Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 3003 Source: Perflib

Unable to find the Open Procedure name in the registry for service "<service>". Please check the application event log to make sure there were no problems encountered during installation of the "<service>" service and re-install its performance counter DLL.
- Service: PSched - A standalone Windows 2003 Enterprise server had this Application Log event entered 10 times over the last 13 days, only once on any given day, generally occurring 24 hours plus 15-30 minutes after the last event. Performance was not being monitored. %SystemDirectory%\Drivers\PSched.sys seems to be the Packet Scheduler for QoS, and can be performance monitored. This computer does not have Qos installed. This machine has recently been locking up (touchpad memory violations) and has had corrupted Registry hives restored at reboot.
I found a bad Registry setting at HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\windows\Psched. NonBestEffortLimit was set to 0xfffffffb(4294967291). By default, it should be 0x00000014(20). Even at 100% bandwidth it would only be 0x00000014(100).
I checked two other places for incorrect values:
1. In gpedit.msc at Computer Configuration\Administrative Templates\Network\QoS Packet Scheduler no settings were defined.
2. In the Registry there were no NIC settings at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PSched.
I set NonBestEffortLimit to the default 0x00000014(20) at HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\windows\Psched.

I fixed the lockups by setting DisableHeapLookaside to 1 for the video and touchpad drivers. See ME195009.

PSched related links: “NonBestEffortLimit”, “Manage the Reserved QoS Bandwidth”, “QoS Bandwidth Reserve Setting”, and ME316666.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.