100).
I checked two other places for incorrect values:
1. In gpedit.msc at Computer Configuration\Administrative Templates\Network\QoS Packet Scheduler no settings were defined.
2. In the Registry there were no NIC settings at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PSched.
I set NonBestEffortLimit to the default 0x00000014(20) at HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\windows\Psched.
I fixed the lockups by setting DisableHeapLookaside to 1 for the video and touchpad drivers. See ME195009.
PSched related links: “NonBestEffortLimit”, “Manage the Reserved QoS Bandwidth”, “QoS Bandwidth Reserve Setting”, and ME316666.
|Private comment: Subscribers only. See example of private comment|
|Links: ME195009, ME316666, Troubleshooting Performance monitoring, Exctrlst Examples, NonBestEffortLimit, Manage the Reserved QoS Bandwidth, QoS Bandwidth Reserve Setting|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
Send comments or solutions
- Notify me when updated