Microsoft KB Archive/226494

{|
 * width="100%"|

INFO: Events for Performance Monitor Extensions

 * }

Q226494

-

The information in this article applies to:


 * Microsoft Windows NT Server version 4.0
 * Microsoft Windows NT Workstation version 4.0
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Server
 * Microsoft Windows 2000 Professional

-

IMPORTANT: This article contains information about editing the registry. Before you edit the registry, make sure you understand how to restore it if a problem occurs. For information about how to do this, view the "Restoring the Registry" Help topic in Regedit.exe or the "Restoring a Registry Key" Help topic in Regedt32.exe.

SUMMARY
Windows NT reports events to the Application Event Log when there are errors, or to give more information regarding performance monitor extensions and custom counters added to performance monitor. This article describes how to control the error checking and reporting by registry settings and list the possible event information. This is useful for testing and validating a performance monitor extension. This is also helpful to diagnose problems with performance monitor extensions that are installed as part of a vendor's server application or device driver.

Registry Values for Windows NT 4.0
The performance library (perflib), part of ADVAPI32.dll, reads three REG_DWORD registry values that control different levels of error checking and reporting. These values are in the following registry key. If the values are not found in this key on your system, the values can be added. The change takes effect after restarting performance monitor or whatever performance monitoring tool currently in use.

HKEY_LOCAL_MACHINE \SOFTWARE \Microsoft \Windows NT              \CurrentVersion \Perflib WARNING: Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

For information about how to edit the registry, view the "Changing Keys and Values" Help topic in Registry Editor (Regedit.exe) or the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe. Note that you should back up the registry before you edit it. If you are running Windows NT or Windows 2000, you should also update your Emergency Repair Disk (ERD).

The following value names are followed by possible values and their meanings.

ExtCounterTestLevel

1 -  object and counter lengths are checked for consistency 2 -  buffer overflows or guard pages are checked 3 -  no checking is made but does not suppress exception handling

EventLogLevel

0 -  no errors are reported 1 -  user event log error messages (1000-1013) 2 -  warnings and errors used for debugging (1000-2002) 3 -  verbose, all information (1000-3000) OpenProcedureWaitTime

If OpenProcedureWaitTime value is present, perflib sets up a timeout procedure internally. If the Open function of a performance monitor extension DLL does not return within the time specified, in milliseconds, in this registry value an event (2002) is posted to the Event Log. However, it only controls the reporting of the fact, it doesn't control the behavior. For example, if an Open function "hangs" then the performance monitor process will "hang" regardless of the presence of this registry value.

Registry Values for Windows 2000
Starting with Windows 2000 a new wait time registry entry was added for the collect function. The previous three registry values also work on Windows 2000 as described earlier. The new registry entry is placed in the following registry key.

HKEY_LOCAL_MACHINE \SYSTEM \CurrentControlSet \Services \(service name) \Performance Collect Timeout

The Collect Timeout value is new in Windows 2000. Note the space in the value name. If this value is present, perflib sets up a timeout procedure internally. If the Collect function of a performance monitor extension DLL does not return within the time specified, in milliseconds, in this registry value an event (1015) is posted to the Event Log.

Open Timeout

The Open Timeout value is new in Windows 2000. Note the space in the value name. If this value is present, perflib sets up a timeout procedure internally. If the Open function of a performance monitor extension DLL does not return within the time specified, in milliseconds, in this registry value an event (2002) is posted to the Event Log.

NOTE: On Windows 2000, OpenProcedureWaitTime is global to all performance extension DLLs. If the Open Timeout registry value, which is performance extension DLL-specific, is not present, then the operating system will use the global OpenProcedureWaitTime registry value, if it is present. Similarly, if the Collect Timeout registry value is not present, the operating system will use the global OpenProcedureWaitTime registry value, if present. If the OpenProcedureWaitTime registry value is not present, the default timeout value is 10,000 (milliseconds).

Event IDs and Descriptions
The following is a list of event IDs and the detailed error text displayed in the Details dialog box of Event Viewer. Some of the following items also include additional information about the interpretation of the event details. Also, each of the items give an expertise level to suggest who may be able to address the issue.

Many of the following descriptions refer to a DWORD in the Data field of the Event Details dialog box. Note the data is arranged in byte order and to interpret a DWORD on Intel systems you must read 4 bytes at a time each byte in reverse order. For example 05 00 00 C0 may appear in the Data field, but the DWORD is read C0000005.

Event ID: 1000

Detail Text: Access to performance data was denied to (username) as attempted from (calling module name)

Interpretation: The following key is checked for security access:

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib If the user associated with the client thread or process token is not on the ACL for this key then this event is posted.

Expertise: System Administrator

Event ID: 1001

Detail Text: The buffer size returned by a collect procedure in Extensible Counter DLL (DLL name) for the (service name) service was larger than the space available. Performance data returned by counter DLL will not be returned in Perf Data Block. Overflow size is data DWORD 0.

Interpretation: Perflib finds that the beginning pointer for the data buffer is not pointing past the end of the buffer including safe buffer.

Expertise: Developer of named extensible counter DLL

Event ID: 1002

Detail Text: A Guard Page was modified by a collect procedure in Extensible Counter DLL (DLL name) for the (service name) service. Performance data returned by counter DLL will not be returned in Perf Data Block.

Interpretation: Perflib implements a safe buffer that adds some space in the buffer filled with some signature byte. This event means the extension has written past the end of the buffer.

Expertise: Developer of named extensible counter DLL

Event ID: 1003

Detail Text: The object length of an object returned by Extensible Counter DLL (DLL name) for the (service name) service was not correct. The sum of the object lengths returned did not match the size of the buffer returned. Performance data returned by counter DLL will not be returned in Perf Data Block. Count of objects returned is data DWORD 0.

Interpretation: After the collect function returns, perflib validates the TotalByteLength members of each PERF_OBJECT_TYPE structure returned by the performance extension. This error event means there is problem with one or more TotalByteLength values in the PERF_OBJECT_TYPE structures.

Expertise: Developer of named extensible counter DLL

Event ID: 1004

Detail Text: The instance length of an object returned by Extensible Counter DLL (DLL name) for the (service name) service was incorrect. The sum of the instance lengths plus the object definition structures did not match the size of the object. Performance data returned by counter DLL will not be returned in Perf Data Block. The object title index of the bad object is data DWORD 0.

Interpretation: After the collect function returns perflib validates the PERF_INSTANCE_DEFINITION ByteLength and PERF_COUNTER_BLOCK ByteLength members, if the object has instances. This error event means the ByteLength member is incorrect.

Expertise: Developer of named extensible counter DLL

Event ID: 1005

Detail Text: Unable to locate the open procedure (open proc name) in DLL (DLL name) for the (service name) service. Performance data for this service will not be available. Error Status is data DWORD 0.

Interpretation: Perflib calls GetProcAddress for the function name specified as the Open procedure in the registry for the extension. This error typically means the name was not found either because the extension DLL did not correctly export it, or the DLL was compiled with C++ code and extern "C" declaration was not used.

Expertise: Developer of named extensible counter DLL

Event ID: 1006

Detail Text: Unable to locate the collect procedure (collect proc name) in DLL (DLL name) for the (service name) service. Performance data for this service will not be available. Error Status is data DWORD 0.

Interpretation: Perflib calls GetProcAddress for the function name specified as the Collect procedure in the registry for the extension. This error typically means the name was not found either because the extension DLL did not correctly export it, or the DLL was compiled with C++ code and extern "C" declaration was not used.

Expertise: Developer of named extensible counter DLL

Event ID: 1007

Detail Text: Unable to locate the close procedure (close proc name) in DLL (DLL name) for the (service name) service. Performance data for this service will not be available. Error Status is data DWORD 0.

Interpretation: Perflib calls GetProcAddress for the function name specified as the Close procedure in the registry for the extension. This error typically means the name was not found either because the extension DLL did not correctly export it, or the DLL was compiled with C++ code and extern "C" declaration was not used.

Expertise: Developer of named extensible counter DLL

Event ID: 1008

Detail Text: The Open Procedure for service (service name) in DLL (DLL name) failed. Performance data for this service will not be available. Status code returned is DWORD 0.

Interpretation: If the Open function for an extension does not return ERROR_SUCCESS, perflib posts the status code in the data field of the event. This may be used to help the author of the extension determine why the Open function failed.

Expertise: Developer of named extensible counter DLL

Event ID: 1009

Detail Text: The Open Procedure for service (service name) in DLL (DLL name) generated an exception. Performance data for this service will not be available. Exception code returned is DWORD 0.

Interpretation: Perflib calls the performance extension functions in a structured exception handler __try block. This is posted if an exception occurred or RaiseException was called in the Open function. The data field will have the exception code. For example, C0000005 means there was an Access Violation.

Expertise: Developer of named extensible counter DLL

Event ID: 1010

Detail Text: The Collect Procedure for the (service name) service in DLL (DLL name) generated an exception or returned an invalid status. Performance data returned by counter DLL will not be returned in Perf Data Block. Exception or status code returned is DWORD 0.

Interpretation: Perflib calls the performance extension functions in a structured exception handler __try block. This is posted if an exception occurred or RaiseException was called in the Collect function. The data field will have the exception code. For example, C0000005 means there was an Access Violation.

Expertise: Developer of named extensible counter DLL

Event ID: 1011

Detail Text: The library file (DLL name) specified for the (service name) service could not be opened. Performance data for this service will not be available. Status code is data DWORD 0.

Interpretation: Perflib uses LoadLibrary to open performance extensions. If LoadLibrary fails the status code from GetLastError is posted in the data field of the event. For example, 7e means the DLL could not be found or the library Name in the registry is not correct.

Expertise: System administrator or developer of named extensible counter DLL

Event ID: 1012

Detail Text: The system reported an idle process time that was less than the last time reported. The data shows the current time and the last reported time for the system's idle process.

Interpretation: This event is not used by Perflib

Expertise: None

Event ID: 1013

Detail Text: The collect procedure in Extensible Counter DLL (DLL name) for the (service name) service returned a buffer that was larger than the space allocated and may have corrupted the application's heap. This DLL should be disabled or removed from the system until the problem has been corrected to prevent further corruption. The application accessing this performance data should be restarted. The Performance data returned by counter DLL will not be returned in Perf Data Block. Overflow size is data DWORD 0.

Expertise: Developer of named extensible counter DLL

Event ID: 1014 Only available on Windows 2000

Detail Text: An error occurred while trying to collect data from the Server Object. The Error code returned by the function is DWORD 0. The Status returned in the IO Status Block is DWORD 1. The Information field of the IO Status Block is DWORD 2.

Interpretation: This event is not used by perflib.

Expertise: None

Event ID: 1015 Only available on Windows 2000

Detail Text: The timeout waiting for the performance data collection function (function name) to finish has expired. There may be a problem with that extensible counter or the service from which it is collecting data.

Expertise: Developer of named extensible counter DLL

Interpretation:See comments about the Collect Timeout registry value

Event ID: 1016 Only available on Windows 2000

Detail Text: The data buffer created for the (service name) service in the (DLL name) library is not aligned on an 8-byte boundary. This may cause problems for applications that are trying to read the performance data buffer. Contact the manufacturer of this library or service to have this problem corrected or to get a newer version of this library.

Expertise: Developer of named extensible counter DLL

Event ID: 1017 Only available on Windows 2000

Detail Text: Performance counter data collection from the (service name) service has been disabled due to one or more errors generated by the performance counter library for that service. The error(s) that forced this action have been written to the application event log. The error(s) should be corrected before the performance counters for this service are enabled again.

Expertise: Developer of named extensible counter DLL

Event ID: 1018 Only available on Windows 2000

Detail Text: Performance counter data collection from the (service name) service has been disabled for this session due to one or more errors generated by the performance counter library for that service. The error(s) that forced this action have been written to the application event log.

Expertise: Developer of named extensible counter DLL

Event ID: 1019 Only available on Windows 2000

Detail Text: A definition field in an object returned by Extensible Counter DLL (DLL name) for the (service name) service was incorrect. The sum of the definitions block lengths in the object definition structures did not match the size specified in the object definition header. Performance data returned by this counter DLL will be not be returned in Perf Data Block. The object title index of the bad object is data DWORD 0.

Interpretation:Similar to Event 1003 except the sum of the structure counter definition length members is checked. This event typically means the ByteLength of one of the counter definition structures of the performance data object is incorrect.

Expertise: Developer of named extensible counter DLL

Event ID: 1020 Only available on Windows 2000

Detail Text: The size of the buffer used is greater than that passed to the collect function of the (DLL name) Extensible Counter DLL for the (service name) service. The size of the buffer passed in is data DWORD 0 and the size returned is data DWORD 1.

Interpretation:Similar to Event 1001 except more information about the size of the buffer expected by the extension is given.

Expertise: Developer of named extensible counter DLL

Event ID: 2000

Detail Text: The pointer returned did not match the buffer length returned by the Collect procedure for the (service name) service in Extensible Counter DLL (DLL name). The Length will be adjusted to match and the performance data will appear in the Perf Data Block. The returned length is data DWORD 0, the new length is data DWORD 1.

Interpretation: This event is used for the development and debugging of a performance monitor extension. After the collect procedure is called return parameters are checked for consistency. In this case the number of bytes added to the perf data buffer is checked against the actual difference in the buffer pointer before and after the collect procedure is called.

Expertise: Developer of the named extensible counter DLL

Event ID: 2001

Detail Text: The (service name) service does not have a Performance subkey or the key could not be opened. No performance counters will be collected for this service. The Win32 error code is returned in the data.

Interpretation: This event is saying an item under the Services subkey does not contain a Performance subkey (or it could not be opened, for example, due to security access). This is posted for each item under the Service subkey.

Expertise: System administrator or developer of named service

Event ID: 2002

Detail Text: The open procedure for service (service name) in DLL (DLL name) has taken longer than the established wait time to complete. The wait time in milliseconds is shown in the data.

Interpretation: See the comments earlier regarding the Open Timeout registry value.

Expertise: Developer of named extensible counter DLL

Event ID: 2003 Only available on Windows 2000

Detail Text:The configuration information of the performance library (DLL name) for the (service name) service does not match the trusted performance library information stored in the registry. The functions in this library will not be treated as trusted.

Interpretation: If the "Library Validation Code" value exists for the named service in the Performance subkey, the data is checked against the file creation time and the file size of the named DLL. This error is posted if they do not match. If the error occurs, it may be corrected by removing and reinstalling the named service.

Expertise: System administrator or developer of named service

Event ID: 3000

Detail Text: Open procedure for service (service name) in DLL (DLL name) was called and returned successfully.

Expertise: Novice