Microsoft KB Archive/240389

Knowledge Base

Log Is Not Started When You Try to Start a Log with Remote Counters in System Monitor

Article ID: 240389

Article Last Modified on 3/1/2007

---

APPLIES TO

• Microsoft Windows 2000 Server
• Microsoft Windows 2000 Advanced Server
• Microsoft Windows 2000 Professional Edition

---

This article was previously published under Q240389

SYMPTOMS

When you attempt to start a log with remote counters in System Monitor, the log may not be started. The lack of success starting the log may generate the following two events in the Event Viewer Application log:

Event ID: 2028 Source: SYSMONLOG The service was unable to add the counter \\Server_Name\Counter_Name
to the LogName log or alert. The service will continue, but data for that counter will not be collected.

Event ID: 2029 The service was unable to add any counters to the LogName log or alert. The log or alert will not be started.

-or-

When you attempt to start a performance log, the following message may be displayed :

Performance Logs and Alerts
The LogName log or alert has not started. Refresh the log or alert list to view current status, or see the application event log for any errors.

CAUSE

By default, the Performance Logs and Alerts service is started under the local computer's "system" account. Normally, the "system" account only has permission to access services and resources on the local computer, not logs on network computers.

RESOLUTION

To start the Performance Logs and Alerts service under a different account:

1. Right-click My Computer, and then click Manage.
2. Open Services and Applications.
3. Click Services.
4. Right-click Performance Logs and Alerts, then click Properties.
5. Click the Log On tab, and then click This account.
6. Type a user account, and then type a password with sufficient credentials to gain access to the remote computer.

STATUS

This behavior is by design. As a result of the stronger security implemented in Windows 2000, the remote computer only enables a network connection for user accounts with sufficient permissions. The credentials of the System account do not have sufficient permissions. In order to monitor remote computers with System Monitor, sufficient permissions are required.

Additional query words: Performance Counters Extensible Counters 2046 2029

Keywords: kbenv kbprb kbui KB240389

---

Send feedback to Microsoft

© Microsoft Corporation. All rights reserved.