Hi,

I get several PerLib and PerfNet errors in my eventlog. When I run procesmon I see a lot of access denied errors for my app pool accoount in the registry on performance keys. Anybody any idea how to get rid of this?

• Moved by Victoria XiaMicrosoft contingent staff, Moderator Tuesday, March 24, 2015 8:34 AM sp2013

I am using SharePoint 2013 with SQL server 2012.

I just realize that this post is in the wrong section. Can't edit category

• Edited by Danny Hansen Tuesday, March 24, 2015 8:18 AM

Hi Victoria,

This is a internet facing site with 4 DMZ servers and 4 application servers in the LAN. I am not able to put application pool accounts in the local admin groups cause of security policies at my customer site. When I add the application pool account to the local admin group we will also get the health analyzer message that an application pool account is in the local admin group. I don't get why an application pool account should have local admin rights on a server. If it is just for writing to registry for performance counter this seems a bit odd to me. 

Regards

Danny

Local Admin isn't required, you're correct. However, Users do have Read rights on the Performance keys, unless your customer has altered permissions (e.g. via Local Security Policy or Group Policy).

The application pool account has read rights. But in my trace I see that the account is requiring read/write access on a lot of keys. Why does the account wan't to wright to all those keys? This is not necessary in my opinion.

 

Can you please post the entire event log entry for the Perfnet/Perflib entries?

In my previous post

PerfNet 2004: Unable to open the Server service performance object. The first four bytes (DWORD) of the Data section contains the status code.

PerfLib 1008: The Open Procedure for service "BITS" in DLL "C:\Windows\System32\bitsperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

PerfLib 1008: The Open Procedure for service "WmiApRpl" in DLL "C:\Windows\system32\wbem\wmiaprpl.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

PerfLib 1008: The Open Procedure for service "FIMSynchronizationService" in DLL "C:\Program Files\Microsoft Office Servers\15.0\Synchronization Service\Bin\mmsperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

6398
The Execute method of job definition Microsoft.SharePoint.Administration.SPUpdateWorkerProcessGroup (ID 9b4d28e2-5d0f-4748-a844-e19a07f425a6) threw an exception. More information is included below.
1387

6398
The Execute method of job definition Microsoft.SharePoint.Diagnostics.SPDiagnosticsMetricsProvider (ID a2c0d4b5-5054-4219-931a-8c159f29ddad) threw an exception. More information is included below.
An update conflict has occurred, and you must re-try this action. The object SPWebService was updated by ZKH\svspfa, in the OWSTIMER (3936) process, on machine 0057.  View the tracing log for more information about the conflict.

But if you look in trace several other write failures that dont show up in event log. Those I don't mind. I just want to get eventlog clean of errors

• Edited by Danny Hansen Thursday, March 26, 2015 3:37 PM

The full event, please. You're leaving out details such as the DWORD error code, and so forth.

2004 Unable to open the Server service performance object. The first four bytes (DWORD) of the Data section contains the status code. 

 <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
 <System>
  <Provider Name="Microsoft-Windows-PerfNet" Guid="{CAB2B8A5-49B9-4EEC-B1B0-FAC21DA05A3B}" EventSourceName="PerfNet" /> 
  <EventID Qualifiers="49152">2004</EventID> 
  <Version>0</Version> 
  <Level>2</Level> 
  <Task>0</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x80000000000000</Keywords> 
  <TimeCreated SystemTime="2015-03-23T22:58:04.000000000Z" /> 
  <EventRecordID>53570</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="0" ThreadID="0" /> 
  <Channel>Application</Channel> 
  <Computer></Computer> 
  <Security /> 
  </System>
 <EventData>
  <Binary>220000C0</Binary> 
  </EventData>
  </Event>
  
  
1008 The Open Procedure for service "BITS" in DLL "C:\Windows\System32\bitsperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.  

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-Perflib" Guid="{13B197BD-7CEE-4B4E-8DD0-59314CE374CE}" EventSourceName="Perflib" /> 
  <EventID Qualifiers="49152">1008</EventID> 
  <Version>0</Version> 
  <Level>2</Level> 
  <Task>0</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x80000000000000</Keywords> 
  <TimeCreated SystemTime="2015-03-23T10:57:08.000000000Z" /> 
  <EventRecordID>53171</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="0" ThreadID="0" /> 
  <Channel>Application</Channel> 
  <Computer></Computer> 
  <Security /> 
  </System>
- <UserData>
- <EventXML xmlns="Perflib">
  <param1>BITS</param1> 
  <param2>C:\Windows\System32\bitsperf.dll</param2> 
  <binaryDataSize>8</binaryDataSize> 
  <binaryData>0500000000000000</binaryData> 
  </EventXML>
  </UserData>
  </Event>
  
1008 The Open Procedure for service "WmiApRpl" in DLL "C:\WINDOWS\system32\wbem\wmiaprpl.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.


- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-Perflib" Guid="{13B197BD-7CEE-4B4E-8DD0-59314CE374CE}" EventSourceName="Perflib" /> 
  <EventID Qualifiers="49152">1008</EventID> 
  <Version>0</Version> 
  <Level>2</Level> 
  <Task>0</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x80000000000000</Keywords> 
  <TimeCreated SystemTime="2015-03-23T10:57:00.000000000Z" /> 
  <EventRecordID>53169</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="0" ThreadID="0" /> 
  <Channel>Application</Channel> 
  <Computer></Computer> 
  <Security /> 
  </System>
- <UserData>
- <EventXML xmlns="Perflib">
  <param1>WmiApRpl</param1> 
  <param2>C:\WINDOWS\system32\wbem\wmiaprpl.dll</param2> 
  <binaryDataSize>8</binaryDataSize> 
  <binaryData>1500000000000000</binaryData> 
  </EventXML>
  </UserData>
  </Event>

1008 The Open Procedure for service "FIMSynchronizationService" in DLL "C:\Program Files\Microsoft Office Servers\15.0\Synchronization Service\Bin\mmsperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-Perflib" Guid="{13B197BD-7CEE-4B4E-8DD0-59314CE374CE}" EventSourceName="Perflib" /> 
  <EventID Qualifiers="49152">1008</EventID> 
  <Version>0</Version> 
  <Level>2</Level> 
  <Task>0</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x80000000000000</Keywords> 
  <TimeCreated SystemTime="2015-03-23T03:38:24.000000000Z" /> 
  <EventRecordID>52857</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="0" ThreadID="0" /> 
  <Channel>Application</Channel> 
  <Computer></Computer> 
  <Security /> 
  </System>
- <UserData>
- <EventXML xmlns="Perflib">
  <param1>FIMSynchronizationService</param1> 
  <param2>C:\Program Files\Microsoft Office Servers\15.0\Synchronization Service\Bin\mmsperf.dll</param2> 
  <binaryDataSize>8</binaryDataSize> 
  <binaryData>0200000000000000</binaryData> 
  </EventXML>
  </UserData>
  </Event>  

• Edited by Danny Hansen Thursday, March 26, 2015 3:42 PM

Thanks.

Have you tried rebuilding the perf counters?

http://blogs.technet.com/b/yongrhee/archive/2009/10/06/how-to-rebuild-performance-counters-on-windows-vista-server2008-7-server2008r2.aspx

Yes I followed the exact same article

Hi Danny,

Please check the solutions in the two articles below to see if the issue can be resolved:

Event ID 1008 Performance Library Availability: https://technet.microsoft.com/en-us/library/cc774913%28v=ws.10%29.aspx?f=255&MSPPError=-2147217396

Event ID 2004 Network Performance Counter Availability: https://technet.microsoft.com/en-us/library/cc727117(v=ws.10).aspx

Best regards,

Victoria

Hi Victoria,

I already tried both links but no success.

Hi Danny,

I understand that the two links does not work for our issue. Could you please perform the following steps to rebuild the performance counter?

I will take USB counter (usbhub) as example. We need to use command lodctr <<var>inifile</var>> to rebuid the USB command counter. So the key point is how to find the correct .ini file.

---------------------------------

1. The .ini file for the USB counter is usbperf.ini, we can get this in the registry key below.e.g. HKLM\System\CurrentControlSet\services\usbhub\performance\perfinifile

2. I use the usbperf to search in the Windows folder, found the following folder which contains this file. Then try to use the lodctr .ini to reload the usbper.ini under the following folders.

C:\windows\inf\usbhub\0000\usbperf.ini  ===Dont work.

C:\Windows\WinSxS\amd64_microsoft-windows-usbperf.resources_31bf3856ad364e35_6.3.9600.16384_en-us_ca78f49af4a1a728 ===Dont work.

C:\Windows\WinSxS\amd64_microsoft-windows-usbperf_31bf3856ad364e35_6.3.9600.16384_none_90a0d03b4c066e9d\usbperf.ini  === This worked.

There are usbperf.dll, usbper.ini and usbperfsym.h under this folder. So, please use the correct *.ini file name to search under the C:\Windows\WinSxs folder. Then change to the correct folder which include three files and run the lodctr *.ini to add the missing counter. Please note that the folders name which include resources will not works. 

3. Repeat the step 1-2 to rebuild other missing counters.

Moreover, I consulted the OS engineers, they suggested that we could safely ignore the events, since these errors will not cause any functionality impact on the server and all of the normal operations would continue to work.

Thanks,

Sorry for the late response. But no luck with the rebuild.

I will ignore the errors. Thx for the help so far

Regards

Danny