Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 41 Source: WinMgmt

Source
Level
Description
WMI ADAP was unable to create object index <index number> for Performance Library <service name> because no value was found in the <language id> subkey.
Comments
 
As per Microsoft: "Windows Management Instrumentation (WMI) could not locate the specified object because it was not listed in the registry key. The Performance Monitor object and counter names are stored in the Counters section of the following registry key: HKEY LOCAL MACHINE\Software\Microsoft\WindowsNT\ CurrentVersion\Perflib\ (Lang ID 009 = U.S. English)". See MSW2KDB for more information on this event.

See the links to "McAfee Support Solution ID: NAI29245" for additional information on this event.
I had this error in my event log about the W3SVC service after each reboot. I had to remove and add the performance counters for the W3SVC service according to ME267831, namely I ran the following commands at a command prompt: “unlodctr w3svc”, and “lodctr w3ctrs.ini”.
Try the three possible solutions to resolve this problem:
1. winmgmt /clearadap.
2. winmgmt /resyncperf "winmgmt service pid" (the “winmgmt service pid” can be found in Task Manager, next to the process name).
3. If event 41 still appears, it might be caused by a slow startup. To avoid this add a DWORD key “Collect Timeout” with value 10000 to “HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\<process name>\Performance”. See ME266416 for more details.
From a newsgroup post: "The 009 subkey is: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009. There is a multi-string value there called Counter. All performance counters have to be listed there. One can remove the counter for the service by typing on the command line: unlodctr <service_name>. (I did not misspell it, "UNLODCTR" is the file name). This of course should be done only if the performance counters for that service are not required. See also the links below."
From another post: "The Performance Monitor object and counter names are stored in the "Counters" in this Registry Key:
HKEY LOCAL MACHINE\Software\Microsoft\WindowsNT\ CurrentVersion\Perflib\<LangID> (Lang ID 009 = U.S. English)

If the list of objects and counters available to chart in Performance Monitor is incomplete or blank, it may be because Perflib subkeys other than the 009 subkey exist. Performance Monitor only uses the contents of one <LangID> subkey. Additional subkeys under the Perflib subkey are created when the Language setting in Control Panel is modified.
For cases where "Index number"=0, "Service name"=MSDTC, and "Language ID"=009, ensure no missing values in \HKEY_LOCAL_MACHINE\CurrentControlSet\Services\MSDTC\Performance. In my case, the following REG_DWORD values were missing and manually adding them eliminated the error: "First Counter" 7e6, "First Help" 7e7, "Last Counter" 800, and "Last Help" 801.


Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...