I have multiple Windows 2003 SP2 servers that are throwing Perflib Event ID 2003 in their Application event logs. The errors vary between servers, but all take similar formats:Aug2807:06:38server01Perflib:2003:Theconfigurationinformationoftheperformancelibrary"C:\WINDOWS\System32\aspperf.dll"forthe"ASP"servicedoesnotmatchthetrustedperformancelibraryinformationstoredintheregistry.Thefunctionsinthislibrarywillnotbetreatedastrusted.Aug2807:06:43server01Perflib:2003:Theconfigurationinformationoftheperformancelibrary"C:\WINDOWS\System32\perfts.dll"forthe"TermService"servicedoesnotmatchthetrustedperformancelibraryinformationstoredintheregistry.Thefunctionsinthislibrarywillnotbetreatedastrusted.Aug2807:06:43server01Perflib:2003:Theconfigurationinformationoftheperformancelibrary"C:\WINDOWS\system32\inetsrv\w3ctrs.dll"forthe"W3SVC"servicedoesnotmatchthetrustedperformancelibraryinformationstoredintheregistry.Thefunctionsinthislibrarywillnotbetreatedastrusted.This began when I started monitoring these systems with OpenNMS. No changes were made to the servers themselves - OpenNMS is a self-contained application running on a separate host. All affected servers are running SNMP Informant. We were previously collecting data via Cacti with no errors, but OpenNMS queries many more OIDs out of the box than Cacti. Servers running SP1 are not affected. I have not been able to manually reproduce the error, even by doing a full snmpwalk. This happens no more than once a day per server, but not necessarily every day and not at the same time each day.I've tried unloading and reloading the performance libraries with unlodctr and lodctr (followed by a reboot), as well as forcing trusts with lodctr /T, but this has not yielded any change.I'm baffled. Any help is greatly appreciated.-HKS

Hi, According to my research, these might be generated by Performance Monitor Extensions. They are harmless for our system. However, it floods our Event log. Therefore, to work around this issue, add the following registry key that prevents Performance Monitor from testing data buffer alignment errors: WARNING: If you use Registry Editor incorrectly, you may cause seriousproblems that may require you to reinstall your operating system. Microsoftcannot guarantee that you can solve problems that result from usingRegistry Editor incorrectly. Use Registry Editor at your own risk.1. Start Registry Editor (Regedt32.exe).2. Locate and click the following registry key:HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Perflib3. On the Edit menu, click Add Value, and then add the following value:Value Name: Configuration FlagsData type: REGDWORDValue: 0x014. Quit Registry Editor. For Event 2003 error message, please open Regedit, locate the"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servi ces\W3SVC\Performance"registry key and you will find the "Library Validation Code" value. The data of the the registry value is checked against the file creation timeand the file size of the "%systemroot%\system32\inetsrv\w3ctrs.dll" DLL.This error is posted if they do not match. To resolve this error, you mayremove and reinstall IIS. See the following Knowledge Base article for moreinformation:320202 How to Remove and Reinstall IIS and Exchangehttp://support.microsoft.com/?id=320202For more information, please refer to the following Knowledge Base article:249138. KB.EN-US INFO: Controlling the Disabling of Performance MonitorExtensionhttp://support.microsoft.com/default...B;EN-US;249138 Additional information:Events for Performance Monitor Extensionshttp://support.microsoft.com/?id=226494152513 Troubleshooting Performance Monitor Counter Problemshttp://support.microsoft.com/?id=152513

Thank you for the response. According to my research, these might be generated by Performance Monitor Extensions. They are harmless for our system. However, it floods our Event log. Therefore, to work around this issue, add the following registry key that prevents Performance Monitor from testing data buffer alignment errors: WARNING: If you use Registry Editor incorrectly, you may cause seriousproblems that may require you to reinstall your operating system. Microsoftcannot guarantee that you can solve problems that result from usingRegistry Editor incorrectly. Use Registry Editor at your own risk.1. Start Registry Editor (Regedt32.exe).2. Locate and click the following registry key:HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Perflib3. On the Edit menu, click Add Value, and then add the following value:Value Name: Configuration FlagsData type: REGDWORDValue: 0x014. Quit Registry Editor.The links you provided suggest this as a resolution for Perflib 1016 events on Windows 2000 and XP. I am not receiving these events. Did you have success with this eliminating Perflib 2003 events as well?For Event 2003 error message, please open Regedit, locate the"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servi ces\W3SVC\Performance"registry key and you will find the "Library Validation Code" value. The data of the the registry value is checked against the file creation timeand the file size of the "%systemroot%\system32\inetsrv\w3ctrs.dll" DLL.This error is posted if they do not match. To resolve this error, you mayremove and reinstall IIS.This is also happening on servers without IIS installed.320202 How to Remove and Reinstall IIS and Exchangehttp://support.microsoft.com/?id=320202For more information, please refer to the following Knowledge Base article:249138. KB.EN-US INFO: Controlling the Disabling of Performance MonitorExtensionhttp://support.microsoft.com/default...B;EN-US;249138 Additional information:Events for Performance Monitor Extensionshttp://support.microsoft.com/?id=226494152513 Troubleshooting Performance Monitor Counter Problemshttp://support.microsoft.com/?id=152513Thank you for the links. I've been through these, but have not yet found a solution.Any further help is more than welcome.-HKS

Any?-HKS

Hi, Thanks for letting me know that part of my suggestion works. The event might be generated for information purposes. Therefore, you can safely ignore the warning messages. Additionally, you can prevent these warning messages in certain scenarios by reregistering the service to update the validation code in the registry. To reregister the performance counter libraries of the affected service, follow these steps: 1. Click Start, click Run, type cmd, and then click OK. 2. Type unlodctrServiceName, and then press ENTER. Note Servicename represents the name of the affected service. 3. Type lodctrIniFile, and then press ENTER. For more information, please check the following KB articles: Event ID 2003 Warning Message Logged When Loading Performance Counters http://support.microsoft.com/kb/267831/en-us Event ID: 2003 warning messages that are related to performance counters are logged in the Application log on a Windows Server 2003-based computer http://support.microsoft.com/kb/928384/en-us

Hello,Thanks again for the response. Unfortunately, I've already tried reregistering the performance counter libraries to no avail.Any further suggestions are very welcome.-HKS

Last bump...-HKS

I've tried all above and get the same warning for "TermService". Anyone solve this problem?Anthony