Missing data in .blg file when an unrelated counter could not be added

Aug 17, 2012 at 10:41 AM

Again thanks for a great product.

I have the following issue.

1)      Installed PAL v2.3 on a Win7 64 bit box
2)      Exported the System Overview template to Server 2003 format (htm)
3)      On a Server 2003 (32 bit), imported the template (using Log settings from in perfmon)
4)      Waited a week before stopping the counter log and copying the blg file back to my Win7 machine
5)      Ran PAL

However the PAL report was missing a lot of information.

Opened the blg (in perfmon) and it was missing a lot of data (f.x. \Process(*) data was not there). Went back to the Server 2003 machine and check the blg file. Still the data was missing.

Finally, check the event log on the server and it included these: (I have removed the computername)

Event Type:     Warning

Event Source: SysmonLog

Event Category:                          None

Event ID:           2028

Date:                                               17-08-2012

Time:                                               11:09:49

User:                                               N/A

Computer:      

Description:

The service was unable to add the counter '\Network Inspection System\Average inspection latency (sec/bytes)' to the PAL_System_Overview log or alert. This log or alert will continue, but data for that counter will not be collected. The error returned is: The specified object is not found on the system.

.

 

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Data:

0000: b8 0b 00 c0               ¸..À  

 

 

 

 

Event Type:     Warning

Event Source: SysmonLog

Event Category:                          None

Event ID:           2028

Date:                                               17-08-2012

Time:                                               11:09:49

User:                                               N/A

Computer:      

Description:

The service was unable to add the counter '\Memory\Free & Zero Page List Bytes' to the PAL_System_Overview log or alert. This log or alert will continue, but data for that counter will not be collected. The error returned is: The specified counter could not be found.

.

 

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Data:

0000: b9 0b 00 c0               ¹..À  

 

Okay, I removed the “bad” counters and from SystemOverview htm-template and imported it again. Perfmon how stores all the expected data in the blg file.

Can anyone explain this, and could I have done something to avoid this? (Except checking the event log when it started it)

With regards, Thomas

Coordinator
Aug 26, 2012 at 5:11 AM

Many of the counters that the system could not find exist on Windows 7 and Windows Server 2008 R2 and later. When a counter doesn't exist, then Performance Monitor just ignores it other than the one time event log entries that you are seeing. I felt it would be much simpler to have a single System Overview file versus one for each operating system.

I have no idea why it would be missing the \Process(*)\* related counters. Those are in the System Overview threshold file. When you export it to a Performance Monitor template, then it should have shown up in the Performance Monitor data collector. If they are not collecting properly, then you might need to open a support case with Microsoft to identify why the counters are not being logged.

Aug 27, 2012 at 9:10 AM

Hi,

I agree that it is simpler with just one file.

I retried the problem and it appears that performance monitor took a little longer to stop the trace and I actually copied the blg file before performance monitor had flushed the complete file.

If I wait a bit longer, the data is actually present.

In short, my mistake, but thanks for the answer.

With regards, Thomas