Troubleshooting

Article
09/11/2009

What problem are you having?

Counter values consistently equal zero.Cause: The process being monitored has stopped so there is no data for the process in the performance tools.Solution: If you stopped the process manually, restart it to see the process in System Monitor. Otherwise, check Event Viewer for concurrent entries. You may find an error associated with this process.Cause: The counter DLL was disabled after you selected the corresponding counters in a log or display. The performance tools will not detect that the counter was removed or disabled but will report the counter data as zeroes.Solution: Enable the corresponding counter DLL.Cause: You lack permissions on the computer being monitored. If you don't have appropriate permissions to monitor the computer, an error message will be displayed when you attempt to select the counter but the counter will still appear in the histogram or graph legend without any data or any graph line.Solution: An administrator must ensure that your user account has permissions to use the performance tools.
System Monitor shows gaps in its line graphs. Cause: This could be because data collection was subordinated to higher priority processing activity on a system with a heavy load. When the system has adequate resources to continue with data collection, the graphing will resume as usual. A message appears describing this. Solution: Reduce the performance overhead of system monitoring. See also: Best practices
Values recorded in a log don't appear in the graph view. Cause: The graph is limited to 100 samples. Solution: Reduce the selected time range. See also: To use logged data
Objects, counters, or instances seem to be missing or invalid. Cause: Test routines that run when you start Performance have detected a problem with installed counters and have disabled the counters automatically to prevent the counters from slowing the system. Disabled objects and counters do not appear in the Add Counters dialog box. Solution #1: You can enable the disabled counters. Using Registry Editor, change the value under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Service_name\Performance\Disable Performance Counters from 1 for disable to 0 for enable. Note that counters that have been disabled after initial testing are likely to contain errors and may cause system problems. For information about debugging problems with counter DLLs, see the Microsoft Web site. Solution #2: You can turn off the counter DLL automatic testing feature or adjust the level of testing. Using Registry Editor, locate the Configuration Flags subkey under HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Perflib and change the value of the REG_DWORD entry for this subkey: REG_DWORD Value Performance Counter DLL Test Level 0x00 Test for buffer alignment errors and report any critical error detected. 0x01 Do not test for data buffer alignment errors. 0x02 Do not disable DLLs when errors are detected. Note Windows will still write messages to the Event Log if this option is used. 0x04 Disable all performance counter function testing. 0x08 Enable the disabling of performance objects if they exceed a timeout value. Note Normally Windows will merely write a message to the Event Log. 0x10 Enable the collection of performance and error statistics for each performance object. This is the default setting. Caution Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer. Cause: The process that starts the object counters is not started or installed. Solution: Use Task Manager to verify that the process is running. If so, use Exctrlst.exe on the Resource Kit companion CD to verify that the counter DLL is enabled. Cause: The counters haven't been enabled. Solution: Make sure that the service or feature that provides the counter has been installed or configured. Cause: The DLL that installs the counters is generating errors. An example is if the counter does not handle localization functions correctly. Solution: Check Event Viewer to see whether the counter DLL or the Performance Data Helper reported any errors. If necessary, you can disable counter DLLs that are causing errors by using Exctrlst.exe on the Resource Kit companion CD. Cause: You are trying to monitor a 16-bit or MS-DOS application. Only 32-bit processes appear in the instances list. Active 16-bit processes appear as threads running in a Windows Virtual DOS Machine (NTVDM) process. Solution: Monitor the application via the NTVDM process. See also: Monitoring legacy programs Cause: The instance you want to monitor is not currently active. If you are configuring System Monitor to collect real-time data, you can only select active instances for data collection. (If you are viewing logged data, you can select inactive instances for which the log contains data.) If you select the process and it stops after you've selected it, it will continue to appear in the list box but the reported data will be zeroes. Solution: Make sure the instance is active.
I sometimes see an extremely high value for one instance and not the other when I am monitoring processes of the same name. Cause: The performance tools sometimes misrepresent data for separate instances of processes with the same name by reporting the combined values of the instances as the value of a single instance. Solution: Use the instance index and track the Process\ID Process and Process\Creating Process ID counters.
When monitoring several threads, if one thread stops, its data appears to be reported for another. Cause: This is because of the way threads are numbered. For example, assume you are monitoring three threads, numbered 0, 1, and 2. If thread 0 stops, the remaining threads get renumbered. The original thread 0 is now gone and the original thread 1 is renamed to 0. As a result data for the stopped thread 0 could be reported along with data for the running thread 1 because old thread 1 is now old thread 0. Solution: Use the instance index with Thread ID to track these threads.
An error message is displayed if I try to export log data to Microsoft Excel while the Performance Logs and Alerts service is actively collecting data to that log. Cause: Microsoft Excel requires exclusive access to the log file. Other programs are not known to require this exclusive access; therefore, in general, you can work with data from a log file while the service is collecting data to that file. Solution: Stop the Performance Logs and Alerts service before trying to use it with Microsoft Excel.
I lost my connection to a remote computer from which I was logging data and I cannot resume logging. Cause: Logging data from a remote computer requires the use of Remote Registry Service. If the service stops due to failure, by default the system restarts it automatically only once. Solution: If Remote Registry Service stops more than once, you must restart the service manually on the second and any subsequent failures. To change this default behavior, use Computer Management or Services (on the Administrative Tools menu) to modify the properties for Remote Registry Service.
Help for System Monitor does not appear in MMC Help; only Performance Logs and Alerts is displayed. Cause: Because System Monitor is designed as an ActiveX control, its behavior differs from other MMC snap-ins. For example, System Monitor Help is not available when you right-click System Monitor and then click Help on the shortcut menu, or when you click Help Topics on the Help menu. Solution: Click the Help button on the System Monitor toolbar.
I cannot log performance counters from a remote computer. Cause: You may not have permission to view the counters on the remote machine. Solution: Ask the administrator of the remote machine to give you read access to the remote computer. Cause: You may not have the correct privileges granted through Group Policy. Solution: Ask the administrator of the remote machine to grant you access through the following User Rights policies: Profile System Performance and Profile a Single Process. Cause: The Performance Logs and Alerts service may not have permission to log on to the remote computer or to create and update the log file. Solution: Use the Run As text box and Password button to specify the logon account name with the necessary permissions for the performance logs and alerts service. You can access these features from the General tab. Cause: The Remote Registry service is not running on the remote machine. Solution: On the remote computer, start the Remote Registry service. Open Computer Management In the console tree, click Services. Where? Services and Applications > Services In the details pane, click Remote Registry Service On the Action menu, click Start. Cause: The log file size limit may not be large enough to collect your requested data. Solution: Increase the limit of the log file size or set the file size to the maximum limit allowed. For more information, see To set file parameters for a log Cause: The log update interval may be too short to allow the server to respond to each periodic data request. Solution: Increase the log's update interval. For more information, see To view or change properties of a log or alert
My counters used to work, but since I installed a new application the counters don't work. Is there a way to restore the old counter settings? Cause: Whenever you install a new application that installs performance counters on the operating system, Windows creates a backup copy of the performance counter registry entries taken prior to the addition of the application's performance counters file. This backup is saved as a file named PerfStringBackup.INI. If Windows successfully adds the application's performance counters file, it then replaces the previous version of the PerfStringBackup.INI file with the file that it just created. Solution: Restore the performance counter registry to the state described in the uncorrupted backup file by using the following command: LODCTR /R:filename where filename is name of the backup performance counter registry entry file. Note To make a backup copy at any time of the performance counter registry settings, use the following command: LODCTR /S:filename where filename is any name. You can save these backup files anywhere on your computer.

Counter values consistently equal zero.Cause: The process being monitored has stopped so there is no data for the process in the performance tools.Solution: If you stopped the process manually, restart it to see the process in System Monitor. Otherwise, check Event Viewer for concurrent entries. You may find an error associated with this process.Cause: The counter DLL was disabled after you selected the corresponding counters in a log or display. The performance tools will not detect that the counter was removed or disabled but will report the counter data as zeroes.Solution: Enable the corresponding counter DLL.Cause: You lack permissions on the computer being monitored. If you don't have appropriate permissions to monitor the computer, an error message will be displayed when you attempt to select the counter but the counter will still appear in the histogram or graph legend without any data or any graph line.Solution: An administrator must ensure that your user account has permissions to use the performance tools.

System Monitor shows gaps in its line graphs.

Cause: This could be because data collection was subordinated to higher priority processing activity on a system with a heavy load. When the system has adequate resources to continue with data collection, the graphing will resume as usual. A message appears describing this.

Solution: Reduce the performance overhead of system monitoring.

See also: Best practices

Values recorded in a log don't appear in the graph view.

Cause: The graph is limited to 100 samples.

Solution: Reduce the selected time range.

See also: To use logged data

Objects, counters, or instances seem to be missing or invalid.

Cause: Test routines that run when you start Performance have detected a problem with installed counters and have disabled the counters automatically to prevent the counters from slowing the system. Disabled objects and counters do not appear in the Add Counters dialog box.

Solution #1: You can enable the disabled counters. Using Registry Editor, change the value under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Service_name\Performance\Disable Performance Counters from 1 for disable to 0 for enable. Note that counters that have been disabled after initial testing are likely to contain errors and may cause system problems. For information about debugging problems with counter DLLs, see the Microsoft Web site.

Solution #2: You can turn off the counter DLL automatic testing feature or adjust the level of testing. Using Registry Editor, locate the Configuration Flags subkey under HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Perflib and change the value of the REG_DWORD entry for this subkey:

REG_DWORD Value Performance Counter DLL Test Level

0x00 Test for buffer alignment errors and report any critical error detected.

0x01 Do not test for data buffer alignment errors.

0x02 Do not disable DLLs when errors are detected. Note

Windows will still write messages to the Event Log if this option is used.

0x04 Disable all performance counter function testing.

0x08 Enable the disabling of performance objects if they exceed a timeout value. Note

Normally Windows will merely write a message to the Event Log.

0x10 Enable the collection of performance and error statistics for each performance object. This is the default setting.

Caution

Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.

Cause: The process that starts the object counters is not started or installed.

Solution: Use Task Manager to verify that the process is running. If so, use Exctrlst.exe on the Resource Kit companion CD to verify that the counter DLL is enabled.

Cause: The counters haven't been enabled.

Solution: Make sure that the service or feature that provides the counter has been installed or configured.

Cause: The DLL that installs the counters is generating errors. An example is if the counter does not handle localization functions correctly.

Solution: Check Event Viewer to see whether the counter DLL or the Performance Data Helper reported any errors. If necessary, you can disable counter DLLs that are causing errors by using Exctrlst.exe on the Resource Kit companion CD.

Cause: You are trying to monitor a 16-bit or MS-DOS application. Only 32-bit processes appear in the instances list. Active 16-bit processes appear as threads running in a Windows Virtual DOS Machine (NTVDM) process.

Solution: Monitor the application via the NTVDM process.

See also: Monitoring legacy programs

Cause: The instance you want to monitor is not currently active. If you are configuring System Monitor to collect real-time data, you can only select active instances for data collection. (If you are viewing logged data, you can select inactive instances for which the log contains data.) If you select the process and it stops after you've selected it, it will continue to appear in the list box but the reported data will be zeroes.

Solution: Make sure the instance is active.

I sometimes see an extremely high value for one instance and not the other when I am monitoring processes of the same name.

Cause: The performance tools sometimes misrepresent data for separate instances of processes with the same name by reporting the combined values of the instances as the value of a single instance.

Solution: Use the instance index and track the Process\ID Process and Process\Creating Process ID counters.

When monitoring several threads, if one thread stops, its data appears to be reported for another.

Cause: This is because of the way threads are numbered. For example, assume you are monitoring three threads, numbered 0, 1, and 2. If thread 0 stops, the remaining threads get renumbered. The original thread 0 is now gone and the original thread 1 is renamed to 0. As a result data for the stopped thread 0 could be reported along with data for the running thread 1 because old thread 1 is now old thread 0.

Solution: Use the instance index with Thread ID to track these threads.

An error message is displayed if I try to export log data to Microsoft Excel while the Performance Logs and Alerts service is actively collecting data to that log.

Cause: Microsoft Excel requires exclusive access to the log file. Other programs are not known to require this exclusive access; therefore, in general, you can work with data from a log file while the service is collecting data to that file.

Solution: Stop the Performance Logs and Alerts service before trying to use it with Microsoft Excel.

I lost my connection to a remote computer from which I was logging data and I cannot resume logging.

Cause: Logging data from a remote computer requires the use of Remote Registry Service. If the service stops due to failure, by default the system restarts it automatically only once.

Solution: If Remote Registry Service stops more than once, you must restart the service manually on the second and any subsequent failures. To change this default behavior, use Computer Management or Services (on the Administrative Tools menu) to modify the properties for Remote Registry Service.

Help for System Monitor does not appear in MMC Help; only Performance Logs and Alerts is displayed.

Cause: Because System Monitor is designed as an ActiveX control, its behavior differs from other MMC snap-ins. For example, System Monitor Help is not available when you right-click System Monitor and then click Help on the shortcut menu, or when you click Help Topics on the Help menu.

Solution: Click the Help button on the System Monitor toolbar.

I cannot log performance counters from a remote computer.

Cause: You may not have permission to view the counters on the remote machine.

Solution: Ask the administrator of the remote machine to give you read access to the remote computer.

Cause: You may not have the correct privileges granted through Group Policy.

Solution: Ask the administrator of the remote machine to grant you access through the following User Rights policies: Profile System Performance and Profile a Single Process.

Cause: The Performance Logs and Alerts service may not have permission to log on to the remote computer or to create and update the log file.

Solution: Use the Run As text box and Password button to specify the logon account name with the necessary permissions for the performance logs and alerts service. You can access these features from the General tab.

Cause: The Remote Registry service is not running on the remote machine.

Solution: On the remote computer, start the Remote Registry service.

Open Computer Management
In the console tree, click Services.

Where?

Services and Applications > Services
In the details pane, click Remote Registry Service
On the Action menu, click Start.

Cause: The log file size limit may not be large enough to collect your requested data.

Solution: Increase the limit of the log file size or set the file size to the maximum limit allowed. For more information, see To set file parameters for a log

Cause: The log update interval may be too short to allow the server to respond to each periodic data request.

Solution: Increase the log's update interval. For more information, see To view or change properties of a log or alert

My counters used to work, but since I installed a new application the counters don't work. Is there a way to restore the old counter settings?

Cause: Whenever you install a new application that installs performance counters on the operating system, Windows creates a backup copy of the performance counter registry entries taken prior to the addition of the application's performance counters file. This backup is saved as a file named PerfStringBackup.INI. If Windows successfully adds the application's performance counters file, it then replaces the previous version of the PerfStringBackup.INI file with the file that it just created.

Solution: Restore the performance counter registry to the state described in the uncorrupted backup file by using the following command:

LODCTR /R:filename

where filename is name of the backup performance counter registry entry file.

Note

To make a backup copy at any time of the performance counter registry settings, use the following command:

LODCTR /S:filename

where filename is any name. You can save these backup files anywhere on your computer.

Note

For information on troubleshooting your computer using performance monitoring tools, see [Reviewers: This is a placeholder for a link to the troubleshooting Website.]

Troubleshooting

Additional resources