Re: Performance Monitoring Events
- From: "Robert Zahm" <robzahm@xxxxxxxxxxx>
- Date: Mon, 24 Oct 2005 11:15:14 -0500
Jenny,
I didn't end up getting a chance to try this out this weekend, so most
likely I will have to push it back a week.
Thanks,
Rob
""Jenny wu [MSFT]"" <v-yanniw@xxxxxxxxxxxxxxxxxxxx> wrote in message
news:QFY3cVI2FHA.3220@xxxxxxxxxxxxxxxxxxxxxxxx
> Hi Rob,
>
> Thanks for your update!
>
> I am sorry for the delayed response due to weekend. Please understand that
> the newsgroups are staffed weekdays by Microsoft Support professionals to
> answer your systems and applications questions. Your understanding is
> greatly appreciated!
>
> I appreciate you time and efforts to the issue. Please feel free to post
> back when you need further assistance on this issue and you are always
> welcome!
>
> Have a nice day!
>
> Sincerely,
>
> Jenny Wu
> Microsoft CSS Online Newsgroup Support
> Get Secure! - www.microsoft.com/security
> ======================================================
> This newsgroup only focuses on SBS technical issues. If you have issues
> regarding other Microsoft products, you'd better post in the corresponding
> newsgroups so that they can be resolved in an efficient and timely manner.
> You can locate the newsgroup here:
> http://www.microsoft.com/communities/newsgroups/en-us/default.aspx
>
> When opening a new thread via the web interface, we recommend you check
> the
> "Notify me of replies" box to receive e-mail notifications when there are
> any updates in your thread. When responding to posts via your newsreader,
> please "Reply to Group" so that others may learn and benefit from your
> issue.
>
> Microsoft engineers can only focus on one issue per thread. Although we
> provide other information for your reference, we recommend you post
> different incidents in different threads to keep the thread clean. In
> doing
> so, it will ensure your issues are resolved in a timely manner.
>
> For urgent issues, you may want to contact Microsoft CSS directly. Please
> check http://support.microsoft.com for regional support phone numbers.
>
> Any input or comments in this thread are highly appreciated.
> ======================================================
> This posting is provided "AS IS" with no warranties, and confers no
> rights.
>
> --------------------
>>From: "Robert Zahm" <robzahm@xxxxxxxxxxx>
>>References: <#qyuepL1FHA.3180@xxxxxxxxxxxxxxxxxxxx>
> <lQCWvET1FHA.3884@xxxxxxxxxxxxxxxxxxxxx>
>>Subject: Re: Performance Monitoring Events
>>Date: Fri, 21 Oct 2005 13:09:55 -0500
>>Lines: 223
>>X-Priority: 3
>>X-MSMail-Priority: Normal
>>X-Newsreader: Microsoft Outlook Express 6.00.2900.2670
>>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670
>>X-RFC2646: Format=Flowed; Original
>>Message-ID: <u2qDlqm1FHA.664@xxxxxxxxxxxxxxxxxxxx>
>>Newsgroups: microsoft.public.windows.server.sbs
>>NNTP-Posting-Host: 64-45-168-10.client.cypresscom.net 64.45.168.10
>>Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!tk2msftngp13.phx.gbl
>>Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:163443
>>X-Tomcat-NG: microsoft.public.windows.server.sbs
>>
>>Jenny,
>>
>>Thanks for your reply, I will try the KB steps you outlined over the
>>weekend.
>>
>>Thanks,
>>
>>Rob
>>
>>""Jenny wu [MSFT]"" <v-yanniw@xxxxxxxxxxxxxxxxxxxx> wrote in message
>>news:lQCWvET1FHA.3884@xxxxxxxxxxxxxxxxxxxxxxxx
>>> Hi Robert,
>>>
>>> Thanks for posting here!
>>>
>>> For your description, I understand that you got warning event 5603 and
>>> 2003
>>> warning event when reboot server box. If I am off base, please don't
>>> hesitate to let me know.
>>>
>>> 1. Event 5603
>>>
>>> Based on my research, this is a by-design behavior. The reasoning behind
>>> the warning is that the operating system informs the administrators that
> a
>>> WMI provider runs under the LocalSystem context. This is the reason why
> we
>>> see this warning anytime the WMI service starts up.
>>>
>>> Actually, this does not indicate a system error. We can safely ignore
>>> the
>>> event. Please do not worry.
>>>
>>> 2. Event 2003
>>>
>>> This event could occur when server was heavy loaded or some particular
>>> third-party software was installed on the server. Could you please tell
> me
>>> if there is any server management software ware such as HP agent service
>>> installed on the SBS server? If so, you may disable the third-party
>>> management software to see if the problem will occur again. If the
> warning
>>> only occurs when the server is starting up, there will be no impact to
>>> your
>>> SBS server. I''ve tested the steps of KB267831 on my SBS 2003 server.
>>> It''s
>>> safely to use the steps on a SBS 2003 server.
>>>
>>> You can refer to the KB 267831 article to resolve the issue:
>>> Event ID 2003 Warning Message Logged When Loading Performance Counters
>>> http://support.microsoft.com/?id=267831
>>>
>>> And also you can try to remove the "Library Validation Code" value from
>>> registry to try to resolve the issue:
>>>
>>> Open Regedit, locate the
>>> "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Performance"
>>> registry key and you will find the "Library Validation Code" value.
>>>
>>> WARNING: If you use Registry Editor incorrectly, you may cause serious
>>> problems that may require you to reinstall your operating system. Please
>>> backup the registry keys before edit it.
>>>
>>> How about the result?
>>>
>>> What is more, you can view the following link to get more information
>>> about
>>> the 2003 error event:
>>>
> http://www.eventid.net/display.asp?eventid=2003&eventno=705&source=Perflib&p
>>> hase=1
>>>
>>> Related information:
>>>
>>> Create and Configure Performance Monitor Alerts in Windows 2000
>>> http://support.microsoft.com/?id=302558
>>>
>>> Troubleshooting Performance Monitor Counter Problems
>>> http://support.microsoft.com/?id=152513
>>>
>>> How to manually rebuild Performance Counter Library values
>>> http://support.microsoft.com/?id=300956
>>>
>>> Events for Performance Monitor Extensions
>>> http://support.microsoft.com/?id=226494
>>>
>>> Hope above information helps! If you have any further concern on the
> issue
>>> please feel free to let me know. I am happy to be assistance of you!
>>>
>>> Have a nice day!
>>>
>>> Best Regards,
>>>
>>> Jenny Wu
>>> Microsoft CSS Online Newsgroup Support
>>> Get Secure! - www.microsoft.com/security
>>> ======================================================
>>> This newsgroup only focuses on SBS technical issues. If you have issues
>>> regarding other Microsoft products, you'd better post in the
> corresponding
>>> newsgroups so that they can be resolved in an efficient and timely
> manner.
>>> You can locate the newsgroup here:
>>> http://www.microsoft.com/communities/newsgroups/en-us/default.aspx
>>>
>>> When opening a new thread via the web interface, we recommend you check
>>> the
>>> "Notify me of replies" box to receive e-mail notifications when there
>>> are
>>> any updates in your thread. When responding to posts via your
>>> newsreader,
>>> please "Reply to Group" so that others may learn and benefit from your
>>> issue.
>>>
>>> Microsoft engineers can only focus on one issue per thread. Although we
>>> provide other information for your reference, we recommend you post
>>> different incidents in different threads to keep the thread clean. In
>>> doing
>>> so, it will ensure your issues are resolved in a timely manner.
>>>
>>> For urgent issues, you may want to contact Microsoft CSS directly.
>>> Please
>>> check http://support.microsoft.com for regional support phone numbers.
>>>
>>> Any input or comments in this thread are highly appreciated.
>>> ======================================================
>>> This posting is provided "AS IS" with no warranties, and confers no
>>> rights.
>>>
>>> --------------------
>>>>From: "Robert Zahm" <robzahm@xxxxxxxxxxx>
>>>>Subject: Performance Monitoring Events
>>>>Date: Wed, 19 Oct 2005 09:35:34 -0500
>>>>Lines: 78
>>>>X-Priority: 3
>>>>X-MSMail-Priority: Normal
>>>>X-Newsreader: Microsoft Outlook Express 6.00.2900.2670
>>>>X-RFC2646: Format=Flowed; Original
>>>>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670
>>>>Message-ID: <#qyuepL1FHA.3180@xxxxxxxxxxxxxxxxxxxx>
>>>>Newsgroups: microsoft.public.windows.server.sbs
>>>>NNTP-Posting-Host: 64-45-168-10.client.cypresscom.net 64.45.168.10
>>>>Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP14.phx.gbl
>>>>Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:162685
>>>>X-Tomcat-NG: microsoft.public.windows.server.sbs
>>>>
>>>>I found the warnings listed below in the event logs of our Windows
> SBS2003
>>>>SP1 machine after startup. They were also logged when I attempted to
>>>>myself the performance monitoring report (along with an error dialog
>>>>that
>>>>told me that an error had occured, and that I should check the
>>> configuration
>>>>settings). I saw some things about unloading/reloading DLLs, reseting
>>>>performance counters, reinstalling IIS and updating registry entries,
>>>>but
>>> I
>>>>would like a little more information and some reassurance before doing
>>>>anything like that.
>>>>
>>>>Thanks,
>>>>
>>>>Rob
>>>>
>>>>Here are the events that are logged (from what I gather, I can ignore
>>>>the
>>>>duplicate 5603 errors, but I'm guessing my problem lies with that last
>>> one):
>>>>
>>>>Event Type: Warning
>>>>Event Source: WinMgmt
>>>>Event Category: None
>>>>Event ID: 5603
>>>>Date: 10/15/2005
>>>>Time: 9:29:39 PM
>>>>User: NT AUTHORITY\SYSTEM
>>>>Computer: BRADFORDDC01
>>>>Description:
>>>>A provider, PerfProv, has been registered in the WMI namespace,
>>>>ROOT\CIMV2\MicrosoftHealthMonitor\PerfMon, but did not specify the
>>>>HostingModel property. This provider will be run using the LocalSystem
>>>>account. This account is privileged and the provider may cause a
> security
>>>>violation if it does not correctly impersonate user requests. Ensure
> that
>>>>provider has been reviewed for security behavior and update the
>>> HostingModel
>>>>property of the provider registration to an account with the least
>>>>privileges possible for the required functionality.
>>>>
>>>>For more information, see Help and Support Center at
>>>>http://go.microsoft.com/fwlink/events.asp.
>>>>
>>>>
>>>>Event Type: Warning
>>>>Event Source: WinMgmt
>>>>Event Category: None
>>>>Event ID: 5603
>>>>Date: 10/15/2005
>>>>Time: 9:29:39 PM
>>>>User: NT AUTHORITY\SYSTEM
>>>>Computer: BRADFORDDC01
>>>>Description:
>>>>A provider, PerfProv, has been registered in the WMI namespace,
>>>>ROOT\CIMV2\MicrosoftHealthMonitor\PerfMon, but did not specify the
>>>>HostingModel property. This provider will be run using the LocalSystem
>>>>account. This account is privileged and the provider may cause a
> security
>>>>violation if it does not correctly impersonate user requests. Ensure
> that
>>>>provider has been reviewed for security behavior and update the
>>> HostingModel
>>>>property of the provider registration to an account with the least
>>>>privileges possible for the required functionality.
>>>>
>>>>For more information, see Help and Support Center at
>>>>http://go.microsoft.com/fwlink/events.asp.
>>>>
>>>>
>>>>Event Type: Warning
>>>>Event Source: Perflib
>>>>Event Category: None
>>>>Event ID: 2003
>>>>Date: 10/15/2005
>>>>Time: 9:29:43 PM
>>>>User: N/A
>>>>Computer: BRADFORDDC01
>>>>Description:
>>>>The configuration information of the performance library
>>>>"C:\WINDOWS\system32\inetsrv\w3ctrs.dll" for the "W3SVC" service does
>>>>not
>>>>match the trusted performance library information stored in the
>>>>registry.
>>>>The functions in this library will not be treated as trusted.
>>>>
>>>>For more information, see Help and Support Center at
>>>>http://go.microsoft.com/fwlink/events.asp.
>>>>
>>>>
>>>>
>>>
>>
>>
>>
>
.
- References:
- Performance Monitoring Events
- From: Robert Zahm
- Re: Performance Monitoring Events
- From: "Jenny wu [MSFT]"
- Performance Monitoring Events
- Prev by Date: Where exactly is the SQL setup
- Next by Date: Re: Usage Report
- Previous by thread: Re: Performance Monitoring Events
- Next by thread: Re: Performance Monitoring Events
- Index(es):
Relevant Pages
|
