Troubleshooting Performance monitoring

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

Troubleshooting

What problem are you having?

• Counter values consistently equal zero.

• System Monitor shows gaps in its line graphs.

• Values recorded in a log do not appear in the graph view.

• Objects, counters, or instances seem to be missing or invalid.

• I sometimes see an extremely high value for one instance and not another while I am monitoring processes of the same name.

• While monitoring several threads, if one thread stops, its data appears to be reported for another.

• An error message is displayed if I try to export log data to Microsoft Excel while the Performance Logs and Alerts service is actively collecting data to that log.

• I lost my connection to a remote computer from which I was logging data and I cannot resume logging.

• Help for System Monitor does not appear in MMC Help; only Performance Logs and Alerts is displayed.

• I cannot log performance counters from a remote computer.

• My counters used to work, but since I installed a new application they do not work. Is there a way to restore the old counter settings?

• A remote performance counter query might return incorrect zero value for process elapsed time.

Counter values consistently equal zero.

Cause:  The process being monitored has stopped so there is no data in the performance tools.

Solution:  If you stopped the process manually, restart it to see the process in System Monitor. Otherwise, check Event Viewer for concurrent entries. You may find an error associated with this process.

Cause:  The counter DLL was disabled after you selected the corresponding counters in a log or display. The performance tools will not detect that the counter was removed or disabled but will report the counter data as zeros.

Solution:  Enable the corresponding counter DLL.

Cause:  You lack the appropriate administrative credentials on the computer being monitored.

Solution:  An administrator must ensure that your user account has the appropriate administrative credentials to use the performance tools.

System Monitor shows gaps in its line graphs.

Cause:  This could be because data collection was subordinated to a processing activity with a higher priority on a system with a heavy load. When the system has adequate resources to continue with data collection, the graphing will resume as usual. A message appears describing this.

Solution:  Reduce the performance overhead of system monitoring.

See also:  Performance monitoring best practices

Values recorded in a log do not appear in the graph view.

Cause:  The graph is limited to 100 samples.

Solution:  Reduce the selected time range. For more information, see Use logged data.

Cause:  You did not add counters to the graph view.

See also:  For more information, see Add counters to System Monitor.

Objects, counters, or instances seem to be missing or invalid.

Cause:  Test routines that run when you open the Performance console have detected a problem with installed counters and have disabled the counters automatically to prevent them from slowing the system. Disabled objects and counters do not appear in the Add Counters dialog box.

Solution #1:  You can enable the disabled counters. Using Registry Editor, change the value under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Service_name\Performance\Disable Performance Counters from 1 for disable to 0 for enable. Note that counters that have been disabled after initial testing are likely to contain errors and may cause system problems. For information about debugging problems with counter DLLs, see the Microsoft Web site.

Solution #2:  You can turn off the automatic testing feature for the counter DLL or adjust the level of testing. Using Registry Editor, locate the Configuration Flags subkey under HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Perflib and change the value of the REG_DWORD entry for this subkey:

Cause:  The process that starts the object counters is not started or installed.

Solution:  Use Task Manager to verify that the process is running. If not, use Exctrlst.exe.

See also: Windows Resource Kit Tools Help.

Cause:  The counters have not been enabled.

Solution:  Make sure that the service or feature that provides the counter has been installed or configured.

Cause:  The DLL that installs the counters is generating errors. An example is possible problems with localization functions by the counter.

Solution:  Check Event Viewer to see whether the counter DLL or the Performance Data Helper reported any errors. If necessary, you can disable counter DLLs that are causing errors by using Exctrlst.exe.

See also:  Windows Resource Kit Tools Help.

Cause:  You are trying to monitor a 16-bit or MS-DOS application. Only 32-bit processes appear in the instances list. Active 16-bit processes appear as threads running in a Windows Virtual DOS Machine (NTVDM) process.

Solution:  Monitor the application through the NTVDM process.

Cause:  The instance you want to monitor is not currently active. If you are configuring System Monitor to collect real-time data, you can only select active instances for data collection. (If you are viewing logged data, you can select inactive instances for which the log contains data.) If you select the process and it stops after you've selected it, it will continue to appear in the list box but the reported data will be zeros.

Solution:  Make sure the instance is active.

I sometimes see an extremely high value for one instance and not another while I am monitoring processes of the same name.

Cause:  The performance tools sometimes misrepresent data for separate instances of processes with the same name by reporting the combined values of the instances as the value of a single instance.

Solution:   Use the instance index and track the Process\ID Process and Process\Creating Process ID counters.

While monitoring several threads, if one thread stops, its data appears to be reported for another.

Cause:  This is caused by the way threads are numbered. For example, assume you are monitoring three threads, numbered 0, 1, and 2. If thread 0 stops, the remaining threads get renumbered. The original thread 0 is now gone and the original thread 1 is renamed 0. As a result, data for the stopped thread 0 could be reported along with data for the running thread 1 because the previous thread 1 is now the current thread 0.

Solution:  Use the instance index with Thread ID to track these threads.

An error message is displayed if I try to export log data to Microsoft Excel while the Performance Logs and Alerts service is actively collecting data to that log.

Cause:  Microsoft Excel requires exclusive access to the log file. Most other programs do not require this exclusive access; therefore, in general, you can work with data from a log file while the service is collecting data to that file.

Solution:  Stop the log collection using Performance Logs and Alerts before trying to use the log data with Microsoft Excel.

I lost my connection to a remote computer from which I was logging data and I cannot resume logging.

Cause:  Logging data from a remote computer requires the use of Remote Registry Service. If the service stops due to failure, by default the system restarts it automatically only once.

Solution:  If Remote Registry service stops more than once, you must restart the service manually on the second and any subsequent failures. To change this default behavior, use Computer Management or Services (on the Administrative Tools menu) to modify the properties for Remote Registry service.

Help for System Monitor does not appear in MMC Help; only Performance Logs and Alerts is displayed.

Cause:  Because System Monitor is designed as an ActiveX control, its behavior differs from other Microsoft Management Console (MMC) snap-ins. For example, System Monitor Help is not available when you right-click System Monitor and then click Help on the shortcut menu, or when you click Help Topics on the Help menu.

Solution:  Click the Help button on the System Monitor toolbar.

I cannot log performance counters from a remote computer.

Cause:  You may not have administrative credentials to view the counters on the remote computer.

Solution:  Ask the administrator of the remote computer to give you read access to the remote computer.

Cause:  You may not have the correct administrative credentials granted through Group Policy.

Solution:  Ask the administrator of the remote computer to grant you access through the following User Rights policies: Profile System Performance and Profile a Single Process.

See also:  Group Policy (pre-GPMC).

Cause:  The Performance Logs and Alerts service may not have permission to log on to the remote computer or to create and update the log file.

Solution:  Use the Run as text box and Password button to specify the logon account name with the necessary permissions for the Performance Logs and Alerts service. You can access these features from the General tab.

Cause:  The Remote Registry service is not running on the remote computer.

Solution:  Ensure that the Remote Registry service is started on the remote computer. You need appropriate permissions on the remote computer to start the service.

Note

• You might also receive this error message if the remote computer is running Windows 95. Computer Management does not support remote access to computers that are running Windows 95.

See also: Start, stop, pause, resume, or restart a service.

Cause:  The size limit of the log file may not be large enough to collect your requested data.

Solution:  Increase the limit of the log file size or set the file size to the maximum limit allowed.

See also:  Set parameters for a log.

Cause:  The log update interval may be too short to allow the server to respond to each periodic data request.

Solution:  Increase the log update interval.

See also:  View or change properties of a log or alert.

My counters used to work, but since I installed a new application they do not work. Is there a way to restore the old counter settings?

Cause:  Whenever you install a new application that installs performance counters on your operating system, the operating system creates a backup copy of the performance counter registry entries taken prior to the addition of the new application's performance counters file. This backup is saved as a file named PerfStringBackup.ini. If your operating system successfully adds the new application's performance counters file, it then replaces the previous version of the PerfStringBackup.ini file with the file that it just created.

Solution:  Restore the performance counter registry to the state described in the uncorrupted backup file by using the following command: **LODCTR /R:**filename where filename is the name of the backup file of the performance counter registry entries.

Note

• To make a backup copy at any time of the performance counter registry settings, use the following command:

  **LODCTR /S:**filename

  where filename is any name. You can save these backup files anywhere on your computer.

A remote performance counter query might return incorrect zero value for process elapsed time.

Cause:  If an application queries performance counters through remote registry, some performance counters might appear with zero values.This is caused by a remote registry design limitation. The issue will occur if your application calls WNetAddConnection2W with a CONNECT_UPDATE_PROFILE flag prior to opening a remote registry handle.

Solution:  This is a known issue that is resolved in Windows Server 2008.