locked
LogicalDisk Perfmon counter generates errors Event ID: 2029 and Event ID: 2028 RRS feed

Answers

  • Hi everyone,

    I just wanted to say it has been resolved with the help of microsoft.

    I'll explain my problem again for claraty sake:

    When adding a LogicalDisk counter in the perfmon i would get an error after trying to start the counter (Event ID 2003) The counter could not be started and Event ID 1008, 1001 and 2003 would come back in the eventlog at a regular interval.

    On another server i could add the LogicalDisk counter and start it without any errors, but the logs would come up empty as displayed:
    "04/11/2012 17:31:00.777"," "   (correct counters should have a value between the last two qoutations

    Both problems were solved as followed:

    1. Open regedit en navigate to MKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfDisk\Performance, open the properties of the "Performance" key by right click and navigate to the security tab, there make sure the usergroup everyone is added with read permissions

    2. In the above key make sure that the REG_DWORD named "Disable Performance Counters" is set to 0, (if set to 1 performance counters will not work)

    3. Navigate to C:\Windows\System32 and locate the following files: perfc009.dat, perfd009.dat, perfh009.dat and perfi009.dat open properties and make sure the usergroup "everyone" has read permissions (again in the security tab) if the group "everyone" is not added, add it.

    4. Open services and restart (or start) Performance Logs and Alerts

    This solved my problems and i hope it helps you solve yours

    
    
    
    
    
    
    
    
    Thursday, April 12, 2012 11:06 AM

All replies

  • Have you read KB?

    http://support.microsoft.com/kb/240389/en-us

    Try running

    lodctr /r: c:\winn commandt\system32\perfstringbackup.ini  

    Regards

    Milos

     


    Friday, January 13, 2012 12:57 PM
  • refer to KB :Log Is Not Started When You Try to Start a Log with Remote Counters in System Monitor:

    http://support.microsoft.com/kb/240389

    And also check the remote registry service is running on the both the machines.


    Gopi Kiran |Facebook| This posting is provided AS IS with no warranties,and confers no rights.
    Friday, January 13, 2012 1:06 PM
  • @ Gopi Thank you for your response, the preformance Logs and Alerts are started and working under the account "Network Service"
    Services are running on both servers

    @ Milos Thank you for your response, i only have problems with the LogicalDisk counter, i'd like to leave the other counters as-is since it took me some time getting the exchange counters back to working state

    lodctr /R:PerfStringBackup.ini

    Note: Running this lodctr command may remove performance counters that were added after the PerfStringBackup.ini backup was created. You may have to reinstall any extensible counters or the programs that installed them

    Friday, January 13, 2012 3:41 PM
  • do u have MOM installed in ur Environment. ?? If yes try to stop the service and check it.

    In ur case you are able to Performance objects, but the values are not recorded

    check this KB: How to manually rebuild Performance Counter Library values

    http://support.microsoft.com/kb/300956

    http://www.red-gate.com/supportcenter/content/knowledgebase/ANTS_Performance_Profiler/KB200810000316

    http://networkadminkb.com/KB/a34/how-to-correct-corrupt-performance-counters.aspx

    some times it also issue with .netframe work versions on the both the systems..

    --------------------

    I was goggling and found this solution in one of forums:

      Resolve the problem by assigning "Full Control" permission to "Performance Log Users" group to the
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<myfilterdriver>\Performance
    key in the Registry.

    Hope it helps..


    Gopi Kiran |Facebook| This posting is provided AS IS with no warranties,and confers no rights.
    • Edited by Gopi Kiran Friday, January 13, 2012 4:29 PM
    Friday, January 13, 2012 4:27 PM
  • Hi Gopi,

    Thank you for your time, as stated in my original post i already tried KB3000956.

    Thing is; all other counters work perfectly, only the LogicalDisk did not work. So from there i tried to rebuild the counters manually en that resulted in the fact of the Exchange counters not working. Ik fixed the Exchange counter but could not get the LogicalDisk counter working, the problem that started this all :\

    I think i might have to opena case with microsoft. I'll post whatever Miscrosoft does to help others with this problem.

    Monday, January 16, 2012 8:37 AM
  • did u follow this :http://networkadminkb.com/KB/a34/how-to-correct-corrupt-performance-counters.aspx

    create a backup of all Performance Counters and repairing all the counters..


    Gopi Kiran |Facebook| This posting is provided AS IS with no warranties,and confers no rights.
    Tuesday, January 17, 2012 5:50 AM
  • Yes, i tried that one aswell, opening a call with Ms as we speak.

    i'll post whatever they advice as soon as a solution is found.

    • Marked as answer by Elytis Cheng Tuesday, January 24, 2012 2:17 AM
    • Unmarked as answer by Leo Schoonhoven Friday, January 27, 2012 9:57 AM
    Tuesday, January 17, 2012 10:54 AM
  • Hi everyone,

    I followed these steps provided by Microsoft to diagnose the cause of my errors:


    1. Clean boot the server following as described on the following article: http://support.microsoft.com/kb/331796
    2. Collect log and diagnostic data:
    3. Collect MPS reports:
    Run MPS Report(s) from below URL:
    http://www.microsoft.com/downloads/details.aspx?FamilyId=CEBF3C7C-7CA5-408F-88B7-F9C79B7306C0&displaylang=en

    Configure the report gathering as follows:
    “General”
    “Internet and Networking”
    “Business Networks”
    “Server Components”
    “Windows Update Services”

    When asked to export the event logs select “All”. Select “Save the results”.

    4. Rebuild performance counters as you did before following the article http://support.microsoft.com/?id=300956
    5. Download Process Monitor from the following url: http://technet.microsoft.com/en-us/sysinternals/bb896645
    6. Extract Process monitor in a folder of your choice which I’ll refer as c:\tools
    7. Open a command prompt and change directory to c:\tools
    8. Run the following: procmon /Quiet /Minimized /BackingFile <Servername>.PML
    9. Run the following from the command prompt:
    logman create counter perf_log -c “\LogicalDisk(C:)\Free Megabytes”
    logman start perf_log
    10. Wait 30 seconds and run the following from the command prompt you opened at #7:
    procmon /Terminate
    11. Compress the file BGFS01.PML in c:\tools
    12. Wait 3 minutes and see if the events 2028 and 2029 are logged
    13. Stop logman running the following from the command prompt:
    Logman stop perf_log
    14. Upload the following to the workspace:
    a. CAB file created at #3
    b. Send the compressed capture created with process monitor at #10

    Fun fact, the created log named perf_log worked without generating any errors, so no error 2028 or 2029, when this was done the server was booted in clean state. After step 13 i restarted the server back in to normal state and went home ( long day)

    The next day i tried creating counters via the Command prompt (with a different counter name) but got the 2028 and 2029 error. Even starting the perf_log that was created in step 9 could not start en generated said errors 2028 and 2029.

    I now have a lot op Perflib Errors, i tries reregistering all of stated DLL's but to no avail


    Event Type: Error
    Event Source: Perflib
    Event Category: None
    Event ID: 1008
    Date:  27-1-2012
    Time:  10:45:18
    User:  N/A
    Computer: <ServerName>
    Description:
    The Open Procedure for service "ASP" in DLL "C:\WINDOWS\system32\aspperf.dll" failed. Performance data for this service will not be available. The Status code returned is the first DWORD in the attached data.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
    Data:
    0000: 02 00 00 00 00 00 00 00   ........

    Event Type: Error
    Event Source: Perflib
    Event Category: None
    Event ID: 1008
    Date:  27-1-2012
    Time:  10:45:18
    User:  N/A
    Computer: <ServerName>
    Description:
    The Open Procedure for service "ContentFilter" in DLL "C:\WINDOWS\System32\query.dll" failed. Performance data for this service will not be available. The Status code returned is the first DWORD in the attached data.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
    Data:
    0000: 02 00 00 00 00 00 00 00   ........

    Event Type: Error
    Event Source: Perflib
    Event Category: None
    Event ID: 1008
    Date:  27-1-2012
    Time:  10:45:18
    User:  N/A
    Computer: <ServerName>
    Description:
    The Open Procedure for service "ContentIndex" in DLL "C:\WINDOWS\System32\query.dll" failed. Performance data for this service will not be available. The Status code returned is the first DWORD in the attached data.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
    Data:
    0000: 02 00 00 00 00 00 00 00   ........

    Event Type: Error
    Event Source: Perflib
    Event Category: None
    Event ID: 1008
    Date:  27-1-2012
    Time:  10:45:18
    User:  N/A
    Computer: <ServerName>
    Description:
    The Open Procedure for service "Dfsr" in DLL "C:\WINDOWS\system32\DfsrPerf.dll" failed. Performance data for this service will not be available. The Status code returned is the first DWORD in the attached data.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
    Data:
    0000: 02 00 00 00 00 00 00 00   ........

    Event Type: Error
    Event Source: Perflib
    Event Category: None
    Event ID: 1008
    Date:  27-1-2012
    Time:  10:45:18
    User:  N/A
    Computer: <ServerName>
    Description:
    The Open Procedure for service "DNS" in DLL "C:\WINDOWS\system32\dnsperf.dll" failed. Performance data for this service will not be available. The Status code returned is the first DWORD in the attached data.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
    Data:
    0000: 02 00 00 00 00 00 00 00   ........

    Event Type: Error
    Event Source: Perflib
    Event Category: None
    Event ID: 1008
    Date:  27-1-2012
    Time:  10:45:18
    User:  N/A
    Computer: <ServerName>
    Description:
    The Open Procedure for service "ESE" in DLL "D:\Program Files\Microsoft\Exchange Server\Bin\Perf\AMD64\eseperf.dll" failed. Performance data for this service will not be available. The Status code returned is the first DWORD in the attached data.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
    Data:
    0000: 02 00 00 00 00 00 00 00   ........

    I also see these errors in the in the event log and i executed the solution to this problem http://social.technet.microsoft.com/Forums/en-US/exchangesvrgeneral/thread/eb15c6ad-216f-4a70-a78a-1d09bf82c0db/ and executed ResetSearchIndex.ps1 [-force] -all from this http://technet.microsoft.com/en-us/library/aa995966(EXCHG.80).aspx but to no avail.

    I first got this one:

    Event Type: Error
    Event Source: MSExchange Common
    Event Category: General
    Event ID: 106
    Date:  27-1-2012
    Time:  10:48:10
    User:  N/A
    Computer: BGFS01
    Description:
    Performance counter updating error. Counter name is Number of Mailboxes Left to Crawl, category name is MSExchange Search Indices. Optional code: 2.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

    After i executed ResetSearchIndex.ps1 [-force] -all in the exchange command shell i got this error:

    Event Type: Error
    Event Source: MSExchange Common
    Event Category: General
    Event ID: 106
    Date:  27-1-2012
    Time:  11:03:42
    User:  N/A
    Computer: BGFS01
    Description:
    Performance counter updating error. Counter name is Number of HTML Message Bodies, category name is MSExchange Search Indices. Optional code: 1.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

    Some advice would be awesome!

    Friday, January 27, 2012 10:50 AM
  • I think we are running out of the options. we can try some steps Before doing Repair installation.

    I can't find a way to reinstall Perfmon without Repair/reinstalling windows.

    -------

    U can try doing these steps :

    1.Clean registry with wise registry cleaner to remove unused and old registry entries.

    2. try registering the dll again (we have DLL fixer software which fixes dll/sys errors Not sure it supports 2003 or not)

    -------------

    Check registry key that was the cause of the error.

    Ex : HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfOS\Performance

    in it there was a Disable Performance Counters value that was set to 1. change the value to 0 and rebooted the computer. 

    There's also other PerfXX keys @ HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services. If you're missing other counters, try look into these or do a registry find for Disable Performance Counters.

    http://channel9.msdn.com/Forums/TechOff/59699-perfmon-counters-are-corrupted

    ---------------------------

    we have alternative for perfmon : PA Server Monitor and some open source software.


    Gopi Kiran |Facebook| This posting is provided AS IS with no warranties,and confers no rights.
    Saturday, January 28, 2012 7:57 PM
  • Why & who marked the comments of mine as Abuse?

    Guys this is Public forum. If you are not satisfied with the solution, give us the proper reason and apart from that a better solution for the issue. Some ethics has to be maintain when ur posting/reporting the comments as Abuse. If ur not sure what the Meaning of the abuse, please do a google/bing search.



    Gopi Kiran |Facebook| This posting is provided AS IS with no warranties,and confers no rights.
    • Edited by Gopi Kiran Sunday, January 29, 2012 7:00 AM
    Sunday, January 29, 2012 6:45 AM
  • Hi Gopi,

    No idea who marked your posts as Abuse, i'm greatfull for your posts.

    Repair installation is not an option since we are talking about a main domain controller/Exchange server
    I will try your sugestions and let you know the results. 

    Monday, January 30, 2012 8:43 AM
  • Hi everyone,

    I just wanted to say it has been resolved with the help of microsoft.

    I'll explain my problem again for claraty sake:

    When adding a LogicalDisk counter in the perfmon i would get an error after trying to start the counter (Event ID 2003) The counter could not be started and Event ID 1008, 1001 and 2003 would come back in the eventlog at a regular interval.

    On another server i could add the LogicalDisk counter and start it without any errors, but the logs would come up empty as displayed:
    "04/11/2012 17:31:00.777"," "   (correct counters should have a value between the last two qoutations

    Both problems were solved as followed:

    1. Open regedit en navigate to MKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfDisk\Performance, open the properties of the "Performance" key by right click and navigate to the security tab, there make sure the usergroup everyone is added with read permissions

    2. In the above key make sure that the REG_DWORD named "Disable Performance Counters" is set to 0, (if set to 1 performance counters will not work)

    3. Navigate to C:\Windows\System32 and locate the following files: perfc009.dat, perfd009.dat, perfh009.dat and perfi009.dat open properties and make sure the usergroup "everyone" has read permissions (again in the security tab) if the group "everyone" is not added, add it.

    4. Open services and restart (or start) Performance Logs and Alerts

    This solved my problems and i hope it helps you solve yours

    
    
    
    
    
    
    
    
    Thursday, April 12, 2012 11:06 AM
  • Thanks Shadowfly,

    I know this is an old thread but I was about to open a case with MS when I came upon this.

    Changing permissions on keys and perf dat files has resolved our same issue on 2003 server running Exchange 2007.

    Thanks

    Thursday, May 9, 2013 1:26 PM