Event ID 1001 — Performance Library Availability

Applies To: Windows Server 2008

Performance counters, including those built in to the operating system and those provided by non-Microsoft vendors, are combined in the Performance Library. Performance monitoring applications such as Windows Reliability and Performance Monitor use the Performance Library to identify available counters and map to counter providers. Errors accessing the Performance Library may result in application errors when expected data cannot be found, or when expected data providers are unavailable.

Event Details

Product: Windows Operating System
ID: 1001
Source: Microsoft-Windows-Perflib
Version: 6.0
Symbolic Name: PERFLIB_BUFFER_OVERFLOW
Message: The buffer size returned by a collect procedure in Extensible Counter DLL "%1!s!" for the "%2!s!" service was larger than the space available. The performance data returned by the counter DLL will not be returned in the Perf Data Block. The first four bytes (DWORD) of the Data section contains the returned buffer size.

Diagnose

This error might be caused by one of the following conditions:

  • A non-Microsoft DLL caused the error.
  • The list of counters is corrupt.
  • The Remote Registry service is not running on a remote system.
  • The File and Printer Sharing firewall exception is not enabled on a remote system running Windows Vista.
  • The application is running as a user with insufficient privileges.

If a Windows system error code containing four or five digits is included, you can find the explanation of the error code on the Web at https://go.microsoft.com/fwlink/?LinkID=83027. This information can help you identify the correct resolution.

A non-Microsoft DLL caused the error

If the error references a non-Microsoft DLL, follow the steps in the section titled "Contact a vendor" to obtain a newer copy of the DLL file.

The list of counters is corrupt

If the performance counter could not unload the strings for the specified service, the registry might be corrupted. To correct this problem, follow the steps in the section titled "Rebuild the list of available counters."

The Remote Registry service is not running on a remote system

In order to collect performance counters remotely, the Remote Registry service must be running on the destination system.

Membership in the destination system's local Administrators group is required to change service settings.

To check if the Remote Registry service is running:

  1. On the destination system, click Start.
  2. In the Start Search text box, type compmgmt.msc, and then press ENTER. Microsoft Management Console (MMC) will start.
  3. In the navigation tree, expand Services and Applications and click Services.
  4. In the Services list, scroll down and click Remote Registry.
  5. Check to see if the status of the Remote Registry service is Started. If it is not, follow the steps in the section titled "Enable the Remote Registry service" to resolve the error.

The File and Printer Sharing firewall exception is not enabled on a remote system running Windows Vista

On systems running Windows Vista, the File and Printer Sharing firewall exception must be enabled on the destination system.

Membership in the destination computer's local Administrators group is required to change firewall settings.

To check File and Printer Sharing firewall exception settings:

  1. On the destination system, click Start and then click Control Panel.
  2. In the Control Panel search box, type firewall.
  3. In the search results, double-click Windows Firewall.
  4. In Windows Firewall, click Change settings.
  5. On the Exceptions tab, check to see if File and Printer Sharing is selected. If it is not, follow the steps in the section titled "Enable the File and Printer Sharing firewall exception on a remote system running Windows Vista" to resolve the error.

The application is running as a user with insufficient privileges 

To view performance counters, a user must be a member of the local Performance Monitor Users group, Performance Log Users group, Administrators group, or equivalent. Applications that run as a user or system account with insufficient privileges may not be able to load performance counters correctly. Follow the steps in the section titled "Run the application as a user with sufficient privileges" to identify a resolution.

Resolve

To resolve this issue, use the resolution that corresponds to the cause you identified in the Diagnose section. After performing the resolution, see the Verify section to confirm that the feature is operating properly

Cause

Resolution

A non-Microsoft DLL caused the error

Contact a vendor

The list of counters is corrupt

Rebuild the list of performance counters

A required DLL is disabled

Re-enable a required DLL

The application is running as a user with insufficient privileges

Run the application as a user with sufficient privileges

The File and Printer Sharing firewall exception is not enabled

Enable the File and Printer Sharing firewall exception on a remote system running Windows Vista

The Remote Registry service is not running on a remote system

Enable the Remote Registry service

Contact a vendor

Contact the vendor who provided the performance counter DLLs. If operating system DLLs generated this error, contact Microsoft Customer Service and Support. For more information, see https://go.microsoft.com/fwlink/?LinkID=102491.

Rebuild the list of performance counters

Membership in the local Administrators group is required to complete this procedure.

To rebuild the list of counters in the registry:

  1. Click Start, expand All Programs, and expand Accessories.
  2. Right-click Command Prompt, and then click Run as administrator.
  3. At the command prompt, type lodctr /r, and then press ENTER.

Re-enable a required DLL

Membership in the local Administrators group is required to complete this procedure.

To enable a performance library DLL:

  1. Click Start, click All Programs, and then click Accessories.
  2. Right-click Command Prompt, and then click Run as administrator.
  3. At the command prompt, type lodctr /e:<DLL name> and then press ENTER, where <DLL name> is the name of the library, for example "PerfOS". The DLL name is found in the event message details.

Run the application as a user with sufficient privileges

By default, an application runs with the same privileges as the user who started it. You can configure services to run as the local system account or as a specific user. You can also start an application as Administrator, but in Windows Vista or Windows Server 2008 with User Account Control enabled, you must confirm that you want to start the application each time it runs if it is configured to run as Administrator.

Consider running services that collect performance counter data as the local system account to resolve privilege issues.

If for security reasons you do not want to run the application or service as the local system account, you can add the user the application runs as to the Performance Log Users group and assign the group the Log on as a Batch Job user right to enable performance counter collection each time the application runs.

Membership in the destination computer's local Administrators group is required to complete these procedures.

Add a user to the Performance Log Users group

To add a user to the Performance Log Users group:

  1. Click Start, click in the Start Search box, type compmgmt.msc, and then press ENTER.
  2. Expand System Tools, expand Local Users and Groups, and click Groups.
  3. In the list of groups, right-click Performance Log Users, and then click Add to Group.
  4. On the General tab, click Add.
  5. Type the name of the user you want to add, or click Advanced to search the directory for a user.
  6. When you have finished adding users, click OK, and click OK again to close the Performance Log Users property page.

Assign the Log on as a batch job user right to the Performance Log Users group

In order for members of the Performance Log Users group to initiate data logging or modify Data Collector Sets, the group must first be assigned the Log on as a batch job user right. To assign this user right, use the Local Security Policy snap-in in Microsoft Management Console (MMC).

To assign the Log on as a batch job user right to the Performance Log Users group:

  1. Click Start, click in the Start Search box, type secpol.msc, and then press ENTER. The Local Security Policy snap-in will open in Microsoft Management Console.
  2. In the navigation pane, expand Local Policies and click User Rights Assignment.
  3. In the console pane, right-click Log on as a batch job and then click Properties.
  4. In the Properties page, click Add User or Group.
  5. In the Select Users or Groups dialog box, click Object Types. Select Groups, and then click OK.
  6. Type Performance Log Users in the Select Users or Groups dialog box, and then click OK.
  7. Click OK again to close the property page.

Enable the File and Printer Sharing firewall exception on a remote system running Windows Vista

In Windows Vista and Windows Server 2008, the File and Printer Sharing firewall exception must be enabled on the destination computer before performance counters can be collected remotely.

Membership in the destination computer's local Administrators group is required to change firewall settings.

To enable the File and Printer Sharing firewall exception:

  1. On the destination computer, click Start and then click Control Panel.
  2. In the Control Panel search box, type firewall.
  3. In the search results, double-click Windows Firewall.
  4. In Windows Firewall, click Change settings.
  5. On the Exceptions tab, select the File and Printer Sharing check box.

Enable the Remote Registry service

Membership in the destination computer's local Administrators group is required to complete this procedure.

To enable the Remote Registry service:

  1. On the destination system, click Start.
  2. In the Start Search text box, type compmgmt.msc, and then press ENTER. Microsoft Management Console (MMC) will start.
  3. In the navigation tree, expand Services and Applications and click Services.
  4. In the Services list, right-click Remote Registry, and then click Start.

Verify

You can use Windows Reliability and Performance Monitor to verify that netowkr performance counters are properly collected and displayed in a Performance Monitor graph. In addition, you can use the typeperf command to get a list of the available counters on the local system.

Membership in the local Administrators group is required to complete these procedures.

View counters in Performance Monitor

To view counters in Performance Monitor:

  1. On the computer where you want to view counters, click Start. In the Start Search text box, type perfmon.exe, and then press ENTER.
  2. In the navigation pane, expand Monitoring Tools, and then click Performance Monitor.
  3. Click the Add button to open a list of available performance counters.
  4. In the Add Counters dialog box, you can click Help for more information on adding counters. When you have finished adding counters to the list, click OK.
  5. Verify that the performance counters you selected are displayed in the Performance Monitor graph.

View a list of counters using the typeperf command

To view a list of counters at the command prompt:

  1. Click Start, click All Programs, and click Accessories. Right-click Command Prompt, and click Run as administrator.
  2. At the command prompt, type typeperf -qx and press ENTER.
  3. Verify that the performance counter list contains expected values.

Performance Library Availability

Management Infrastructure