locked
Perflib Errors + PerfNet Errors in Web Front End Server RRS feed

  • Question

  • Hello

    - been in SP2013 forum - but are directed to this forum for assistance  - so hope that someone can spot the why :)

    Hyper-V Server Windows 2012 R2 running on Windows 2016 Host   

    See this multiple time- restarted the Server service (which running on Local System)  - but it still keeps coming; 

    Event id 1008:

    The Open Procedure for service ".NETFramework" in DLL "C:\Windows\system32\mscoree.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

    event id 2004:

    Unable to open the Server service performance object. The first four bytes (DWORD) of the Data section contains the status code.

    XML view: 

    - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    - <System>
      <Provider Name="Microsoft-Windows-Perflib" Guid="{13B197BD-7CEE-4B4E-8DD0-59314CE374CE}" EventSourceName="Perflib" /> 
      <EventID Qualifiers="49152">1008</EventID> 
      <Version>0</Version> 
      <Level>2</Level> 
      <Task>0</Task> 
      <Opcode>0</Opcode> 
      <Keywords>0x80000000000000</Keywords> 
      <TimeCreated SystemTime="2017-05-16T00:55:54.000000000Z" /> 
      <EventRecordID>99321</EventRecordID> 
      <Correlation /> 
      <Execution ProcessID="0" ThreadID="0" /> 
      <Channel>Application</Channel> 
      <Computer>ServerName</Computer> 
      <Security /> 
      </System>
    - <UserData>
    - <EventXML xmlns="Perflib">
      <param1>.NETFramework</param1> 
      <param2>C:\Windows\system32\mscoree.dll</param2> 
      <binaryDataSize>8</binaryDataSize> 
      <binaryData>0200000000000000</binaryData> 
      </EventXML>
      </UserData>
      </Event>
    - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    - <System>
      <Provider Name="Microsoft-Windows-Perflib" Guid="{13B197BD-7CEE-4B4E-8DD0-59314CE374CE}" EventSourceName="Perflib" /> 
      <EventID Qualifiers="49152">1008</EventID> 
      <Version>0</Version> 
      <Level>2</Level> 
      <Task>0</Task> 
      <Opcode>0</Opcode> 
      <Keywords>0x80000000000000</Keywords> 
      <TimeCreated SystemTime="2017-05-16T00:55:54.000000000Z" /> 
      <EventRecordID>99322</EventRecordID> 
      <Correlation /> 
      <Execution ProcessID="0" ThreadID="0" /> 
      <Channel>Application</Channel> 
      <Computer>ServerName</Computer> 
      <Security /> 
      </System>
    - <UserData>
    - <EventXML xmlns="Perflib">
      <param1>BITS</param1> 
      <param2>C:\Windows\System32\bitsperf.dll</param2> 
      <binaryDataSize>8</binaryDataSize> 
      <binaryData>0200000000000000</binaryData> 
      </EventXML>
      </UserData>
      </Event>

    The Collect Procedure for the "C:\Windows\System32\winspool.drv" service in DLL "Spooler" generated an exception or returned an invalid status. The performance data returned by the counter DLL will not be returned in the Perf Data Block. The first four bytes (DWORD) of the Data section contains the exception code or status code.

     <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    - <System>
      <Provider Name="Microsoft-Windows-Perflib" Guid="{13B197BD-7CEE-4B4E-8DD0-59314CE374CE}" EventSourceName="Perflib" /> 
      <EventID Qualifiers="49152">1010</EventID> 
      <Version>0</Version> 
      <Level>2</Level> 
      <Task>0</Task> 
      <Opcode>0</Opcode> 
      <Keywords>0x80000000000000</Keywords> 
      <TimeCreated SystemTime="2017-05-16T06:45:11.000000000Z" /> 
      <EventRecordID>99344</EventRecordID> 
      <Correlation /> 
      <Execution ProcessID="0" ThreadID="0" /> 
      <Channel>Application</Channel> 
      <Computer>ServerName</Computer> 
      <Security /> 
      </System>
    - <UserData>
    - <EventXML xmlns="Perflib">
      <param1>C:\Windows\System32\winspool.drv</param1> 
      <param2>Spooler</param2> 
      <binaryDataSize>8</binaryDataSize> 
      <binaryData>BA06000000000000</binaryData> 
      </EventXML>
      </UserData>
      </Event>


    • Edited by JmATK Monday, May 22, 2017 5:22 AM
    Monday, May 22, 2017 4:26 AM

Answers

  • Hi Andy 

    Symantec have  been disabled - still the Errors are back - It starts with PerfNet error (event id 2004) at 02:49:23

    "Unable to open the Server service performance object. The first four bytes (DWORD) of the Data section contains the status code." 

    Bits service are running and so is the Server service

    I've no clue why this is happening/triggered in the middle of the night 


    Really strange!

    I suggest you open a case with Microsoft, more in-depth investigation can be done so that you would get a more satisfying explanation and solution to this issue.
    Here is the link:
    https://support.microsoft.com/en-us/gp/support-options-for-business 

    Best regards,

    Andy


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    • Marked as answer by JmATK Friday, June 9, 2017 5:48 AM
    Friday, June 9, 2017 4:59 AM

All replies

  • Hi,

    From these event logs to see:first we need to ensure that Spooler, BITs services  running smoothly.

    Then using: Lodctr.exe /R to rebuilt it.

    https://technet.microsoft.com/en-us/library/bb490926.aspx

    Lastly running:

    C:\Windows\System32\wbem\winmgmt.exe /RESYNCPERF
    C:\Windows\SysWOW64\wbem\winmgmt.exe /RESYNCPERF

    Adding an official link:

    https://technet.microsoft.com/en-us/library/cc774913(v=ws.10).aspx

    Best regards,

    Andy


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    • Edited by Hello_2018 Tuesday, May 23, 2017 6:29 AM
    • Marked as answer by JmATK Tuesday, May 23, 2017 7:19 AM
    • Unmarked as answer by JmATK Thursday, June 1, 2017 4:25 AM
    Tuesday, May 23, 2017 6:28 AM
  • Hi Andy 

    Thank you :D - the errors are gone :D 

    Tuesday, May 23, 2017 7:23 AM
  • Hi Andy 

    Thank you :D - the errors are gone :D 

    Today is a beautiful day!


    • Edited by Hello_2018 Tuesday, May 23, 2017 7:25 AM
    Tuesday, May 23, 2017 7:25 AM
  • Hi Andy 

    The Errors are back ... :(

    the server runs fine during business hour... no entries in Event viewer ...then suddenly (at 02:49 am) event ID 2004 & 1010 appears....so why is this triggered at night? 


    "Unable to open the Server service performance object. The first four bytes (DWORD) of the Data section contains the status code."

     

    Thursday, June 1, 2017 4:28 AM
  • Hi Andy 

    The Errors are back ... :(

    the server runs fine during business hour... no entries in Event viewer ...then suddenly (at 02:49 am) event ID 2004 & 1010 appears....so why is this triggered at night? 


    "Unable to open the Server service performance object. The first four bytes (DWORD) of the Data section contains the status code."

     

    Besides of these logs, did you see any other logs or application logs triggered during this happened?

    we can't find out the root cause with less info.

    Best regards,

    Andy


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, June 5, 2017 5:30 AM
  • Hi Andy 

    Nope - no other logs - the Application running are:

    SharePoint

    Symantec antivirus

    Can I disable something so these PerfLib/PerfNet errors wont appear?  

    Monday, June 5, 2017 5:36 AM
  • Hi JmATK,

    >>Can I disable something so these PerfLib/PerfNet errors wont appear?  

    If you have to do this, i suspect you could temporary disable the Symantec to see if this issue occurs again.

    Just for testing purpose.

    Best regards,

    Andy


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, June 5, 2017 7:43 AM
  • Hi JmATK,

    Do you have any updates?

    Best regards,

    Andy


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, June 7, 2017 1:41 AM
  • Hi Andy 

    Just waiting reply from security to disable the Symantec... :D  

    Wednesday, June 7, 2017 4:52 AM
  • Hi Andy 

    Just waiting reply from security to disable the Symantec... :D  

    Great!

    Hope to see more results.

    Have a nice day!


    • Edited by Hello_2018 Wednesday, June 7, 2017 5:15 AM
    Wednesday, June 7, 2017 5:15 AM
  • Hi Andy 

    Symantec have  been disabled - still the Errors are back - It starts with PerfNet error (event id 2004) at 02:49:23

    "Unable to open the Server service performance object. The first four bytes (DWORD) of the Data section contains the status code." 

    Bits service are running and so is the Server service

    I've no clue why this is happening/triggered in the middle of the night 


    • Edited by JmATK Friday, June 9, 2017 4:39 AM
    Friday, June 9, 2017 4:35 AM
  • Hi Andy 

    Symantec have  been disabled - still the Errors are back - It starts with PerfNet error (event id 2004) at 02:49:23

    "Unable to open the Server service performance object. The first four bytes (DWORD) of the Data section contains the status code." 

    Bits service are running and so is the Server service

    I've no clue why this is happening/triggered in the middle of the night 


    Really strange!

    I suggest you open a case with Microsoft, more in-depth investigation can be done so that you would get a more satisfying explanation and solution to this issue.
    Here is the link:
    https://support.microsoft.com/en-us/gp/support-options-for-business 

    Best regards,

    Andy


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    • Marked as answer by JmATK Friday, June 9, 2017 5:48 AM
    Friday, June 9, 2017 4:59 AM
  • Hi Andy 

    ok - thank You for your time and effort :D  

    Friday, June 9, 2017 5:48 AM
  • Hi Andy 

    ok - thank You for your time and effort :D  

    No thanks, my friend!

    Have a nice day!

    Best regards,

    Andy



    • Edited by Hello_2018 Friday, June 9, 2017 5:52 AM
    Friday, June 9, 2017 5:52 AM
  • Hi Andy 

    Update: Forund out its triggered by a AppPool Recycle that happens 02:49 

    and seeing this 10016 DistributedCom 

    The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID: .... IIS WAMREG admin Service

    Monday, June 12, 2017 6:54 AM
  • Hi Andy 

    Update: Forund out its triggered by a AppPool Recycle that happens 02:49 

    and seeing this 10016 DistributedCom 

    The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID: .... IIS WAMREG admin Service

    A big thanks for sharing this.

    I suppose this will help others who encountered the similar issue.

    Have a nice day!

    Best regards,

    Andy


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Tuesday, June 13, 2017 1:43 AM
  • JmATK,

    I got the same error days. I don't understand your post above completely. It would be greatly appreciated if you could drop couple more lines for the procedure to fix the error.

    Thank you.

    Charles

    Monday, June 26, 2017 4:16 PM
  • Hi Charles 

    I found the reg key in the Event viewer (error) and went into the regedit.exe and searched for the similar key - edited the permissions (granted the WSS_Admin & WSS_WPG group full control to the keys)    

    You might experience that you can't edit but these solved it for me:  

    http://www.sharepointblogs.be/blogs/vandest/archive/2012/11/29/fixing-sharepoint-dcom-errors-the-easy-way.aspx 

    http://www.sysadminsblog.com/microsoft/unable-to-edit-the-dcom-settings

    Hope it helps :D 
    • Edited by JmATK Tuesday, June 27, 2017 4:07 AM
    Tuesday, June 27, 2017 4:06 AM