Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 3009 Source: LoadPerf

Installing the performance counter strings for <application name> failed. The error code is DWORD 0 of the record data.

0000: 05 00 00 00 b3 11 00 00
For Outlook 2003 on Windows 2003 Server, just start Outlook once with administrator rights.
If you use an editor to look in the Xperf.ini file there will be a dirvername=X parameter where X is the "Performance Service Name" to use with UnLodCtr.
Service ASP.NET_64 (ASP.NET_64) - See EV100402 (Installing the performance counter strings for service ASP.NET_64 (ASP.NET_64) failed).
Service WmiApRpl - See EV100403 (Symantec TECH153818).
T726978 provides several troubleshooting suggestions for this type of error.

- Application: Outlook - See ME931914.
- Application: ASP - From a newsgroup post: "Try the following:
1) From command line, navigate to C:\winnt\system32
2) Run the command "unlodctr axperf.ini"
3) Run the command "lodctr axperf.ini"
4) Restart the computer".
- Application: Outlook - I received this event along with events 3003 and 3011 from the same source. The issue was Outlook 2003 on a 2003 server. Deleting the "HKLM\System\Current Control Set\Services\Outlook\Performance" registry key fixed the issue.
When using Citrix\Terminal Services, if you install Office 2003 you must login as an administrator to complete the configuration of the Performance Counters. An event ID 1000 will confirm the load\unload of performance counters. After that, all users should be able to launch Outlook without any errors being written to the event log.
In my case, the source of the problem ended up being with NTDS Performance counters. Once the procedure in ME300956 was followed and the counters rebuilt, the error disappeared.
This error appeared on a box loaded with Exchange 2000 with a direct application of Exchange SP3. Trying to un-register and register the “eseperf.dll” did not work. Pulling the following two files from Exchange 2000 SP2 seemed to fix the problem, “eseperf.hxx” (7K 5/21/2002) and “eseperf.ini” (380K 6/18/2002). These files reside in the “%exchange_install_dir%\BIN” directory. After replacing these two files, I ran the “unlodctr” and “lodctr” commands and the performance counter entries were properly populated in the registry.
Application: ESE97. As per Microsoft's ME273177, this problem can occur when a registry setting associated with a Performance Monitor counter is damaged, causing the Exchange Server Setup program to incorrectly determine that the counters associated with the Exchange Database Engine have already been installed.
Application: DNS. As per ME304541 this is a current problem of Windows 2000. At the command prompt type the following commands:
NOTE: DNS service must be running for the performance counters to be available.
One of the recommendations for this event was to use the UnLodCtr DNSperf.ini and LodCtr DNSperf.ini, which is partially correct (it is UnLodCtr "Performance Service Name", looks like Microsoft made a mistake in ME304541). Please note that the file DNSperf.ini is not available in the system and must be built or obtained. Adding a perf counter is not an easy job...
Applications: "Inetinfo", "ASP, "MSFTPSVC", "W3SVC". The error can occur after Service Pack 3 (SP3) for Windows 2000 installation. To work around this problem, reinstall and then remove IIS. For details see ME325727 link below.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.