Performance log and alert error on Windows 2003.

Hi,

With our product's perf dll I'm getting perflib error with event ID 1008 as
folloows on only windows server 2003 and not on windows 2000.
---
Event Type: Error
Event Source: Perflib
Event Category: None
Event ID: 1008
Date: 11/10/2004
Time: 5:14:38 PM
User: N/A
Computer: POPEYE
Description:
The Open Procedure for service "*****" in DLL "C:\Program
Files\**\***Perf.Dll" failed. Performance data for this service will not be
available. The Status code returned is the first DWORD in the attached data.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 05 00 00 00 ....
---
I can capture counter in system monitor but not in performance logs and
alerts. If I change the log on account for "Performance Logs and Alerts"
service to "LocalSystem" from "NetworkService" the perf logs and alerts
works. Does any one know how can I resolve this?

Is there any other group I should be using to post this question?

Thanks.

Is the account you are using a member of "Performance Log Users"

NEVER CHANGE A SERVICE ACCOUNT FROM "Network Service" to "LocalSystem"

LocalSystem is an overprivileged account and should be used with judicious
care.

--
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subjected to the terms specified at
http://www.microsoft.com/info/cpyright.htm.


"RD" <RD@discussions.microsoft.com> wrote in message
news:E8C16DE6-4E01-446B-A4C1-19894AA29397@microsoft.com...
> Hi,
>
> With our product's perf dll I'm getting perflib error with event ID 1008
> as
> folloows on only windows server 2003 and not on windows 2000.
> ---
> Event Type: Error
> Event Source: Perflib
> Event Category: None
> Event ID: 1008
> Date: 11/10/2004
> Time: 5:14:38 PM
> User: N/A
> Computer: POPEYE
> Description:
> The Open Procedure for service "*****" in DLL "C:\Program
> Files\**\***Perf.Dll" failed. Performance data for this service will not
> be
> available. The Status code returned is the first DWORD in the attached
> data.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 05 00 00 00 ....
> ---
> I can capture counter in system monitor but not in performance logs and
> alerts. If I change the log on account for "Performance Logs and Alerts"
> service to "LocalSystem" from "NetworkService" the perf logs and alerts
> works. Does any one know how can I resolve this?
>
> Is there any other group I should be using to post this question?
>
> Thanks.

Thanks for the reply.
If it is not OK to change the service's log on account, how can I resolve
the issue? I added "Everyone" with "Full COntrol" to DLL's ACL but that
didn't work. How 2003 is different from windows 2000 except for the log on
account of "Perfromance Log...." service.

Also, I didn't understand the your question -- "Is the account you are using
a member of "Performance Log Users". Doesn't the extension DLL get loaded by
"Perfromance Log...." service under its log on account?

RD

"Sundaram Narayanan[MSFT]" wrote:

> Is the account you are using a member of "Performance Log Users"
>
> NEVER CHANGE A SERVICE ACCOUNT FROM "Network Service" to "LocalSystem"
>
> LocalSystem is an overprivileged account and should be used with judicious
> care.
>
> --
> This posting is provided "AS IS" with no warranties, and confers no rights.
> Use of included script samples are subjected to the terms specified at
> http://www.microsoft.com/info/cpyright.htm.
>
>
> "RD" <RD@discussions.microsoft.com> wrote in message
> news:E8C16DE6-4E01-446B-A4C1-19894AA29397@microsoft.com...
> > Hi,
> >
> > With our product's perf dll I'm getting perflib error with event ID 1008
> > as
> > folloows on only windows server 2003 and not on windows 2000.
> > ---
> > Event Type: Error
> > Event Source: Perflib
> > Event Category: None
> > Event ID: 1008
> > Date: 11/10/2004
> > Time: 5:14:38 PM
> > User: N/A
> > Computer: POPEYE
> > Description:
> > The Open Procedure for service "*****" in DLL "C:\Program
> > Files\**\***Perf.Dll" failed. Performance data for this service will not
> > be
> > available. The Status code returned is the first DWORD in the attached
> > data.
> >
> > For more information, see Help and Support Center at
> > http://go.microsoft.com/fwlink/events.asp.
> > Data:
> > 0000: 05 00 00 00 ....
> > ---
> > I can capture counter in system monitor but not in performance logs and
> > alerts. If I change the log on account for "Performance Logs and Alerts"
> > service to "LocalSystem" from "NetworkService" the perf logs and alerts
> > works. Does any one know how can I resolve this?
> >
> > Is there any other group I should be using to post this question?
> >
> > Thanks.
>
>
>

On Windows Server 2003 there is a group called Performance Log Users. Any
user trying to use a performance log needs to be a member of this group.
Switch the service account back to network service, add your user to this
group and try to capture the log again.

--
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subjected to the terms specified at
http://www.microsoft.com/info/cpyright.htm.
"RD" <RD@discussions.microsoft.com> wrote in message
news:EE338063-EF31-4072-9A25-C17CF7FC93E0@microsoft.com...
> Thanks for the reply.
> If it is not OK to change the service's log on account, how can I resolve
> the issue? I added "Everyone" with "Full COntrol" to DLL's ACL but that
> didn't work. How 2003 is different from windows 2000 except for the log on
> account of "Perfromance Log...." service.
>
> Also, I didn't understand the your question -- "Is the account you are
> using
> a member of "Performance Log Users". Doesn't the extension DLL get loaded
> by
> "Perfromance Log...." service under its log on account?
>
> RD
>
> "Sundaram Narayanan[MSFT]" wrote:
>
>> Is the account you are using a member of "Performance Log Users"
>>
>> NEVER CHANGE A SERVICE ACCOUNT FROM "Network Service" to "LocalSystem"
>>
>> LocalSystem is an overprivileged account and should be used with
>> judicious
>> care.
>>
>> --
>> This posting is provided "AS IS" with no warranties, and confers no
>> rights.
>> Use of included script samples are subjected to the terms specified at
>> http://www.microsoft.com/info/cpyright.htm.
>>
>>
>> "RD" <RD@discussions.microsoft.com> wrote in message
>> news:E8C16DE6-4E01-446B-A4C1-19894AA29397@microsoft.com...
>> > Hi,
>> >
>> > With our product's perf dll I'm getting perflib error with event ID
>> > 1008
>> > as
>> > folloows on only windows server 2003 and not on windows 2000.
>> > ---
>> > Event Type: Error
>> > Event Source: Perflib
>> > Event Category: None
>> > Event ID: 1008
>> > Date: 11/10/2004
>> > Time: 5:14:38 PM
>> > User: N/A
>> > Computer: POPEYE
>> > Description:
>> > The Open Procedure for service "*****" in DLL "C:\Program
>> > Files\**\***Perf.Dll" failed. Performance data for this service will
>> > not
>> > be
>> > available. The Status code returned is the first DWORD in the attached
>> > data.
>> >
>> > For more information, see Help and Support Center at
>> > http://go.microsoft.com/fwlink/events.asp.
>> > Data:
>> > 0000: 05 00 00 00 ....
>> > ---
>> > I can capture counter in system monitor but not in performance logs and
>> > alerts. If I change the log on account for "Performance Logs and
>> > Alerts"
>> > service to "LocalSystem" from "NetworkService" the perf logs and alerts
>> > works. Does any one know how can I resolve this?
>> >
>> > Is there any other group I should be using to post this question?
>> >
>> > Thanks.
>>
>>
>>

I tried that but didn't work. Since I can scedule the performance counter
log, I beleive the context is that of "NetworkService" and somehow that is
not working. Windows 2000 server don't have this built-in account type, hence
it works fine.

Here is the warning that get logged after the error(pasted below) in the logs.

Event Type: Warning
Event Source: SysmonLog
Event Category: None
Event ID: 2028
Date: 11/11/2004
Time: 1:24:30 PM
User: N/A
Computer: POPEYE
Description:
The service was unable to add the counter '\\POPEYE\***(F:\)\Queue Current
Length' to the test log or alert. This log or alert will continue, but data
for that counter will not be collected. The error returned is: The specified
object is not found on the system.
..

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: b8 0b 00 c0 ¸..À

RD
--

"Sundaram Narayanan[MSFT]" wrote:

> On Windows Server 2003 there is a group called Performance Log Users. Any
> user trying to use a performance log needs to be a member of this group.
> Switch the service account back to network service, add your user to this
> group and try to capture the log again.
>
> --
> This posting is provided "AS IS" with no warranties, and confers no rights.
> Use of included script samples are subjected to the terms specified at
> http://www.microsoft.com/info/cpyright.htm.
> "RD" <RD@discussions.microsoft.com> wrote in message
> news:EE338063-EF31-4072-9A25-C17CF7FC93E0@microsoft.com...
> > Thanks for the reply.
> > If it is not OK to change the service's log on account, how can I resolve
> > the issue? I added "Everyone" with "Full COntrol" to DLL's ACL but that
> > didn't work. How 2003 is different from windows 2000 except for the log on
> > account of "Perfromance Log...." service.
> >
> > Also, I didn't understand the your question -- "Is the account you are
> > using
> > a member of "Performance Log Users". Doesn't the extension DLL get loaded
> > by
> > "Perfromance Log...." service under its log on account?
> >
> > RD
> >
> > "Sundaram Narayanan[MSFT]" wrote:
> >
> >> Is the account you are using a member of "Performance Log Users"
> >>
> >> NEVER CHANGE A SERVICE ACCOUNT FROM "Network Service" to "LocalSystem"
> >>
> >> LocalSystem is an overprivileged account and should be used with
> >> judicious
> >> care.
> >>
> >> --
> >> This posting is provided "AS IS" with no warranties, and confers no
> >> rights.
> >> Use of included script samples are subjected to the terms specified at
> >> http://www.microsoft.com/info/cpyright.htm.
> >>
> >>
> >> "RD" <RD@discussions.microsoft.com> wrote in message
> >> news:E8C16DE6-4E01-446B-A4C1-19894AA29397@microsoft.com...
> >> > Hi,
> >> >
> >> > With our product's perf dll I'm getting perflib error with event ID
> >> > 1008
> >> > as
> >> > folloows on only windows server 2003 and not on windows 2000.
> >> > ---
> >> > Event Type: Error
> >> > Event Source: Perflib
> >> > Event Category: None
> >> > Event ID: 1008
> >> > Date: 11/10/2004
> >> > Time: 5:14:38 PM
> >> > User: N/A
> >> > Computer: POPEYE
> >> > Description:
> >> > The Open Procedure for service "*****" in DLL "C:\Program
> >> > Files\**\***Perf.Dll" failed. Performance data for this service will
> >> > not
> >> > be
> >> > available. The Status code returned is the first DWORD in the attached
> >> > data.
> >> >
> >> > For more information, see Help and Support Center at
> >> > http://go.microsoft.com/fwlink/events.asp.
> >> > Data:
> >> > 0000: 05 00 00 00 ....
> >> > ---
> >> > I can capture counter in system monitor but not in performance logs and
> >> > alerts. If I change the log on account for "Performance Logs and
> >> > Alerts"
> >> > service to "LocalSystem" from "NetworkService" the perf logs and alerts
> >> > works. Does any one know how can I resolve this?
> >> >
> >> > Is there any other group I should be using to post this question?
> >> >
> >> > Thanks.
> >>
> >>
> >>
>
>
>

Hi Sundaram,

I was able to resolve the problem by assigning "Full Control" permission to
"Performance Log Users" group to the
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<myfilterdriver>\Performance
key in the Registry. But I don't understand how it works with other counters
like Exchange server counters I have on same server. Their "Performance" key
doesn't have entry for the "Performance Log Users" group. Any thought on this.

RD.

"RD" wrote:

> I tried that but didn't work. Since I can scedule the performance counter
> log, I beleive the context is that of "NetworkService" and somehow that is
> not working. Windows 2000 server don't have this built-in account type, hence
> it works fine.
>
> Here is the warning that get logged after the error(pasted below) in the logs.
>
> Event Type: Warning
> Event Source: SysmonLog
> Event Category: None
> Event ID: 2028
> Date: 11/11/2004
> Time: 1:24:30 PM
> User: N/A
> Computer: POPEYE
> Description:
> The service was unable to add the counter '\\POPEYE\***(F:\)\Queue Current
> Length' to the test log or alert. This log or alert will continue, but data
> for that counter will not be collected. The error returned is: The specified
> object is not found on the system.
> .
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: b8 0b 00 c0 ¸..À
>
> RD
> --
>
> "Sundaram Narayanan[MSFT]" wrote:
>
> > On Windows Server 2003 there is a group called Performance Log Users. Any
> > user trying to use a performance log needs to be a member of this group.
> > Switch the service account back to network service, add your user to this
> > group and try to capture the log again.
> >
> > --
> > This posting is provided "AS IS" with no warranties, and confers no rights.
> > Use of included script samples are subjected to the terms specified at
> > http://www.microsoft.com/info/cpyright.htm.
> > "RD" <RD@discussions.microsoft.com> wrote in message
> > news:EE338063-EF31-4072-9A25-C17CF7FC93E0@microsoft.com...
> > > Thanks for the reply.
> > > If it is not OK to change the service's log on account, how can I resolve
> > > the issue? I added "Everyone" with "Full COntrol" to DLL's ACL but that
> > > didn't work. How 2003 is different from windows 2000 except for the log on
> > > account of "Perfromance Log...." service.
> > >
> > > Also, I didn't understand the your question -- "Is the account you are
> > > using
> > > a member of "Performance Log Users". Doesn't the extension DLL get loaded
> > > by
> > > "Perfromance Log...." service under its log on account?
> > >
> > > RD
> > >
> > > "Sundaram Narayanan[MSFT]" wrote:
> > >
> > >> Is the account you are using a member of "Performance Log Users"
> > >>
> > >> NEVER CHANGE A SERVICE ACCOUNT FROM "Network Service" to "LocalSystem"
> > >>
> > >> LocalSystem is an overprivileged account and should be used with
> > >> judicious
> > >> care.
> > >>
> > >> --
> > >> This posting is provided "AS IS" with no warranties, and confers no
> > >> rights.
> > >> Use of included script samples are subjected to the terms specified at
> > >> http://www.microsoft.com/info/cpyright.htm.
> > >>
> > >>
> > >> "RD" <RD@discussions.microsoft.com> wrote in message
> > >> news:E8C16DE6-4E01-446B-A4C1-19894AA29397@microsoft.com...
> > >> > Hi,
> > >> >
> > >> > With our product's perf dll I'm getting perflib error with event ID
> > >> > 1008
> > >> > as
> > >> > folloows on only windows server 2003 and not on windows 2000.
> > >> > ---
> > >> > Event Type: Error
> > >> > Event Source: Perflib
> > >> > Event Category: None
> > >> > Event ID: 1008
> > >> > Date: 11/10/2004
> > >> > Time: 5:14:38 PM
> > >> > User: N/A
> > >> > Computer: POPEYE
> > >> > Description:
> > >> > The Open Procedure for service "*****" in DLL "C:\Program
> > >> > Files\**\***Perf.Dll" failed. Performance data for this service will
> > >> > not
> > >> > be
> > >> > available. The Status code returned is the first DWORD in the attached
> > >> > data.
> > >> >
> > >> > For more information, see Help and Support Center at
> > >> > http://go.microsoft.com/fwlink/events.asp.
> > >> > Data:
> > >> > 0000: 05 00 00 00 ....
> > >> > ---
> > >> > I can capture counter in system monitor but not in performance logs and
> > >> > alerts. If I change the log on account for "Performance Logs and
> > >> > Alerts"
> > >> > service to "LocalSystem" from "NetworkService" the perf logs and alerts
> > >> > works. Does any one know how can I resolve this?
> > >> >
> > >> > Is there any other group I should be using to post this question?
> > >> >
> > >> > Thanks.
> > >>
> > >>
> > >>
> >
> >
> >

Does this help?