Event ID/Source search
Keyword search
Example: Windows cannot unload your registry file
Event ID: 2003 Source: Perflib
| Source: Perflib |
| Type: Warning |
| Description: The configuration information of the performance library <library> for the <service> service does not match the trusted performance library information stored in the registry. The functions of the library will not be treated as trusted. |
| English: This information is only available to subscribers. An example of English, please! |
| Concepts to understand: What are the performance counters? |
| Comments: NC the Boss - Service: TermService - As per ME932813 one should use: lodctr /T:TermService Microsoft claims it is a SP2 issue but notice the /T (while in Help and Support the msg is lodctr/t servicename). In my case the TermService isn't the problem it is the Perflib. Probable causes include: - The trusted information stored in the registry is outdated. - The configuration information for this performance library is outdated. - A malicious user is attempting to attack your computer. I guess lodctr/t or lodctr /T: will work. PSched is erroring out with a 1008 ID.  x
6
Fabio Pongan Service: C:\WINNT\system32\infoctrs.dll - I received this on a Windows Server 2000. I followed M267831 to unload/reload the IIS-related performance dlls: unlodctr w3svc unlodctr msftpsvc unlodctr asp unlodctr inetinfo lodctr w3ctrs.ini lodctr ftpctrs.ini lodctr axperf.ini lodctr infoctrs.ini After you run these commands, you must restart your computer for the changes to take effect. This fixed this error, at least for me. x
10
Anonymous In my case the warning appears, when the nc_net service from Nagios is starts while the port 1248 is used by another application. The Trend Micro Control Manager sometimes uses this port and blocks the nc_net to connect the performance counters. x
2
EventID.Net This event may be recorded if the IIS Admin service is stopped manually. * * * Microsoft confirmed this as a problem that was corrected in Windows 2000 Service Pack 2. Applying Service Pack 2 to an already affected system does not resolve the issue. See ME267831. Service: MSFtpsvc - Received this error when the Windows 2003 server was restarted after a power failure. * * * When using lodctr to unload the counter for a certain service you will use the service name as specified in the event description. However, for unlodctr the trick is to find the right .ini file and in many cases it takes some guess work. For example, most of the performance counters .ini files are located under C:\Windows\System32 (or the corresponding folder if Windows is installed in a different location): - W3SVC service - w3ctrs.ini - TermService service - tslabels.ini - MSFtpsvc service - ftpctrs.ini After using the lodctr command you should see a new event id 1000 from PerfLib in the Application log confirming that the performance counters were loaded successfully. Example for service W3SVC: - Open a command prompt - Type: unlodctr W3SVC - The unloading should be confirmed with a message like this: "Removing counter names and explain text for W3SVC Updating text for language 009". In the Application event log, event id 1001 is recorded, saying: "Performance counters for the W3SVC (World Wide Web Publishing Service ) service were removed successfully. The Record Data contains the new values of the system Last Counter and Last Help registry entries. " - Type: lodctr w3ctrs.ini - There is no confirmation message from this command. However, an event is recorded in the Application log. Open the event log viewer and verify if an informational event id 1000 has been recorded. The description should say: "Performance counters for the W3SVC (World Wide Web Publishing Service ) service were loaded successfully. The Record Data contains the new index values assigned to this service." x
12
EventID.Net - Service: TermService - This problem occurs because the size and the date of the Perfts.dll file in Windows Server 2003 SP2 do not match the size and the date that were stored earlier in the registry for the Perfts.dll file. See ME932813 for details. - Service: W3SVC - Typically, the warning messages are related to the W3svc driver service or to the Active Server Pages (ASP) service. See ME928384 to solve this problem. x
4
Why bother deciphering Event logs when GFI EventsManager can do everything for you? Free trial here! Mohammed Athif Khaleel - Service: InetInfo - In my case, reinstalling IIS (Internet Information Services) solved the problem. x
3
Pavel Dzemyantsau I removed the "Library Validation Code" value from registry and error went away. See the comments below for information on this value. x
6
EventID.Net As per Microsoft: "The trusted information stored in the registry and the configuration information for this performance library do not match. Probable causes include: - The trusted information stored in the registry is outdated. - The configuration information for this performance library is outdated. - A malicious user is attempting to attack your computer". See MSW2KDB for more details on this event. See the link to " Citrix Support Document ID: CTX105011" for additional information on this event. x
4
Richard Ellis I experienced this symptom after installing IBM Director. Reinstalling SP4 seems to have resolved the problem. x
3
Bnc Admin I had the same problem that strangely appeared after installing the IBM Director Active PCI Service Plus Pack. If this is your case, reapply the IIS patch and that should solve your issue. x
4
Anonymous As per Microsoft: "If the "Library Validation Code" value exists for the named service in the Performance subkey, the data is checked against the file creation time and the file size of the named DLL. This error is posted if they do not match. If the error occurs, it may be corrected by removing and reinstalling the named service". See ME226494 for more details. x
2
Phydeaux I can confirm that unloading and reloading the counters fixes the problem. x
6
Woodrow Wayne Collins Troubleshooting this type of problems is not an easy task. For a general approach see ME152513 - "Troubleshooting Performance Monitor Counter Problems". See also ME300956 to find out how to manually rebuild performance counter library values. x
2
Anonymous Reinstallation of the update described in ME327696 helped to solve the problem. The "Library Validation Code" needs to be updated. Seems to be that the Registry wasn't updated via "Windows Update". Maybe Services like compaq Web Managment need to be stoped manually before reinstalling the patch. x
4
Why bother deciphering Event logs when GFI EventsManager can do everything for you? Free trial here! |
| Private comment: Subscribers only. See example of private comment |
| Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue - More links... |
| Custom search for *****: Google - Bing - Microsoft - Yahoo |
| Feedback:
Send comments or solutions
- Notify me when updated
|
| Printer friendly |
Subscribe to EventID.Net now!