Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
WMI ADAP was unable to create object index <index number> for Performance Library <service name> because no value was found in the <language id> subkey.
|English: Request a translation of the event description in plain English.|
|Concepts to understand:|
What are the performance counters?
What is WMI?
What is WMI ADAP?
As per Microsoft: "Windows Management Instrumentation (WMI) could not locate the specified object because it was not listed in the registry key. The Performance Monitor object and counter names are stored in the Counters section of the following registry key: HKEY LOCAL MACHINE\Software\Microsoft\WindowsNT\ CurrentVersion\Perflib\ (Lang ID 009 = U.S. English)". See MSW2KDB for more information on this event.
See the links to "McAfee Support Solution ID: NAI29245" for additional information on this event.
I had this error in my event log about the W3SVC service after each reboot. I had to remove and add the performance counters for the W3SVC service according to ME267831, namely I ran the following commands at a command prompt: “unlodctr w3svc”, and “lodctr w3ctrs.ini”.
Peter Van Gils
Try the three possible solutions to resolve this problem:
1. winmgmt /clearadap.
2. winmgmt /resyncperf "winmgmt service pid" (the “winmgmt service pid” can be found in Task Manager, next to the process name).
3. If event 41 still appears, it might be caused by a slow startup. To avoid this add a DWORD key “Collect Timeout” with value 10000 to “HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\<process name>\Performance”. See ME266416 for more details.
From a newsgroup post: "The 009 subkey is: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009. There is a multi-string value there called Counter. All performance counters have to be listed there. One can remove the counter for the service by typing on the command line: unlodctr <service_name>. (I did not misspell it, "UNLODCTR" is the file name). This of course should be done only if the performance counters for that service are not required. See also the links below."
From another post: "The Performance Monitor object and counter names are stored in the "Counters" in this Registry Key:
HKEY LOCAL MACHINE\Software\Microsoft\WindowsNT\ CurrentVersion\Perflib\<LangID> (Lang ID 009 = U.S. English)
If the list of objects and counters available to chart in Performance Monitor is incomplete or blank, it may be because Perflib subkeys other than the 009 subkey exist. Performance Monitor only uses the contents of one <LangID> subkey. Additional subkeys under the Perflib subkey are created when the Language setting in Control Panel is modified.
For cases where "Index number"=0, "Service name"=MSDTC, and "Language ID"=009, ensure no missing values in \HKEY_LOCAL_MACHINE\CurrentControlSet\Services\MSDTC\Performance. In my case, the following REG_DWORD values were missing and manually adding them eliminated the error: "First Counter" 7e6, "First Help" 7e7, "Last Counter" 800, and "Last Help" 801.
|Private comment: Subscribers only. See example of private comment|
|Links: ME127207, ME266416, ME267831, JSI Tip 2874 - More on WinMgmt performance counter errors. (see also tips 2194 and 2526), McAfee Support Solution ID: NAI29245, MSW2KDB|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
Send comments or solutions
- Notify me when updated