Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1008 Source: Perflib

The Open Procedure for service <service> in DLL <dll> failed. Performance data for this service will not be available. Status code returned is DWORD 0.
This event may occur for various applications. When the performance monitor reads all counters for the first time, the extension's Open Procedure is called. A typical task for the Open procedure is to read what range of object indexes it supports from the registry. These index values are stored in the First Counter, First Help, Last Counter, and Last Help registry values under the application's performance key. If this Open procedure fails to read the data (i.e. those entries don’t exist or have been deleted by an uninstall procedure) the 1008 event is recorded in the event log (see ME247226 for more details). See ME247226 on how to fully install the Performance Monitor Extentions

In order to remove such orphaned entries typically one has to follow these steps:
Start Registry Editor (Regedt32.exe or Regedit.exe)and go to the following subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<service name>:\Performance
Delete the value " Open ."
Restart your computer for this change to take effect.

If you do not need the performance counters for the service mentioned in the event you can disabled them using the exctrlst.exe tool (Extensible Performance Counter List) - see the link below in the links section for the download location.

UPS - apcctrs.dll - The UPS Service with PowerChoute software. See the explanation for event ID 2000 from "appctrs" source

pcAnywhere - PcaPerfCtrs.dll - See the link to pcAnywhere Knowledge base.
Service: ASP.NET_2.0.50727 - Open a command prompt and navigate to  C:\Windows\Microsoft.NET\Framework\v2.0.50727. Run:

unlodctr ASP.NET_2.0.50727

followed by

lodctr aspnet_perf.ini
- Service: "PSched" - If a performance library file was not properly initialized during installation, you can reload it. Membership in the local Administrators group is required to complete this procedure.

To reload a performance library:
- Click Start, click All Programs, and click Accessories.
- Right-click Command Prompt, and then click Run as administrator.
- At the command prompt, type cd %SYSTEMROOT%\System32 and then press ENTER.
- At the command prompt, type lodctr <ini file>, where <ini file> is the pschdprf.ini file for the library that you want to reload.
- Service: ASP.NET, dll: aspnet_perf.dll - See ME944746 for a hotfix applicable to Microsoft .NET Framework 1.0.
- Service: ESE, dll: eseperf.dll - Microsoft article ME273177 may help.
- Service: MSDTC, dll: msdtcui.dll - See ME282293.
- Service: AppleTalk, dll: atkctrs.dll - See ME924208 and "Citrix Support Document ID: CTX214884".
- Service: NwlnkNb, dll: perfctrs.dll - From a newsgroup post: "Open the SBS Admin console and then expand the following: Health Monitor -> All Monitored Computers -> Server -> Health Monitor Sample Monitors -> Windows 2000 Performance Monitors and then open up the appropriate file and stop the Performance Monitor that is running. You can also do this in the registry by deleting all of the Perfmons. I believe the ME226494 article will help you do this".
- Service: PSched, dll: pschdprf.dll - This problem occurs because the system removes the Pschdprf.dll file but does not remove some registry values when the QoS Packet Scheduler is removed. See ME942393 for a solution.

- Service: MSExchangeDSAccess, dll: dscperf.dll - See ME307613.
- Service: MSSQLServerOLAPService, dll: msmdctr80.dll - See ME296147.
- Service: MSExchangeDS, dll: perfdsa.dll -  See ME174690.
- Service: MSExchangeIMC, dll: gwperf.dll - See ME163727.
- Service: MSExchangeIMC, dll: imsperf.dll - See ME256927.
- Service: w3pcache, dll: Mspmon.dll - See ME159001 and ME176696.
- Service: w3proxy, dll: Mspmon.dll - See ME159001 and ME176696.
- Service: wspsrv, dll: Mspmon.dll - See ME176696.
- Service: WSPSrv, dll: WSPPERF.DLL - See ME159001.
- Service: notestat, dll: nnotes.dll - See ME287264.
- Service: PerfDisk, dll: perfdisk.dll - See ME811066.
- Service: BTSSvc, dll: CISPERF.dll - See ME812477.
- Service: RemoteAccess, dll: rasctrs.dll - See ME830459 and ME835446.
- Service: Nbf, dll: Perfctrs.dll - See ME828872.
- Service: McShield - See "Network Associates Support Solution ID: nai15090", "Network Associates Support Solution ID: nai6288", and "Network Associates Support Solution ID: nai19416".
- Service: AvExchange - Search for "Solution ID: 1.0.14526446.2706559", "Solution ID: nai26839", and "Solution ID: nai26840" on the "Network Associates Support" page.
- Service: MSMQ, dll: MQPERF.DLL - See ME267316.

See "Small Business Server Setup Troubleshooting" for additional information on this event.
- Service: ASP.NET_2.0.50727 - I installed the Extensible Performance Counter List tool from Microsoft, and I disabled the performance counters for "ASP.NET_2.0.50727".
- Service: McShield, dll: dssdata.dll - See "Network Associates Support Solution ID: nai19304".
In my case, I had EventID 2003 from source Perflib occurring three times with w3ctrs.dll, infoctrs.dll, and aspperf.dll. The events appeared at every boot of my SBS 2000 SP4 box. I found ME267831 and decided to run the commands stated in the article. On reboot, my event log was filling up with EventID 1001 from source IISInfoCtrs and EventID 1008 from source Perflib, the last one referring to a failure of the open procedure for service infoctrs.dll. I came to think of the Health Monitor service that it is constantly monitoring performance counters on the box. It must be hard for the system to remove and reinstall performance counter on the same time as they are monitored. I therefore disabled the Health Monitor service. This stopped the events from reappearing in the event log. I then ran the commands all over (ME267831), giving the system some time to execute and fix the individual commands. Health Monitor was then restarted and it was reporting that the system was OK. The errors had stopped reappearing in the log and they did not return upon reboot.
I’ve seen this event a lot when using Big Brother monitoring software on Windows NT4 SP6 servers. As stated in the readme file from Big Brother, you can suppress error messages from performance counters by entering EventLogLevel into the registry (see ME226494). This did the trick for me.
This began appearing after disabling diskperf using the command line "diskperf -n", which was a recommended solution for "EventID 2001 from source PerfDisk". After I ran "diskperf -y" and rebooted the system both errors stopped appearing. See the link to "EventID 2001 from source PerfDisk" for details on the diskperf command.
I had one bad or defective extensible performance DLL that rendered the performance monitoring features of the operating system inoperative. I was able to alleviate this problem by using the ExCtrLst tool. See the links to “ - Perf” and “Exctrlst.exe: Extensible Performance Counter List” for details on this tool.
ME226494 describes how to control the error checking and reporting by registry settings and list the possible event information. This is useful for testing and validating a Performance Monitor Extension. This is also helpful to diagnose problems with performance monitor extensions that are installed as part of a vendor's server application or device driver.
"Tcpip" - Perfctrs.dll - See ME186713.
"ISAPIsearch" - QPerf.dll - See ME228747.
"ContentIndex" - QPerf.dll - See ME228747.

- Data: 00001068 = 4200 decimal = ERROR_WMI_GUID_NOT_FOUND - The GUID passed was not recognized as valid by a WMI data provider. (net helpmsg 4200) - See ME307331 for details on this error code.
Service: "ISAPISearch", dll: "C:\W2KS\System32\query.dll" is usually due an NNTP installation failure. "C:\W2KS\system32\perfwci.ini" is corrupt (file size = 0) on Cisco's install CD. This file sets registry entries for the "ISAPISearch" service during the NNTP installation. Since the file is corrupted, the registry will contain incorrect information after NNTP installation. Follow these steps to replace the corrupted "perfwci.ini" file:
1. Download the "perfwci.ini" file.
2. On the Unity SPE, open Windows Explorer.
3. Browse to locate the downloaded "perfwci.ini" file.
4. Copy the downloaded "perfwci.ini" to the "C:\W2KS\system32\" directory to replace the corrupted "perfwci.ini" file.
5. Click Start > Run, enter "cmd", and click OK to open a command window.
6. Enter "cd %windir%\system32", and press Enter.
7. Enter "unlodctr perfwci.ini", and press Enter.
8. Enter "lodctr perfwci.ini", and press Enter.
9. Enter "exit", and close the command window.
This will reset the registry settings and get rid of those annoying errors in the event log. See the link to Cisco Website for the "perfwci.ini" file.

ESE, eseperf.dll - This is due to a damaged registry setting that causes Exchange 2000 setup to believe that the counters for the database engine are already installed. I found it best that you replace the eseperf.dll, eseperf.hxx, and eseperf.ini in the <path> exchsrvr\bin dir. Then run lodctr eseperf.ini from the bin directory. This fixed the problem for me.
AVExch32Service, GSPerf.dll - AVExch32Service is part of McAfee GroupShield for Exchange (GSE). You may try to remove and reinstall.
Nbf - perfctrs.dll. This error appeared every 3 seconds on SBS2000 after I updated the Intel network software from the MS Update site. The update apparently "unsynched" things because un- and re-installing the Netbeui protocol solved the problem.
Just replace the mentioned file(s) i*.dll in system32 directory with the correct versions (copy from a servicepack or a different comparable system). It worked in my case.
"RemoteAccess" - rasctrs.dll - See ME811089.
"Nwlnknb" - perfctrs.dll - To remedy this situation, I simply went into my network settings and enabled both the NWLink NetBIOS protocol and the NWLink IPX/SPX/Netbios compatible Transport Portocol. As soon as this was completed, no more #1008 errors were being logged. Then, I went back in and disabled both protocols and everything was good.
"FileReplicaSet" - "NTFRSPRF.dll". As per Microsoft the error was fixed in Windows 2000 Service Pack 3. See ME324939.

"ContentFilter" - "Qperf.dll". For Small Business Server 4.5 as per Microsoft this event does not cause problems. See ME228747. It occurs when Performance Monitor counters are not properly implemented for Indexing Service. The  solution is to reinstall IIS 4.0 Performance Monitor Counters. See ME226512 for details.

"ODBC" - "ODBC32.DLL". This event is followed by event id: 0 with source ODBC. From a newsgroup post: The following steps can help:
1. Backup HKLM\SYSTEM\CurrentControlSet\Services\ODBC.
2. Delete HKLM\SYSTEM\CurrentControlSet\Services\ODBC\Performance
3. Re-enable the ODBC performance counters through 'Data Sources (ODBC)' applet under the Administrative Tools. For details see ME216950.

"Nbf" - "perfctrs.dll". "Nbf" means "NetBIOS Frame protocol" and relates to Netbeui (NetBios Enhanced User Interface). Removing Netbeui can solve the problem. However Netbeui is very fast for small LAN communications and removing it can decrease the network performance.
FileReplicaSet, FileReplicaConn - NTFRSPRF.dll. As per a call to Microsoft and their internal documentation to fix this service do the following:  
To work around this behavior, force the File Replication service to re-create the registry keys that point to the system monitor counters for the File Replication service:
1. Type the "net stop NTFRS" (without the quotation marks) command at a command prompt to stop the File Replication service.
2. Start Registry Editor, and then delete the following registry keys:
a. Delete the FileReplicaConn folder and all the subfolders, which are located under the HKLM\System\CurrentControlSet\Services key.
b. Delete the FileReplicaSet folder and all the subfolders, which are located under the HKLM\System\CurrentControlSet\Services key.
3. Restart the File Replication service to place the two keys back in the registry.
4. Restart the server.
"PSched" - pschdprf.dll - According to Microsoft: The performance logging feature in Application Center uses Performance Data Helper (PDH) to collect performance data every 10 seconds. If any performance counter object in the performance library is not available, the error message occurs. The error message references the affected performance counter service name and counter DLL. Because of this, performance counters that are related to this error may not be functioning.
And here is a resolution:
1. Obtain latest Windows 2000 Service Pack.
2. Reinstall the affected service performance counters.
3. Reinstall the product that is associated with PDH that is named in dll path.
4. Change the identity of the Application Center Performance Log consumer (com+ component) to an account with administrative rights. Some performance counters, such as Internet Information Services (IIS) counters, require administrative rights. The Microsoft Application Center Performance Log consumer collects performance data by using a non-administrative account with low privileges (ACL_computername). Therefore, changing the identity of this COM+ component to an account with administrative rights may resolve this issue. Keep in mind that this may produce a security risk. More information: ME299059, also check ME248993.

There are two additional ways to resolve this problem:
- Dr. Watson Does Not Run with Certain Extensible Counters, ME234860
- Troubleshooting Performance Monitor Counter Problems, ME152513.

To disable one or more extensible counter DLL(s):
1. Start the Registry Editor (RegEdt32.exe).
2. Navigate to the following registry subtree:
3. Click Find Key on the View menu.
4. Type Performance as the search string, then search down from there.
5. At each Performance entry you find, select the Library value and modify the library name by prefixing it with two x''s: for example, change OrigLib.dll to xxOrigLib.dll
6. When you have done each Performance entry under the CurrentControlSet \Services key, restart Perfmon to see whether it works. If it does, then repeat the above two steps, only restoring the original library name and trying Perfmon after each change to see which library causes the fault.
For more information see ME152513.

It is not necessary to restart the machine for the changes to take effect: restarting the remote registry service is sufficient.
McShield - dssdata.dll - You may recieve an error in event viewer about Mcaffe's Perfmon Counter's under NT4 Terminal server. To fix, research the following SolutionID: nai6288 under Mcaffe's web site.
SiteScope - I had a similar trouble on an NT4/SP6 machine using SiteScope as monitoring tool; the matter was that the SiteScope user used for checking was not a member of the local administrators group and so it has not full control access on the performace subkey. I give specified grant to the user on the subkey using regdt32.
Tcpip - Perfctrs.dll - This problem is caused by the failure of Inetmib1.dll to initialize properly upon loading where memory is allocated during initialization, but not de-allocated during clean-up. To resolve this problem, obtain the latest service pack for Windows NT 4.0 or Windows NT Server 4.0, Terminal Server Edition. See ME193899.
The best way to repair PerfLib 1008 errors is to use Microsoft Article ME300956. It explains everything from rebuilding the standard library to reinstalling the extensible counters.
DNS - dnsperf.dll - After a little bit of research I found that in HKEY_LOCAL_MACHINE\SYSTEM\currentControlSet\Services\DNS\Performance there seemed to be missing the Last Counter, Last Help, First Counter, First Help, WbemAdapFileTime, WbemAdapFileSize & WbemAdapStatus values. I copied the values from a month old SBS2K server that did not run any reports or performance tests and 1008 has gone away.
Adding the following dword in the registry solved my problem: KEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<service name>\Performance\Disable Performance Counters - with a value of 0x1. This will disable the performance counters for that service (replace <service name> with the service that generates the errors. Of course, this won't help if you need the performance counters!
I'm running SBS server 2000. The only way that I found to stop these events filling my logs was to disable these health monitors.
If you feel that disabling a counter is the solution you can also use this tool to disable it without editing the registry: "Extensible Performance Counter List", aka "exctrlst.exe", found in the W2K Resource Kit.

Content Filter - Qperf.dll. See ME201984.
I had this error with DNS and NTFRS after promoting a member server to a DC. This turned out to be directly related some software that we use called ITO and ERMS. Basically, ERMS monitors services and performance counters and based on a configuration file, it will generate alerts that ITO forwards to a paging service we have. When these were running, the c:\winnt\system32\perfc009.dat file was locked. According to Microsoft, in a system that will not experience these problems, this file will not be locked. After stopping the services associated with my offending application, I tried to rename this file and was successful. I then renamed it back to the original name and tried to re-register the performance counters and sure enough, it worked. I know that not everyone will be running ITO and ERMS, but if you have an application that interfaces with the performance counters such as ERMS, this could work for you to. That file being locked would be a dead giveaway.
"FileReplicaConn" - NTFRS.dll. I started getting this error when I added Remote Install Services. Soon as I removed the service, the event cleared.

"MSDTC" - msdtcui.DLL - no info.
"isactrl" - no info.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.