Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
Installing the performance counter strings for <application name> failed. The error code is DWORD 0 of the record data.
0000: 05 00 00 00 b3 11 00 00
|English: This information is only available to subscribers. An example of English, please!|
|Concepts to understand:|
What is a Performance Monitor Extension?
What are the performance counters?
How does an application find the performance counter dll?
What are the effects of performance data not being available?
What is a DWORD?
For Outlook 2003 on Windows 2003 Server, just start Outlook once with administrator rights.
If you use an editor to look in the Xperf.ini file there will be a dirvername=X parameter where X is the "Performance Service Name" to use with UnLodCtr.
Service ASP.NET_64 (ASP.NET_64) - See EV100402 (Installing the performance counter strings for service ASP.NET_64 (ASP.NET_64) failed).
Service WmiApRpl - See EV100403 (Symantec TECH153818).
T726978 provides several troubleshooting suggestions for this type of error.
- Application: Outlook - See ME931914.
- Application: ASP - From a newsgroup post: "Try the following:
1) From command line, navigate to C:\winnt\system32
2) Run the command "unlodctr axperf.ini"
3) Run the command "lodctr axperf.ini"
4) Restart the computer".
- Application: Outlook - I received this event along with events 3003 and 3011 from the same source. The issue was Outlook 2003 on a 2003 server. Deleting the "HKLM\System\Current Control Set\Services\Outlook\Performance" registry key fixed the issue.
When using Citrix\Terminal Services, if you install Office 2003 you must login as an administrator to complete the configuration of the Performance Counters. An event ID 1000 will confirm the load\unload of performance counters. After that, all users should be able to launch Outlook without any errors being written to the event log.
In my case, the source of the problem ended up being with NTDS Performance counters. Once the procedure in ME300956 was followed and the counters rebuilt, the error disappeared.
This error appeared on a box loaded with Exchange 2000 with a direct application of Exchange SP3. Trying to un-register and register the “eseperf.dll” did not work. Pulling the following two files from Exchange 2000 SP2 seemed to fix the problem, “eseperf.hxx” (7K 5/21/2002) and “eseperf.ini” (380K 6/18/2002). These files reside in the “%exchange_install_dir%\BIN” directory. After replacing these two files, I ran the “unlodctr” and “lodctr” commands and the performance counter entries were properly populated in the registry.
Application: ESE97. As per Microsoft's ME273177, this problem can occur when a registry setting associated with a Performance Monitor counter is damaged, causing the Exchange Server Setup program to incorrectly determine that the counters associated with the Exchange Database Engine have already been installed.
Application: DNS. As per ME304541 this is a current problem of Windows 2000. At the command prompt type the following commands:
CD %WINDIR% \SYSTEM32
NOTE: DNS service must be running for the performance counters to be available.
One of the recommendations for this event was to use the UnLodCtr DNSperf.ini and LodCtr DNSperf.ini, which is partially correct (it is UnLodCtr "Performance Service Name", looks like Microsoft made a mistake in ME304541). Please note that the file DNSperf.ini is not available in the system and must be built or obtained. Adding a perf counter is not an easy job...
Applications: "Inetinfo", "ASP, "MSFTPSVC", "W3SVC". The error can occur after Service Pack 3 (SP3) for Windows 2000 installation. To work around this problem, reinstall and then remove IIS. For details see ME325727 link below.
|Private comment: Subscribers only. See example of private comment|
|Links: UnLodCtr Usage, LodCtr Usage, Event ID 3003 from source LoadPerf, Event ID 3011 from source LoadPerf|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
|Custom search for *****: Google - Bing - Microsoft - Yahoo|
Send comments or solutions
- Notify me when updated