1. Is the Counter specified for collection, but not available for collection on the machine?

An Event ID 604 Warning message in the Application Event log (or the <computername>.ntsmf.log file) documents performance Counters that were specified in the DCS Data Definition, but are not available for collection on the local machine. This happens because not all the Counters associated with a given performance Object are available for collection across all versions of the associated Performance Library DLL that is responsible for maintaining them. While the developers of the operating system base Counters, like Processor and System, are pretty good about maintaining upward compatibility between versions of their Perflib DLLs, not all developers of Perflib DLLs are as circumspect.

For instance, if you specify that you want to collect all the Counters in the Internet Information Services Global Object and you are running IIS version 5.0, you are likely to receive a Warning message similar to the following:

10/30/02-09:06:00 – Event ID: 604, Category: DCS, Severity: Warning

The following global counters were specified in the DCS but not found on the local machine and will be skipped.

Object, Internet Information Services Global (L2596, G4022)

Counter, Cache Size (L0, G4024)

Counter, Cache Used (L0, G4026)

Counter, Cached File Handles (L0, G4028)

Counter, Directory Listings (L0, G4030)

Counter, Objects (L0, G4032)

Counter, Cache Flushes (L0, G4034)

Counter, Cache Hits (L0, G4036)

Counter, Cache Misses (L0, G4038)

Counter, Cache Hits % (L0, G4040)

Counter, Measured Async I/O Bandwidth usage/ (L0, G4052)

These are Counters that used to be in the Internet Information Services Global Object, but were dropped in later versions of IIS.

This situation is not an error condition (which is why the Collection service only warns you about it), but you need to abandon any hope you may have of collecting those specific Counters on this machine.

1. Is the Performance Library DLL associated with the missing data missing?

Sometimes the Performance Library DLL that is defined is simply missing on the local machine. When the Performance Sentry collection service attempts to load the Library module referenced in the HKLM\SYSTEM\CurrentControlSet\Services\<servicename>\Performance key, the module is not found. In this event, you should see an Application Event log similar to the following:

11/05/02-17:48:08 – Event ID: 210, Category: Discovery, Severity: Warning
The Performance Library, “Perfctrs.dll”, for service “TCP/IP Protocol Driver” (Tcpip), failed to load.
The system error was “The specified module could not be found (126)”.
Performance data for this service will not be available.
The Event Viewer (source Perflib) may have more details

In this example, the perfctrs.dll module identified in the Library field of the /Services/Tcpip/Performance subkey was missing. When the collection service tried to load it, the Load operation failed, for the following reason: “The specified module could not be found.” When a problem like this occurs, using either the Extended Counter List applet or the Registry Editor, determine where the Library is supposed to be and verify that the Perflib DLL is, in fact, missing. If the Library field of the /Performance subkey points to a fully qualified filename, look for the module in the folder specified. If only the module name is referenced, then look for it in the %system32% folder in the Windows <root> directory.

Sometimes this occurs when the application that installed the Performance Library was removed, but the corresponding Performance subkey was not deleted when the uninstall procedure executed. In this case, it is usually safe to remove the Performance subkey manually using the Registry Editor. The Event ID 210 Warning message will disappear after that.

However, if you feel that the missing Performance Library DLL is a mistake, try to correct the problem. Sometimes uninstalling and re-installing the application will restore the Perflib. Alternatively, try to locate a working version of the Performance Library DLL on a different machine running the same or a similar level of software. Copy that Perflib DLL module to this machine and then restart the collection service to see if that solves the problem.

1. Is the Performance Library DLL associated with the missing data defective?

When the collection service encounters a defective Perflib DLL, it generates Application Event log messages that help to document the data collection problem. Common problems that you might see reported include:

1. a Perflib DLL that does not initialize successfully,

2. a Perflib DLL that fails to return any Objects and Counters, and

3. a Perflib DLL that returns zero values for all the Counter values that it reports.

Sometimes, the Perflib DLL has a bug which causes an unhandled Exception or other error condition that causes the collection thread calling the Module to terminate. Prior to terminating, the collection service (assuming you are running the “fat” version of the collector) will generate a Stack trace showing the precise status of the collection thread at the time the error occurred. This diagnostic trace information should be forwarded to the party responsible for the Perflib DLL that failed for resolution.

An example diagnostic trace message generated by an unhandled exception in a Perflib DLL is illustrated below:

As a result of encountering a serious error condition related to calling a defective Performance Library DLL, the collection service will recover and continue to gather data from whatever Perflib DLLs that are functioning correctly for the duration of the collection cycle. While the collection service bypasses collecting data from the defective Perflib for the remainder of the collection cycle, it will automatically retry the module in the initialization phase at the beginning of the next collection cycle. Consequently, the Warning messages that document the problem are likely to recur regularly at the beginning of each collection cycle until you decide to investigate and resolve the problem.

Only the most serious Perflib DLL defects trigger a diagnostic trace message. You are much more likely to encounter less serious defects like the ones described below.

Sometimes the collection service is able to locate and load the Perflib DLL without problems, but cannot gather the performance data the Perflib was designed to collect. Consider that many Perflib DLLs associated with extended Counters are designed to gather data from inside servers application processes like sqlserver.exe, store.exe, and inetinfo.exe. A frequent cause of data collection problems is that the process that a Perflib DLL needs to acquire performance data from is not running. For example, if the sqlserver.exe process is shutdown, the sqlctr80.dll Perflib DLL designed to gather SQL Server statistics will report an error condition, which the collection thread will post to the Event log.

If sqlserver.exe stops running or is hung for some reason, failed attempts to gather data SQL performance data from the SQL Performance Library DLL (e.g., sqlctr80.dll) will generate Warning messages like the following for each SQL performance Object the collector has been instructed to collect:

11/05/02-22:31:00 – Event ID: 2200, Category: Collection, Severity: Warning
Object, SQLServer:General Statistics (L2346, G17300), failed to return data this interval

11/05/02-22:31:00 – Event ID: 2200, Category: Collection, Severity: Warning
Object, SQLServer:Databases (L2370, G17700), failed to return data this interval

11/05/02-22:31:00 – Event ID: 2200, Category: Collection, Severity: Warning
Object, SQLServer:SQL Statistics (L2470, G18300), failed to return data this interval

Errors can also arise when the process that the Perflib DLL must communicate with to gather performance data is simply unavailable. In this example, the w3ctrs.dll Performance Library DLL cannot access the Inetinfo Web server publishing service that is the source for the Web service performance data that it reports.

11/05/02-16:50:16 – Event ID: 1309, Category: PerfData, Severity: Warning
World Wide Web Publishing (Global): no objects were found in the performance data buffer

11/05/02-16:51:16 – Event ID: 96, Category: N/A, Severity: Warning
The following performance libraries failed to return data.
Data from objects from these libraries will be unavailable for this cycle.
World Wide Web Publishing (W3SVC), “w3ctrs.dll”

11/05/02-16:51:16 – Event ID: 2200, Category: Collection, Severity: Warning
The following objects were specified in the DCS but failed to return data.
These objects will be skipped this cycle.
Web Service (L0, G8300)

11/05/02-16:51:16 – Event ID: 2200, Category: Collection, Severity: Warning
Object, Web Service Web Service (L0, G8300), failed to return data this interval

To rectify this situation, you need to resolve the underlying problem that is preventing the process the Perflib DLL depends on from running.

Version 2.4.7 of the Performance SeNTry (NTSMF) data collector will not execute if DEP is active. This does not apply to versions after 2.4.7

For details and options, see this Technical Note.

The main dispatcher thread of the Collection service generates a separate collection thread for each Perflib DLL that it finds installed on the local machine during the Discovery phase at the beginning of every collection cycle. (Follow this link for more .) Each Open and Collect call to a Perflib DLL is performed under a dedicated collection thread. With the threaded collector, it is possible to detect and recover from most failures involving direct calls to Perflib DLLs, sometimes even when calls via the Microsoft PDH and WMI plumbing that other products use, including System Monitor, fail. Under normal circumstances, the NTSMF collection service continues to gather performance data even in the face of buggy, third party Perflib DLL modules.

There are extenuating circumstances when it is desirable for the NTSMF collection agent to ignore completely specific Performance Library DLLs that are defective and perform no processing on these modules. Performance Library DLLs that malfunction in the following ways are candidates for exclusion from all NTSMF processing :

• The Perflib fails to return properly from any Open or Collect call and causes the collection agent, the application being monitored, or the system to hang.
• When NTSMF successfully opens the Performance Library DLL, the module cannot be shared properly with other applications that also attempt to Open them.

When defective Perflibs are excluded from processing, the NTSMF collection agent does not attempt to load the DLLs or call their Open routines during the Discovery phase at the beginning of every collection cycle. You exclude these defective Perflibs from all NTSMF-related processing using entries in the DmPerfss.cfg configuration file.

Note: the use of the the DmPerfss.cfg configuration file is optional. A default DmPerfss.cfg configuration file is installed automatically when you run the standard software Setup routine. The default DmPerfss.cfg configuration file contains entries for Performance Library DLLs that we have seen cause severe problems in some of our customer sites. We recommend that you install and use the default DmPerfss.cfg configuration file.  You can modify the defaultDmPerfss.cfg configuration file using any text editor if you determine there are additional Performance Library DLLs that need to be excluded from NTSMF processing. We recommend that you contact Customer Support before you make modifications to the DmPerfss.cfg configuration file for your environment. If you are having a problem, there may well be other solutions to consider. If the Performance Library DLL is defective, we might like to let other customers know about it.

The <Perflibs> section of the DmPerfss.cfg configuration file can contain an Exclude list and an Include section. These sections identify specific Performance Library DLLs by module name (and optionally by version) that are to be excluded or included for processing at the beginning of a collection cycle.

Exclude list. The Exclude list causes the collector to exclude the modules listed (by version, if specified) from all NTSMF collection agent processing. The collection agent will not attempt to load a Perflib DLL module on the Exclude list at the beginning of a collection cycle. The Version specification is optional. Module entries without a version specification cause all versions of the Perflib DLL to be excluded. If specific Perflib DLL module versions are to be excluded, then they must be listed in the Version section. If there are duplicate entries, the Exclude list takes precedence over modules on the Include list .

Code a <Module FileName=”filename“></Module> section for each Performance Library DLL that you want to exclude from processing. Optionally, you can add one or more <Version> specifications that qualify which versions of the Performance Library DLL should be excluded. If the <Version> specification does not exist, any version of the Performance Library DLL that is found is excluded.

An example DmPerfss.cfg configuration file with an Exclude list is coded below:

<PerfLibs>

<Exclude>
<! — Sybase ASA object –>
<Module FileName=”dbctrs8.dll”></Module>

<!– .NET CLR Data, NET CLR Networking –>
<Module FileName=”netfxperf.dll”><Version>1.0.3215.11</Version></Module>

<!– .NETFramework –>
<Module FileName=”mscoree.dll”><Version>1.0.3215.11</Version></Module>

<!– FileReplicaConn, FileReplicaSet –>

<Module FileName=”NTFRSPRF.dll”><Version>5.1.3590.0</Version></Module>

<!– WmiApRpl –>
<Module FileName=”wmiaprpl.dll”><Version>5.1.3590.0</Version></Module>

<!– Lotus Notes –>
<Module FileName=”nnotes.dll”> </Module>

</Exclude></PerfLibs>

Text inside a <! This is a comment > Comment section is ignored.

During the Discovery phase at the start of every collection cycle, the DmPerfss.cfg configuration file is processed to determine what Performance Library DLLs should be excluded from processing during that cycle. An Event ID 214 Informational message is written to the <computername>.ntsmf.log file that documents the Performance Library DLLs that were specifically excluded from processing, as illustrated below:

08/02/04-00:00:11 – Event ID: 214, Category: Discovery, Severity: Info

The following Performance Libraries are excluded from processing as specified in DmPerfss.cfg. Performance data from these libraries will not be available this cycle.
.NET CLR Data (.NET CLR Data), “netfxperf.dll”, version 1.1.4322.573
.NET CLR Networking (.NET CLR Networking), “netfxperf.dll”, version 1.1.4322.573
.NETFramework (.NETFramework), “mscoree.dll”, version 1.1.4322.573
WmiApRpl (WmiApRpl), “C:\WINDOWS\System32\wbem

Error Messages. In the case of errors accessing the DmPerfss.cfg configuration file, the configuration file is ignored and collection cycle processing proceeds as if theDmPerfss.cfg configuration file did not exist.

If the the DmPerfss.cfg configuration file is invalid, then the following Warning message is written:

08/02/03-00:50:13 – Event ID: 96, Category: None, Severity: Warning
The configuration file failed to open.
The Inclusion/Exclusion list will not be used this cycle.

If the DmPerfss.cfg configuration file contains syntax errors, then the following Warning message is written:

08/02/03-00:50:13 – Event ID: 96, Category: None, Severity: Warning
Failed to load, “E:\DmPerfss 2.4.6\bin\Debug\DmPerfss.cfg”.
Parse error, 0xC00CE503, encountered on line, 25, at position, 14.
Reason = Incorrect syntax was used in a comment.