Re: Performance Monitoring Events
- From: v-yanniw@xxxxxxxxxxxxxxxxxxxx ("Jenny wu [MSFT]")
- Date: Mon, 24 Oct 2005 10:26:09 GMT
Hi Rob,
Thanks for your update!
I am sorry for the delayed response due to weekend. Please understand that
the newsgroups are staffed weekdays by Microsoft Support professionals to
answer your systems and applications questions. Your understanding is
greatly appreciated!
I appreciate you time and efforts to the issue. Please feel free to post
back when you need further assistance on this issue and you are always
welcome!
Have a nice day!
Sincerely,
Jenny Wu
Microsoft CSS Online Newsgroup Support
Get Secure! - www.microsoft.com/security
======================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx
When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.
Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.
For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.
Any input or comments in this thread are highly appreciated.
======================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
--------------------
>From: "Robert Zahm" <robzahm@xxxxxxxxxxx>
>References: <#qyuepL1FHA.3180@xxxxxxxxxxxxxxxxxxxx>
<lQCWvET1FHA.3884@xxxxxxxxxxxxxxxxxxxxx>
>Subject: Re: Performance Monitoring Events
>Date: Fri, 21 Oct 2005 13:09:55 -0500
>Lines: 223
>X-Priority: 3
>X-MSMail-Priority: Normal
>X-Newsreader: Microsoft Outlook Express 6.00.2900.2670
>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670
>X-RFC2646: Format=Flowed; Original
>Message-ID: <u2qDlqm1FHA.664@xxxxxxxxxxxxxxxxxxxx>
>Newsgroups: microsoft.public.windows.server.sbs
>NNTP-Posting-Host: 64-45-168-10.client.cypresscom.net 64.45.168.10
>Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!tk2msftngp13.phx.gbl
>Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:163443
>X-Tomcat-NG: microsoft.public.windows.server.sbs
>
>Jenny,
>
>Thanks for your reply, I will try the KB steps you outlined over the
>weekend.
>
>Thanks,
>
>Rob
>
>""Jenny wu [MSFT]"" <v-yanniw@xxxxxxxxxxxxxxxxxxxx> wrote in message
>news:lQCWvET1FHA.3884@xxxxxxxxxxxxxxxxxxxxxxxx
>> Hi Robert,
>>
>> Thanks for posting here!
>>
>> For your description, I understand that you got warning event 5603 and
>> 2003
>> warning event when reboot server box. If I am off base, please don't
>> hesitate to let me know.
>>
>> 1. Event 5603
>>
>> Based on my research, this is a by-design behavior. The reasoning behind
>> the warning is that the operating system informs the administrators that
a
>> WMI provider runs under the LocalSystem context. This is the reason why
we
>> see this warning anytime the WMI service starts up.
>>
>> Actually, this does not indicate a system error. We can safely ignore the
>> event. Please do not worry.
>>
>> 2. Event 2003
>>
>> This event could occur when server was heavy loaded or some particular
>> third-party software was installed on the server. Could you please tell
me
>> if there is any server management software ware such as HP agent service
>> installed on the SBS server? If so, you may disable the third-party
>> management software to see if the problem will occur again. If the
warning
>> only occurs when the server is starting up, there will be no impact to
>> your
>> SBS server. I''ve tested the steps of KB267831 on my SBS 2003 server.
>> It''s
>> safely to use the steps on a SBS 2003 server.
>>
>> You can refer to the KB 267831 article to resolve the issue:
>> Event ID 2003 Warning Message Logged When Loading Performance Counters
>> http://support.microsoft.com/?id=267831
>>
>> And also you can try to remove the "Library Validation Code" value from
>> registry to try to resolve the issue:
>>
>> Open Regedit, locate the
>> "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Performance"
>> registry key and you will find the "Library Validation Code" value.
>>
>> WARNING: If you use Registry Editor incorrectly, you may cause serious
>> problems that may require you to reinstall your operating system. Please
>> backup the registry keys before edit it.
>>
>> How about the result?
>>
>> What is more, you can view the following link to get more information
>> about
>> the 2003 error event:
>>
http://www.eventid.net/display.asp?eventid=2003&eventno=705&source=Perflib&p
>> hase=1
>>
>> Related information:
>>
>> Create and Configure Performance Monitor Alerts in Windows 2000
>> http://support.microsoft.com/?id=302558
>>
>> Troubleshooting Performance Monitor Counter Problems
>> http://support.microsoft.com/?id=152513
>>
>> How to manually rebuild Performance Counter Library values
>> http://support.microsoft.com/?id=300956
>>
>> Events for Performance Monitor Extensions
>> http://support.microsoft.com/?id=226494
>>
>> Hope above information helps! If you have any further concern on the
issue
>> please feel free to let me know. I am happy to be assistance of you!
>>
>> Have a nice day!
>>
>> Best Regards,
>>
>> Jenny Wu
>> Microsoft CSS Online Newsgroup Support
>> Get Secure! - www.microsoft.com/security
>> ======================================================
>> This newsgroup only focuses on SBS technical issues. If you have issues
>> regarding other Microsoft products, you'd better post in the
corresponding
>> newsgroups so that they can be resolved in an efficient and timely
manner.
>> You can locate the newsgroup here:
>> http://www.microsoft.com/communities/newsgroups/en-us/default.aspx
>>
>> When opening a new thread via the web interface, we recommend you check
>> the
>> "Notify me of replies" box to receive e-mail notifications when there are
>> any updates in your thread. When responding to posts via your newsreader,
>> please "Reply to Group" so that others may learn and benefit from your
>> issue.
>>
>> Microsoft engineers can only focus on one issue per thread. Although we
>> provide other information for your reference, we recommend you post
>> different incidents in different threads to keep the thread clean. In
>> doing
>> so, it will ensure your issues are resolved in a timely manner.
>>
>> For urgent issues, you may want to contact Microsoft CSS directly. Please
>> check http://support.microsoft.com for regional support phone numbers.
>>
>> Any input or comments in this thread are highly appreciated.
>> ======================================================
>> This posting is provided "AS IS" with no warranties, and confers no
>> rights.
>>
>> --------------------
>>>From: "Robert Zahm" <robzahm@xxxxxxxxxxx>
>>>Subject: Performance Monitoring Events
>>>Date: Wed, 19 Oct 2005 09:35:34 -0500
>>>Lines: 78
>>>X-Priority: 3
>>>X-MSMail-Priority: Normal
>>>X-Newsreader: Microsoft Outlook Express 6.00.2900.2670
>>>X-RFC2646: Format=Flowed; Original
>>>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670
>>>Message-ID: <#qyuepL1FHA.3180@xxxxxxxxxxxxxxxxxxxx>
>>>Newsgroups: microsoft.public.windows.server.sbs
>>>NNTP-Posting-Host: 64-45-168-10.client.cypresscom.net 64.45.168.10
>>>Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP14.phx.gbl
>>>Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:162685
>>>X-Tomcat-NG: microsoft.public.windows.server.sbs
>>>
>>>I found the warnings listed below in the event logs of our Windows
SBS2003
>>>SP1 machine after startup. They were also logged when I attempted to
>>>myself the performance monitoring report (along with an error dialog that
>>>told me that an error had occured, and that I should check the
>> configuration
>>>settings). I saw some things about unloading/reloading DLLs, reseting
>>>performance counters, reinstalling IIS and updating registry entries, but
>> I
>>>would like a little more information and some reassurance before doing
>>>anything like that.
>>>
>>>Thanks,
>>>
>>>Rob
>>>
>>>Here are the events that are logged (from what I gather, I can ignore the
>>>duplicate 5603 errors, but I'm guessing my problem lies with that last
>> one):
>>>
>>>Event Type: Warning
>>>Event Source: WinMgmt
>>>Event Category: None
>>>Event ID: 5603
>>>Date: 10/15/2005
>>>Time: 9:29:39 PM
>>>User: NT AUTHORITY\SYSTEM
>>>Computer: BRADFORDDC01
>>>Description:
>>>A provider, PerfProv, has been registered in the WMI namespace,
>>>ROOT\CIMV2\MicrosoftHealthMonitor\PerfMon, but did not specify the
>>>HostingModel property. This provider will be run using the LocalSystem
>>>account. This account is privileged and the provider may cause a
security
>>>violation if it does not correctly impersonate user requests. Ensure
that
>>>provider has been reviewed for security behavior and update the
>> HostingModel
>>>property of the provider registration to an account with the least
>>>privileges possible for the required functionality.
>>>
>>>For more information, see Help and Support Center at
>>>http://go.microsoft.com/fwlink/events.asp.
>>>
>>>
>>>Event Type: Warning
>>>Event Source: WinMgmt
>>>Event Category: None
>>>Event ID: 5603
>>>Date: 10/15/2005
>>>Time: 9:29:39 PM
>>>User: NT AUTHORITY\SYSTEM
>>>Computer: BRADFORDDC01
>>>Description:
>>>A provider, PerfProv, has been registered in the WMI namespace,
>>>ROOT\CIMV2\MicrosoftHealthMonitor\PerfMon, but did not specify the
>>>HostingModel property. This provider will be run using the LocalSystem
>>>account. This account is privileged and the provider may cause a
security
>>>violation if it does not correctly impersonate user requests. Ensure
that
>>>provider has been reviewed for security behavior and update the
>> HostingModel
>>>property of the provider registration to an account with the least
>>>privileges possible for the required functionality.
>>>
>>>For more information, see Help and Support Center at
>>>http://go.microsoft.com/fwlink/events.asp.
>>>
>>>
>>>Event Type: Warning
>>>Event Source: Perflib
>>>Event Category: None
>>>Event ID: 2003
>>>Date: 10/15/2005
>>>Time: 9:29:43 PM
>>>User: N/A
>>>Computer: BRADFORDDC01
>>>Description:
>>>The configuration information of the performance library
>>>"C:\WINDOWS\system32\inetsrv\w3ctrs.dll" for the "W3SVC" service does not
>>>match the trusted performance library information stored in the registry.
>>>The functions in this library will not be treated as trusted.
>>>
>>>For more information, see Help and Support Center at
>>>http://go.microsoft.com/fwlink/events.asp.
>>>
>>>
>>>
>>
>
>
>
.
- Follow-Ups:
- Re: Performance Monitoring Events
- From: Robert Zahm
- Re: Performance Monitoring Events
- References:
- Performance Monitoring Events
- From: Robert Zahm
- Performance Monitoring Events
- Prev by Date: RE: CEICW Errors
- Next by Date: Re: Event ID 11 in System log
- Previous by thread: Performance Monitoring Events
- Next by thread: Re: Performance Monitoring Events
- Index(es):
Relevant Pages
|
