Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 7064 Source: MicrosoftSearch

Level
Description
Performance monitoring for the Indexer Object cannot be initialized, because the counters are not loaded or the shared memory object cannot be opened. Stop and restart the Search service.  If this error continues, reinstall the application.
Comments
 
The event appeared together with Event ID 3007 and 3006. After searching the registry, we found that the following counters had to be loaded:
HKLM\SYSTEM\CurrentControlSet\Services\MSSEARCH\Performance
HKLM\SYSTEM\CurrentControlSet\Services\MSSGatherer\Performance
HKLM\SYSTEM\CurrentControlSet\Services\MSSGTHRSVC\Performance

These counters can be loaded from the directory C:\Program Files\Common Files\System\MSSearch\Bin. Run the command lodctr against the following files:
- acatctr.ini
- dsscntrs.ini
- gthrctr.ini
- nlindctr.ini

After performing these operations, we restarted the Microsoft Search service and the problem was solved.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...