Hi,While testing out Win2008 and Exch2007, the core perf counters in perfmon have disappeared. They are no longer visible from within perfmon or other tools calling core counters (like Jetstress). I am trying to reload the core counters (processor, physicaldisk, etc) but cannot find any directions on how to do this. Plenty of notes on how to do it in Win2003 and Win2000 - but the DVD for Win2008 is not anything like the previous versions. So you can't extract the needed files (as far as I can tell).Anyone have any suggestions on how to restore performance counters?They are still enabled according the loadctr dos prompt tool.Thanks!John Meng

Hello John,The same methods should work on Windows Server 2008 as they do on Windows Server 2003.Is this 32-bit or 64-bit? If it's 64-bit you have two sets of counters, each of which may need to be repaired by lodctr( one in syswow64(32-bit - Lodctr for 32-bit counters)and the other in system32(64-bit Lodctrfor 64-bit counters)).you also have a 32-bit permon and a 64-bit perfmon.See this article for extracting files from the Windows Server 2008 DVD.It references Windows Vista and a different file name, but the same general steps should apply,You may need the latest version of the Windows AIK to be able to mount the Install.wim to copy files from it.Thanks, Darrell Gorter[MSFT] This posting is provided "AS IS" with no warranties, and confers no rights

Hi Darrell,Thanks so much for the response. You are right, I am running 64-bit Windows Server. Something I never even considered as part of the problem.I am still working on rebuilding the Perf counters per the Server 2003 instructions. Crossing my fingers it works!Just a side note, you were right about perfmon.exe in both sys32 and sysWOW64. The interesting thing is that when I use the sys32 perfmon (64-bit version), the core counters are NOTthere. But when I run perfmon from the sysWOW64 folder (the 32-bit version), the core counters ARE there.I'm starting to wonder if the core counters are not corrupt at all - just that somehow the 64-bit and 32-bit dll's got mixed up. Still researching this one as well.Thanks again for all your help!John Meng

Well - this has been a pretty frustrating experience. Seems that every corner I turn, there's another problem. I won't go into details so as to stay focused on the problem at hand.I was finally able to retrieve the perfd009.dat and perfh009.dat files out of the WIM file on the 2008Server CD (installing AIK turned into a hassle for one reason or another - but was finally successful). But alas, replacing those 2 files, plus the needed resets on the perf registry entries (kb 300956), plus lodctr /R (in the system32 folder only) - did not fix my problem.I am starting to wonder (as per my earlier post) if my dll's are corrupt. Or even if my perfmon.exe and perfmon.msc in system32are corrupt. But trying to replace any ofthose will require some serious work (I think) because of the System32 file lockdown/permission issue. From the little research I've done, it looks like I need to use the Sysinternals utility that will allow me to rename/replace these files.Any more help you can give me on this topic would be great! I'm getting to the end of my rope - and I am close to rebuilding these machines. My issue is that I'm trying to stay with my initial conviction of using Win2008 for my production Exchange environment. I don't want something this simple (I think it should be a simple fix) to leave such a bad taste in my mouth regarding 2008.Thanks,John Meng

Hello John,We should be able to Run SFC /scannow from an elevated cmd prompt to validate the files.When it's done run this to export the messages into a smaller log file findstr /c:"[SR]" %windir%\logs\cbs\cbs.log >sfcdetails.txt 928228How to analyze the log file entries that the Microsoft Windows Resource Checker (SFC.exe) program generates in Windows Vistahttp://support.microsoft.com/default.aspx?scid=kb;EN-US;928228Do you have an other 64-bit servers running where the core counters are still available?I am thinking you may want to compare the registry keys values from the article from a working machine with the registry keys values from a non-working machine.Thanks, Darrell Gorter[MSFT] This posting is provided "AS IS" with no warranties, and confers no rights

It was a long Monday today - so my positive attitude was waning towards the end of my work day when I wrote my earlier entry... :-)I will run SFT in the morning and see what I get.I am curious regarding the findstr command. I have been trying to run it myself (it was referenced in kb 300956) but could not get it to work correctly. I did run it from a DOS prompt with elevated privileges. Plus, the advanced search options on my 2 Mailbox role servers that have the PerfMon issues do not have the GUI"search for text within files" available. I finally mapped the admin share to my local Vista machine and searched for the "drivername" txt required to identify ini files to reload after lodctr /R using my Vista machine. Thatfinally did the trick. Curious if you have any suggestions regarding the findstr command...I do have 2 other "clean"64-bit servers. They are the Client Access andHub Transport servers that are part of my 4 server Exchange farm that I am testing out. The hardware is the production hardware - I was just putting things together for some Jetstress andExchange Load tests when I ran into this PerfMon issue. And unfortunately, this issueis keeping me from gathering performance counters on the 2 mailbox servers. Need this data to verify the hardware that I spec'd out for our production Exch07 environment.I have done some minimal file level comparisons but was not able to find anything conclusive or useful. What suggestions do you have regarding the registry keys? Anything in particular? I did not notice any differences in the ones mentioned in kb 300956.Again - thanks for all your help!John Meng

Hi Darrell,You were right on the registry bit. Turns out that a key called"Disable Performance Counter" was added to quite a few of the counters - and most of them were set to not equal 0. Once I changed the entry to 0, the performance counters related to that registry entry came back.The registry entries impacted were located in HKLM\SYSTEM\CurrentControlSet\Services. There were probably about 10 total perfmon counters impacted. And when compared to the clean 64-bit 2008 server, the clean server/registrydid not even have the "Disable Performance Counters" key in them.As an example,HKLM\SYSTEM\CurrentControlSet\Services\PerfOS\Performance had "Disable Performance Counters" = 2 on the impacted server. The key "Disable Performance Counters" did not even exist in the clean server. Once I set this key =0, the perfmon counters for that reg entry PerfOS came back.I can recreate the issue - it is in regards to Jetstress 2007. I will send a note to the Exchange 2007 team about it. It happens when you double-click on the log files (blg extension)that are generated by Jetstress. If you open PerfMon first, then open the blg files, it is fine. Only when you double-click the blg file that then calls PerfMon which causes the issue.I came across this potential problem/resolutionat the following link:http://www.aoaforums.com/forum/programming-and-assembly-language/40444-performance-counters-registry-windows-management-instrumentation.htmlThanks again for all your help!!John MengPS - I sure hope this entry helps someone else someday!

Hello John,Thanks for the followup with the resolution. That is very useful and appreciated. I am sure other people will run across the same issue and this post will prove to be useful in helping them resolve the issueThanks, Darrell Gorter[MSFT] This posting is provided "AS IS" with no warranties, and confers no rights

Hello John,I did some more searching based on your post.I found this technet articlehttp://technet.microsoft.com/en-us/library/cc784382.aspxwhich lists the values and what they disable Value 1 Disables performance counters for this service. 2 The Win32 version is disabled on computers running a Win64 version of the operating system. 4 The Win64 version of the service is disabled.Thanks, Darrell Gorter[MSFT] This posting is provided "AS IS" with no warranties, and confers no rights

Hey Darrell,Excellent! I was curious why there were different values. Now it makes sense.The most interesting point is how/why did those keys (Disable Performance Counters)get added in the first place. When I have a chance, I will double-confirm the cause, but it seemed to have occurred when I double-clicked on the blg perfmon file that was created by JetStress 2007. If I open up perfmon first - and then point to that log file, the OpSys/Application does not react the same.Thanks,John Meng