Joined
·
538 Posts
PERFLIB PERFDATA
Disable Performance Counters
Disable Performance Counters flag is used in Windows 2000, XP and Server 2003 to block calls to the Performance Library DLL via the standard Registry, Performance Data Helper, and WMI interfaces to gathering performance data. The NTSMF Collection service honors the Disable Performance Counters flag in versions prior to 2.4.5. The Disable Performance Counters flag stops NTSMF from attempting to call the disabled Performance Library DLL in versions prior to 2.4.5. If the the Disable Performance Counters flag is set in the Registry Performance key for the Performance Library DLL responsible for serving up the Object/Counter you are missing, NTSMF versions prior to 2.4.5 will honor this flag and not attempt to collect any data from the disabled Performance Library DLL.
NTSMF version 2.4.5 and higher does not honor the Disable Performance Counters flag. Instead of Disable Performance Counters, NTSMF version 2.4.6 and higher utilize a comparable facility that allows you to specifically exclude Performance Library DLLs that cause collection problems. When specific Performance Library DLLs fail to return properly when Opened or create other anomalies because they cannot be shared properly when the NTSMF collection agent does open them, you can exclude them from all NTSMF-related processing. Instructions to exclude specific Performance Library DLLs are contained in a configuration file named DmPerfss.cfg that is stored in the NTSMF root directory. The format of the DmPerfss.cfg file, which uses a simple XML syntax, is documented in this Technical Note.
Performance Library DLLs are the software modules installed on the machine responsible for gathering specific performance data. These modules are not installed by NTSMF -- some are installed as part of the operating system and some are installed by various applications. There is one specific Performance Library DLL responsible for gathering data for each performance Object and its Counters. (Many Performance Library DLLs gather data for more than one Object.) NTSMF calls the Performance Library DLLs each collection interval to gather the performance data you specified in the DCS Data Definition.
During its Discovery phase at the beginning of each collection cycle, the NTSMF collection agent inventories the Performance Library DLLs installed on the local machine and tries to match them up against the DCS Data Definition that specifies which performance Objects and Counters you want to gather. In this fashion, the collection agent figures out which Performance Library (Perflib) DLLs to call to gather the performance Objects and Counters you specified in the Data Collection set Data Definition.
Performance Library DLLs are identified by entries in the Registry under HKLM\SYSTEM\CurrentControlSet\Services\<servicename>\Performance. If you look through the HKLM\SYSTEM\CurrentControlSet\Services\subkeys using the Registry Editor, you will normally find many Perflib DLLs defined. A typical example is reproduced below for the perfdisk.dll Perflib, which is responsible for gathering disk performance statistics from the diskperf filter driver:
The fields in the HKLM\SYSTEM\CurrentControlSet\Services\<servicename>\Performance key identify the Library module name and the entry points that the Performance SeNTry collection services calls for the Open, Collect, and Close functions.
Like any complex piece of software, Performance Library DLLs can malfunction.
The OpenTimeout value in the
HKLM\SYSTEM\CurrentControlSet\Services\<servicename>\Performance key, for example, determines how long an application like System Monitor will wait during its Discovery phase for a call to a Perflib DLL's Open routine to return. If a call to a Perflib DLL's Open routine does not return within the prescribed amount of time, the operating system software responsible for communicating with Perflibs DLLs aborts the call to the Open routine and sets the Disable Performance Counters flag to disable the Perflib DLL.
According to the official Microsoft documentation in the Windows 2000 Resource Kit,
"The Performance Library (Perflib) uses [the Disable Performance Counters flag] to disable counters that cause serious errors. This prevents the troublesome counters from jeopardizing the display of all performance counters on the system. You can use this entry to reenable the counters for a service after the counter DLL has been repaired or replaced." A Resource Kit Performance tool called Extensible Counter List (exctrlst.exe) can be used to check for all Perflib DLLs that are disabled. This tool is illustrated below: Extensible Counter List.
Using the Extensible Counter List tool from the Resource Kit, you can manually disable a malfunctioning Perlib DLL or re-enable a Perflib DLL after you have found and fixed the problem that caused it to become disabled in the first place.
With regard to calling Perflib DLLs to gather Windows performance Counter data, the Performance SeNTry collection agent functions just like other performance monitoring applications, including the built-in System Monitor application that Microsoft supplies. However, there is one critical difference in the way the Performance SeNTry collection service works. The Performance SeNTry collection agent bypasses the operating system software responsible for communicating with Perflibs DLLs that is used by other performance monitoring applications. Instead, NTSMF calls each Perflib DLL directly. Because the threaded collector bypasses the Microsoft-supplied plumbing that other applications like SysMon use to gather data from Performance Library DLLs, the Performance SeNTry collection service is never responsible for a Perflib DLL becoming disabled (with the Disable Performance Counters flag set). If you find that this flag is set and you are running version 2.4.3 or higher of the Collection service, it is because some other performance monitoring application on your system tried to access that Perflib and failed.
Threaded collector. Beginning in version 2.4.3, each call to a Perflib DLL is performed under a dedicated collection thread. We call this version of the collection agent the threaded collector because the main dispatcher thread of the Collection service generates a separate collection thread for each Perflib DLL that it finds installed on the local machine. In the threaded collector, it is possible to detect and recover from most failures involving calls to Perflib DLLs. This allows the NTSMF collection service to continue to function even when there are bugs in third party Perflib DLL modules. In earlier versions of NTSMF that utilized the Microsoft-supplied plumbing to gather data from Performance Library DLLs, it was not always possible to determine which Perflib DLL had failed or to recover from some Perflib DLLs failures.
Because we found the Disable Performance Counters flag mechanism was a nightmare to administer, beginning in version 2.4.2, the NTSMF Collection agent generates a Warning message whenever it encounters a disabled Perflib DLL during the initial Discovery phase of a collection cycle. A typical Warning message that is written to the Application Event log is illustrated below:
Please note that the collection service generates this Warning message each and every collection cycle until the the Disable Performance Counters flag is reset manually using the Extended Counter List utility discussed above. We have found that Perflib DLLs are sometimes disabled for relatively trivial reasons and there is little harm in re-enabling them and trying again with NTSMF. However, if the problem with the Perflib DLL persists, it is something that should be investigated with the supplier of the malfunctioning module.
Who knows where to find the descripted tool? I disabled the startup entry of the performance logs and alerts in the Start MSCONFIG and Services to stop the buildup of Perflib-Perfdata files in the Temp folders which contain nothing. And keep growing into wild proportions.
Bernardus.
Disable Performance Counters
Disable Performance Counters flag is used in Windows 2000, XP and Server 2003 to block calls to the Performance Library DLL via the standard Registry, Performance Data Helper, and WMI interfaces to gathering performance data. The NTSMF Collection service honors the Disable Performance Counters flag in versions prior to 2.4.5. The Disable Performance Counters flag stops NTSMF from attempting to call the disabled Performance Library DLL in versions prior to 2.4.5. If the the Disable Performance Counters flag is set in the Registry Performance key for the Performance Library DLL responsible for serving up the Object/Counter you are missing, NTSMF versions prior to 2.4.5 will honor this flag and not attempt to collect any data from the disabled Performance Library DLL.
NTSMF version 2.4.5 and higher does not honor the Disable Performance Counters flag. Instead of Disable Performance Counters, NTSMF version 2.4.6 and higher utilize a comparable facility that allows you to specifically exclude Performance Library DLLs that cause collection problems. When specific Performance Library DLLs fail to return properly when Opened or create other anomalies because they cannot be shared properly when the NTSMF collection agent does open them, you can exclude them from all NTSMF-related processing. Instructions to exclude specific Performance Library DLLs are contained in a configuration file named DmPerfss.cfg that is stored in the NTSMF root directory. The format of the DmPerfss.cfg file, which uses a simple XML syntax, is documented in this Technical Note.
Performance Library DLLs are the software modules installed on the machine responsible for gathering specific performance data. These modules are not installed by NTSMF -- some are installed as part of the operating system and some are installed by various applications. There is one specific Performance Library DLL responsible for gathering data for each performance Object and its Counters. (Many Performance Library DLLs gather data for more than one Object.) NTSMF calls the Performance Library DLLs each collection interval to gather the performance data you specified in the DCS Data Definition.
During its Discovery phase at the beginning of each collection cycle, the NTSMF collection agent inventories the Performance Library DLLs installed on the local machine and tries to match them up against the DCS Data Definition that specifies which performance Objects and Counters you want to gather. In this fashion, the collection agent figures out which Performance Library (Perflib) DLLs to call to gather the performance Objects and Counters you specified in the Data Collection set Data Definition.
Performance Library DLLs are identified by entries in the Registry under HKLM\SYSTEM\CurrentControlSet\Services\<servicename>\Performance. If you look through the HKLM\SYSTEM\CurrentControlSet\Services\subkeys using the Registry Editor, you will normally find many Perflib DLLs defined. A typical example is reproduced below for the perfdisk.dll Perflib, which is responsible for gathering disk performance statistics from the diskperf filter driver:
The fields in the HKLM\SYSTEM\CurrentControlSet\Services\<servicename>\Performance key identify the Library module name and the entry points that the Performance SeNTry collection services calls for the Open, Collect, and Close functions.
Like any complex piece of software, Performance Library DLLs can malfunction.
The OpenTimeout value in the
HKLM\SYSTEM\CurrentControlSet\Services\<servicename>\Performance key, for example, determines how long an application like System Monitor will wait during its Discovery phase for a call to a Perflib DLL's Open routine to return. If a call to a Perflib DLL's Open routine does not return within the prescribed amount of time, the operating system software responsible for communicating with Perflibs DLLs aborts the call to the Open routine and sets the Disable Performance Counters flag to disable the Perflib DLL.
According to the official Microsoft documentation in the Windows 2000 Resource Kit,
"The Performance Library (Perflib) uses [the Disable Performance Counters flag] to disable counters that cause serious errors. This prevents the troublesome counters from jeopardizing the display of all performance counters on the system. You can use this entry to reenable the counters for a service after the counter DLL has been repaired or replaced." A Resource Kit Performance tool called Extensible Counter List (exctrlst.exe) can be used to check for all Perflib DLLs that are disabled. This tool is illustrated below: Extensible Counter List.
Using the Extensible Counter List tool from the Resource Kit, you can manually disable a malfunctioning Perlib DLL or re-enable a Perflib DLL after you have found and fixed the problem that caused it to become disabled in the first place.
With regard to calling Perflib DLLs to gather Windows performance Counter data, the Performance SeNTry collection agent functions just like other performance monitoring applications, including the built-in System Monitor application that Microsoft supplies. However, there is one critical difference in the way the Performance SeNTry collection service works. The Performance SeNTry collection agent bypasses the operating system software responsible for communicating with Perflibs DLLs that is used by other performance monitoring applications. Instead, NTSMF calls each Perflib DLL directly. Because the threaded collector bypasses the Microsoft-supplied plumbing that other applications like SysMon use to gather data from Performance Library DLLs, the Performance SeNTry collection service is never responsible for a Perflib DLL becoming disabled (with the Disable Performance Counters flag set). If you find that this flag is set and you are running version 2.4.3 or higher of the Collection service, it is because some other performance monitoring application on your system tried to access that Perflib and failed.
Threaded collector. Beginning in version 2.4.3, each call to a Perflib DLL is performed under a dedicated collection thread. We call this version of the collection agent the threaded collector because the main dispatcher thread of the Collection service generates a separate collection thread for each Perflib DLL that it finds installed on the local machine. In the threaded collector, it is possible to detect and recover from most failures involving calls to Perflib DLLs. This allows the NTSMF collection service to continue to function even when there are bugs in third party Perflib DLL modules. In earlier versions of NTSMF that utilized the Microsoft-supplied plumbing to gather data from Performance Library DLLs, it was not always possible to determine which Perflib DLL had failed or to recover from some Perflib DLLs failures.
Because we found the Disable Performance Counters flag mechanism was a nightmare to administer, beginning in version 2.4.2, the NTSMF Collection agent generates a Warning message whenever it encounters a disabled Perflib DLL during the initial Discovery phase of a collection cycle. A typical Warning message that is written to the Application Event log is illustrated below:
Please note that the collection service generates this Warning message each and every collection cycle until the the Disable Performance Counters flag is reset manually using the Extended Counter List utility discussed above. We have found that Perflib DLLs are sometimes disabled for relatively trivial reasons and there is little harm in re-enabling them and trying again with NTSMF. However, if the problem with the Perflib DLL persists, it is something that should be investigated with the supplier of the malfunctioning module.
Who knows where to find the descripted tool? I disabled the startup entry of the performance logs and alerts in the Start MSCONFIG and Services to stop the buildup of Perflib-Perfdata files in the Temp folders which contain nothing. And keep growing into wild proportions.
Bernardus.
