Registry values
The performance library (perflib), part of ADVAPI32.dll, reads three REG_DWORD registry values that control different levels of error checking and reporting. These values are in the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib
If these values are not present, you can add the values. The change takes effect after you restart Performance Monitor or another performance monitoring tool.
Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
322756 How to back up and restore the registry in Windows
The following value names are followed by possible values and their meanings.
ExtCounterTestLevel
1 - object and counter lengths are checked for consistency
2 - buffer overflows or guard pages are checked
3 - no checking is made but does not suppress exception handling
EventLogLevel
0 - no errors are reported
1 - user event log error messages (1000-1013)
2 - warnings and errors used for debugging (1000-2002)
3 - verbose, all information (1000-3000)
If
OpenProcedureWaitTime value is present, perflib sets up a timeout procedure internally. If the
Open function of a performance monitor extension DLL does not return within the time specified, in milliseconds, in this registry value an event (2002) is posted to the Event Log. However, it only controls the reporting of the fact, it doesn't control the behavior. For example, if an
Open function "hangs" then the performance monitor process will "hang" regardless of the presence of this registry value.
Registry values for Windows 2000
Starting with Windows 2000 a new wait time registry entry was added for the collect function. The previous three registry values also work on Windows 2000 as described earlier. The new registry entry is placed in the following registry key.
HKEY_LOCAL_MACHINE
\SYSTEM
\CurrentControlSet
\Services
\(service name)
\Performance
The
Collect Timeout value is new in Windows 2000. Note the space in the value name. If this value is present, perflib sets up a timeout procedure internally. If the
Collect function of a performance monitor extension DLL does not return within the time specified, in milliseconds, in this registry value an event (1015) is posted to the Event Log.
Open Timeout
The
Open Timeout value is new in Windows 2000. Note the space in
the value name. If this value is present, perflib sets up a timeout
procedure internally. If the
Open function of a performance monitor
extension DLL does not return within the time specified, in
milliseconds, in this registry value an event (2002) is posted to the
Event Log.
Note In Windows 2000,
OpenProcedureWaitTime is global to all
performance extension DLLs. If the
Open Timeout registry value, which is performance extension DLL-specific, is not present, then the operating system will use the global
OpenProcedureWaitTime registry value, if it is present. Similarly, if the
Collect Timeout registry value is not present, the operating system will use the global
OpenProcedureWaitTime registry value, if present. If the
OpenProcedureWaitTime registry value is
not present, the default timeout value is 10,000 (milliseconds).
Event IDs and descriptions
The following is a list of event IDs and the detailed error text displayed in the
Details dialog box of Event Viewer. Some of the following items also include additional information about the interpretation of the event details. Also, each of the items give an expertise level to suggest who may be able to address the issue.
Many of the following descriptions refer to a DWORD in the
Data field of the
Event Details dialog box. Note the data is arranged in byte order and to interpret a DWORD on Intel systems you must read 4 bytes at a time each byte in reverse order. For example 05 00 00 C0 may appear in the
Data field, but the DWORD is read C0000005.
Event ID: 1000Detail Text: Access to performance data was denied to (username) as attempted from (calling module name)
Interpretation: The following key is checked for security access:
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib
If the user associated with the client thread or process token is not on the ACL for this key then this event is posted.
Expertise: System Administrator
Event ID: 1001Detail Text: The buffer size returned by a collect procedure in Extensible Counter DLL (DLL name) for the (service name) service was larger than the space available. Performance data returned by counter DLL will not be returned in Perf Data Block. Overflow size is data DWORD 0.
Interpretation: Perflib finds that the beginning pointer for the data buffer is not pointing past the end of the buffer including safe buffer.
Expertise: Developer of named extensible counter DLL
Event ID: 1002Detail Text: A Guard Page was modified by a collect procedure in Extensible
Counter DLL (DLL name) for the (service name) service. Performance data
returned by counter DLL will not be returned in Perf Data Block.
Interpretation: Perflib implements a safe buffer that adds some space in the buffer filled with some signature byte. This event means the extension has written past the end of the buffer.
Expertise: Developer of named extensible counter DLL
Event ID: 1003Detail Text: The object length of an object returned by Extensible Counter DLL (DLL name) for the (service name) service was not correct. The sum of the object lengths returned did not match the size of the buffer returned. Performance data returned by counter DLL will not be returned in Perf Data Block. Count of objects returned is data DWORD 0.
Interpretation: After the collect function returns, perflib validates the
TotalByteLength members of each
PERF_OBJECT_TYPE structure returned by the performance extension. This error event means there is problem with one or more TotalByteLength values in the
PERF_OBJECT_TYPE structures.
Expertise: Developer of named extensible counter DLL
Event ID: 1004Detail Text: The instance length of an object returned by Extensible Counter DLL (DLL name) for the (service name) service was incorrect. The sum of the instance lengths plus the object definition structures did not match the size of the object. Performance data returned by counter DLL will
not be returned in Perf Data Block. The object title index of the
bad object is data DWORD 0.
Interpretation: After the collect function returns perflib validates the
PERF_INSTANCE_DEFINITION ByteLength and
PERF_COUNTER_BLOCK ByteLength members, if the object has instances. This error event means the ByteLength member is incorrect.
Expertise: Developer of named extensible counter DLL
Event ID: 1005Detail Text: Unable to locate the open procedure (open proc name) in DLL (DLL name) for the (service name) service. Performance data for this service will not be available. Error Status is data DWORD 0.
Interpretation: Perflib calls GetProcAddress for the function name specified as the Open procedure in the registry for the extension. This error typically means the name was not found either because the extension DLL did not correctly export it, or the DLL was compiled with C++ code and extern "C" declaration was not used.
Expertise: Developer of named extensible counter DLL
Event ID: 1006Detail Text: Unable to locate the collect procedure (collect proc name) in DLL (DLL name) for the (service name) service. Performance data for this service will not be available. Error Status is data DWORD 0.
Interpretation: Perflib calls GetProcAddress for the function name specified as the Collect procedure in the registry for the extension. This error typically means the name was not found either because the extension DLL did not correctly export it, or the DLL was compiled with C++ code and extern "C" declaration was not used.
Expertise: Developer of named extensible counter DLL
Event ID: 1007Detail Text: Unable to locate the close procedure (close proc name) in DLL (DLL name) for the (service name) service. Performance data for this service will not be available. Error Status is data DWORD 0.
Interpretation: Perflib calls GetProcAddress for the function name specified as the Close procedure in the registry for the extension. This error typically means the name was not found either because the extension DLL did not correctly export it, or the DLL was compiled with C++ code and extern "C" declaration was not used.
Expertise: Developer of named extensible counter DLL
Event ID: 1008Detail Text: The Open Procedure for service (service name) in DLL (DLL name) failed. Performance data for this service will not be available. Status code returned is DWORD 0.
Interpretation: If the
Open function for an extension does not return ERROR_SUCCESS, perflib posts the status code in the data field of the event. This may be used to help the author of the extension determine why the
Open function failed.
Expertise: Developer of named extensible counter DLL
Event ID: 1009Detail Text: The Open Procedure for service (service name) in DLL (DLL name) generated an exception. Performance data for this service will not be available. Exception code returned is DWORD 0.
Interpretation: Perflib calls the performance extension functions in a structured exception handler __try block. This is posted if an exception occurred or RaiseException was called in the
Open function. The data field will have the exception code. For example, C0000005 means there was an Access Violation.
Expertise: Developer of named extensible counter DLL
Event ID: 1010Detail Text: The Collect Procedure for the (service name) service in DLL (DLL name) generated an exception or returned an invalid status. Performance data returned by counter DLL will not be returned in Perf Data Block. Exception or status code returned is DWORD 0.
Interpretation: Perflib calls the performance extension functions in a structured exception handler __try block. This is posted if an exception occurred or RaiseException was called in the Collect function. The data field will have the exception code. For example, C0000005 means there was an Access Violation.
Expertise: Developer of named extensible counter DLL
Event ID: 1011Detail Text: The library file (DLL name) specified for the (service name) service could not be opened. Performance data for this service will not be available. Status code is data DWORD 0.
Interpretation: Perflib uses LoadLibrary to open performance extensions. If LoadLibrary fails the status code from GetLastError is posted in the data field of the event. For example, 7e means the DLL could not be found or the library Name in the registry is not correct.
Expertise: System administrator or developer of named extensible counter DLL
Event ID: 1012Detail Text: The system reported an idle process time that was less than the last time reported. The data shows the current time and the last reported time for the system's idle process.
Interpretation: This event is not used by Perflib
Expertise: None
Event ID: 1013Detail Text: The collect procedure in Extensible Counter DLL (DLL name) for the (service name) service returned a buffer that was larger than the space allocated and may have corrupted the application's heap. This DLL should be disabled or removed from the system until the problem has been corrected to prevent further corruption. The application accessing this performance data should be restarted. The Performance data returned by counter DLL will not be returned in Perf Data Block. Overflow size is data DWORD 0.
Expertise: Developer of named extensible counter DLL
Event ID: 1014 Only available on Windows 2000Detail Text: An error occurred while trying to collect data from the Server Object. The Error code returned by the function is DWORD 0. The Status returned in the IO Status Block is DWORD 1.
The Information field of the IO Status Block is DWORD 2.
Interpretation: This event is not used by perflib.
Expertise: None
Event ID: 1015 Only available on Windows 2000Detail Text: The timeout waiting for the performance data collection function (function name) to finish has expired. There may be a problem with that extensible counter or the service from which it is collecting data.
Expertise: Developer of named extensible counter DLL
Interpretation:See comments about the Collect Timeout registry value
Event ID: 1016 Only available on Windows 2000Detail Text: The data buffer created for the (service name) service in the (DLL name) library is not aligned on an 8-byte boundary. This may cause problems for applications that are trying to read the performance data buffer. Contact the manufacturer of this library or service to have this problem corrected or to get a newer version of this library.
Expertise: Developer of named extensible counter DLL
Event ID: 1017 Only available on Windows 2000Detail Text: Performance counter data collection from the (service name) service has been disabled due to one or more errors generated by the performance counter library for that service. The error(s) that forced this action have been written to the application event log. The error(s) should be corrected before the performance counters for this service are enabled again.
Expertise: Developer of named extensible counter DLL
Event ID: 1018 Only available on Windows 2000Detail Text: Performance counter data collection from the (service name) service has been disabled for this session due to one or more errors generated by the performance counter library for that service. The error(s) that forced this action have been written to the application event log.
Expertise: Developer of named extensible counter DLL
Event ID: 1019 Only available on Windows 2000Detail Text: A definition field in an object returned by Extensible Counter DLL (DLL name) for the (service name) service was incorrect. The sum of the
definitions block lengths in the object definition structures did not
match the size specified in the object definition header. Performance data
returned by this counter DLL will be not be returned in Perf Data Block.
The object title index of the bad object is data DWORD 0.
Interpretation:Similar to Event 1003 except the sum of the structure counter definition length members is checked. This event typically means the ByteLength of one of the counter definition structures of the performance data object is incorrect.
Expertise: Developer of named extensible counter DLL
Event ID: 1020 Only available on Windows 2000Detail Text: The size of the buffer used is greater than that passed to the collect function of the (DLL name) Extensible Counter DLL for the (service name) service. The size of the buffer passed in is data DWORD 0 and the size returned is data DWORD 1.
Interpretation:Similar to Event 1001 except more information about the size of the buffer expected by the extension is given.
Expertise: Developer of named extensible counter DLL
Event ID: 2000Detail Text: The pointer returned did not match the buffer length returned by the Collect procedure for the (service name) service in Extensible Counter DLL (DLL name). The Length will be adjusted to match and the performance data will appear in the Perf Data Block. The returned length is data DWORD 0, the new length is data DWORD 1.
Interpretation: This event is used for the development and debugging of a performance monitor extension. After the collect procedure is called return parameters are checked for consistency. In this case the number of bytes added to the perf data buffer is checked against the actual difference in the buffer pointer before and after the collect procedure is called.
Expertise: Developer of the named extensible counter DLL
Event ID: 2001Detail Text: The (service name) service does not have a Performance subkey or the key could not be opened. No performance counters will be collected for this service. The Win32 error code is returned in the data.
Interpretation: This event is saying an item under the Services subkey does not contain a Performance subkey (or it could not be opened, for example, due to security access). This is posted for each item under the Service subkey.
Expertise: System administrator or developer of named service
Event ID: 2002Detail Text: The open procedure for service (service name) in DLL (DLL name) has taken longer than the established wait time to complete. The wait time in milliseconds is shown in the data.
Interpretation: See the comments earlier regarding the
Open Timeout registry value.
Expertise: Developer of named extensible counter DLL
Event ID: 2003 Only available on Windows 2000Detail Text:The configuration information of the performance library (DLL name) for the (service name) service does not match the trusted performance library information stored in the registry. The functions in this library will not be treated
as trusted.
Interpretation: If the "Library Validation Code" value exists for the named service in the Performance subkey, the data is checked against the file creation time and the file size of the named DLL. This error is posted if they do not match. If the error occurs, it may be corrected by removing and reinstalling the named service.
Expertise: System administrator or developer of named service
Event ID: 3000Detail Text: Open procedure for service (service name) in DLL (DLL name) was called and returned successfully.
Expertise: Novice