Customers report the following messages generated by “Dmperfss” in the Application Event Log:

Event Type:           Warning

Event Source:       DMPerfss

Event Category:    Windows

Event ID:                1607

Date:                      1/13/2009

Time:                      1:00:00 AM

User:                      NT AUTHORITY\SYSTEM

Computer:             HOU150NTAH3D396

Description:

Win32 exception, 0xC0000005, encountered at location 0×00000000

Read attempt at location 0×00000000

…

0×7C800000-0×7CB00000) C:\WINDOWS\system32\ntdll.dll

(0×7C8D0000-0×7E8CC000) C:\WINDOWS\system32\SHELL32.dll

(0×7E020000-0×7E05C000) C:\WINDOWS\system32\SAMLIB.dll

Stack Trace, Thread, mscoree.dll (1808):

The system error was “The instruction at “0x (0xC0000005)”.

The same error is also recorded in the NTSMF.LOG file.

This is only a warning message and does not affect the ability of the Performance Sentry Collection Service (NTSMF) to collect performance data.

However, for Systems Administrators in charge of monitoring the conditions of a server, this rather ominous looking message can cause alarm and the assumption that the Performance Sentry Collection Service is not operating properly. 

The messages are generated when the Performance Sentry Collection Service (NTSMF) version 3.0 opens the performance library “mscoree.dll” which is contained in the .NET Framework, version 2.0, SP1.

 These messages do not adversely impact the collection service and performance data continues to be collected and written to the .SMF data file.

Solution:

To avoid receiving these nuisance messages under Performance Sentry version 3.0, replace the file “Dmperfss.cfg” with the “Dmperfss.cfg” file having the date of April 24,2008 found here: http://www.demandtech.com/Downloads/Dmperfsscfg.zip

The program file “Dmperfss.exe” normally resides in the “Program Files\NTSMFxx” folder.

At the next Cycle End time, the Performance Sentry Collection Service will read the “Dmperfss.cfg” file and exclude the performance library mscoree.dll version 2.0.50727.1433 from further processing and no longer write the Message Event ID 1607.