Microsoft KB Archive/189656

= Bluescreen When Remotely Monitoring MBS Server with Perfmon =

Article ID: 189656

Article Last Modified on 9/22/2005

-

APPLIES TO


 * Microsoft Commercial Internet System 1.0 Service Pack 2

-



This article was previously published under Q189656



SYMPTOMS
A server running Windows NT 4.0 Service Pack 3 and the Microsoft Commercial Internet System (MCIS) 1.0 Membership Broker or Agent services may bluescreen with a Stop 0xc0000021a when it is remotely monitored with the performance monitor application.

One of the following errors will be logged in the event log:

The buffer size returned by a collect procedure in Extensible Counter DLL "siccntrs.dll" for the "msnlogon" service was larger than the space available. Performance data returned by counter DLL will not be returned in Perf Data Block. Overflow size is data DWORD 0.

-or-

The buffer size returned by a collect procedure in Extensible Counter DLL "siccntrs.dll" for the "SicServ" service was larger than the space available. Performance data returned by counter DLL will not be returned in Perf Data Block. Overflow size is data DWORD 0.



CAUSE
The Siccntrs.dll performance monitor counter DLL was incorrectly checking a buffer size provided by Winlogon. As a result, Siccntrs.dll writes additional data outside of the buffer, which causes Winlogon to crash and Windows NT to ultimately bluescreen with a Stop 0xc0000021a.

See the Microsoft Knowledge Base article 173060, "Performance Monitor Counters Cause Stop or Error Messages" for more information on why changes in Windows NT Service Pack 3 can cause this to occur.



RESOLUTION
Obtain the following fix or wait for the next Microsoft Commercial Internet System Service pack.

The hotfix should be version 7753 and the following timestamp: 07/16/98 02:51p                25,872 siccntrs.dll (Alpha)

07/16/98 02:51p                20,416 siccntrs.dll (Intel)



STATUS
Microsoft has confirmed this to be a problem in Microsoft Commercial Internet System version 1.0 A supported fix is now available, but has not been fully regression-tested and should be applied only to systems experiencing this specific problem. Unless you are severely impacted by this specific problem, Microsoft recommends that you wait for the next Service Pack that contains this fix. Contact Microsoft Technical Support for more information.



MORE INFORMATION
This fix corrects the buffer size checking code so that it only copies data into the buffer, if the buffer is big enough.

Keywords: kbbug kbqfe kbhotfixserver KB189656

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.