none
SharePoint application pool account and event log erros RRS feed

  • Question

  • Hi,

    I get several PerLib and PerfNet errors in my eventlog. When I run procesmon I see a lot of access denied errors for my app pool accoount in the registry on performance keys. Anybody any idea how to get rid of this?

    Friday, March 20, 2015 2:33 PM

All replies

  • Try adding your app pool account to the local Performance Monitor Users group.

    Trevor Seward

    Follow or contact me at...
      

    This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

    Friday, March 20, 2015 4:12 PM
    Moderator
  • The application pool account is already in that group.  The user has no rights (read or write) on any of those keys. When I add the user to a specific performance folder in the registry with read rights some errors are gone. But the account also tries to write to the performance sub key folders in the registry. Te problem is gone when I give full control but I don't want to do this for every registry key.

    Friday, March 20, 2015 6:52 PM
  • These are some of the messages I get in the eventlog

    PerfNet 2004: Unable to open the Server service performance object. The first four bytes (DWORD) of the Data section contains the status code.
    PerfLib 1008: The Open Procedure for service "BITS" in DLL "C:\Windows\System32\bitsperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.
    PerfLib 1008: The Open Procedure for service "WmiApRpl" in DLL "C:\Windows\system32\wbem\wmiaprpl.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.
    PerfLib 1008: The Open Procedure for service "FIMSynchronizationService" in DLL "C:\Program Files\Microsoft Office Servers\15.0\Synchronization Service\Bin\mmsperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

    I tried 

    PerfNet 2004: Unable to open the Server service performance object. The first four bytes (DWORD) of the Data section contains the status code.
    PerfLib 1008: The Open Procedure for service "BITS" in DLL "C:\Windows\System32\bitsperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.
    PerfLib 1008: The Open Procedure for service "WmiApRpl" in DLL "C:\Windows\system32\wbem\wmiaprpl.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.
    PerfLib 1008: The Open Procedure for service "FIMSynchronizationService" in DLL "C:\Program Files\Microsoft Office Servers\15.0\Synchronization Service\Bin\mmsperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

    I tried to rebuild the performance lib following some blog articles, msdn and technet articles.

    No solution yet.

    Friday, March 20, 2015 7:01 PM
  • Hi Danny,

    Did you use SQL Server 2014 with SharePoint 2010?

    If yes, then you can install April 2014 CU for SharePoint and then check if the error still occurs.

    http://blogs.technet.com/b/stefan_gossner/archive/2014/04/09/april-2014-cu-for-sharepoint-2010-has-been-released.aspx

    You can refer to the link below for more details about this issue:

    http://itfreesupport.com/tag/service-stuck-on-starting/

    Best regards.

    Victoria


    TechNet Community Support
    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Monday, March 23, 2015 4:24 AM
    Moderator
  • I am using SharePoint 2013 with SQL server 2012.

    I just realize that this post is in the wrong section. Can't edit category


    Tuesday, March 24, 2015 8:17 AM
  • Hi Danny,

    I recommend to add the application pool account to local administrators group on SharePoint server and then do an IISRESET.

    Best regards.

    Victoria


    TechNet Community Support
    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Wednesday, March 25, 2015 2:11 AM
    Moderator
  • Hi Victoria,

    This is a internet facing site with 4 DMZ servers and 4 application servers in the LAN. I am not able to put application pool accounts in the local admin groups cause of security policies at my customer site. When I add the application pool account to the local admin group we will also get the health analyzer message that an application pool account is in the local admin group. I don't get why an application pool account should have local admin rights on a server. If it is just for writing to registry for performance counter this seems a bit odd to me. 

    Regards

    Danny

    Wednesday, March 25, 2015 8:20 AM
  • Local Admin isn't required, you're correct. However, Users do have Read rights on the Performance keys, unless your customer has altered permissions (e.g. via Local Security Policy or Group Policy).

    Trevor Seward

    Follow or contact me at...
      

    This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

    Wednesday, March 25, 2015 2:26 PM
    Moderator
  • The application pool account has read rights. But in my trace I see that the account is requiring read/write access on a lot of keys. Why does the account wan't to wright to all those keys? This is not necessary in my opinion.

     
    Wednesday, March 25, 2015 2:38 PM
  • Can you please post the entire event log entry for the Perfnet/Perflib entries?

    Trevor Seward

    Follow or contact me at...
      

    This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

    Thursday, March 26, 2015 3:07 PM
    Moderator
  • In my previous post

    PerfNet 2004: Unable to open the Server service performance object. The first four bytes (DWORD) of the Data section contains the status code.

    PerfLib 1008: The Open Procedure for service "BITS" in DLL "C:\Windows\System32\bitsperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

    PerfLib 1008: The Open Procedure for service "WmiApRpl" in DLL "C:\Windows\system32\wbem\wmiaprpl.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

    PerfLib 1008: The Open Procedure for service "FIMSynchronizationService" in DLL "C:\Program Files\Microsoft Office Servers\15.0\Synchronization Service\Bin\mmsperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

    6398
    The Execute method of job definition Microsoft.SharePoint.Administration.SPUpdateWorkerProcessGroup (ID 9b4d28e2-5d0f-4748-a844-e19a07f425a6) threw an exception. More information is included below.
    1387

    6398
    The Execute method of job definition Microsoft.SharePoint.Diagnostics.SPDiagnosticsMetricsProvider (ID a2c0d4b5-5054-4219-931a-8c159f29ddad) threw an exception. More information is included below.
    An update conflict has occurred, and you must re-try this action. The object SPWebService was updated by ZKH\svspfa, in the OWSTIMER (3936) process, on machine 0057.  View the tracing log for more information about the conflict.

    But if you look in trace several other write failures that dont show up in event log. Those I don't mind. I just want to get eventlog clean of errors
    Thursday, March 26, 2015 3:34 PM
  • The full event, please. You're leaving out details such as the DWORD error code, and so forth.

    Trevor Seward

    Follow or contact me at...
      

    This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

    Thursday, March 26, 2015 3:35 PM
    Moderator
  • 2004 Unable to open the Server service performance object. The first four bytes (DWORD) of the Data section contains the status code. 
    
     <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
     <System>
      <Provider Name="Microsoft-Windows-PerfNet" Guid="{CAB2B8A5-49B9-4EEC-B1B0-FAC21DA05A3B}" EventSourceName="PerfNet" /> 
      <EventID Qualifiers="49152">2004</EventID> 
      <Version>0</Version> 
      <Level>2</Level> 
      <Task>0</Task> 
      <Opcode>0</Opcode> 
      <Keywords>0x80000000000000</Keywords> 
      <TimeCreated SystemTime="2015-03-23T22:58:04.000000000Z" /> 
      <EventRecordID>53570</EventRecordID> 
      <Correlation /> 
      <Execution ProcessID="0" ThreadID="0" /> 
      <Channel>Application</Channel> 
      <Computer></Computer> 
      <Security /> 
      </System>
     <EventData>
      <Binary>220000C0</Binary> 
      </EventData>
      </Event>
      
      
    1008 The Open Procedure for service "BITS" in DLL "C:\Windows\System32\bitsperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.  
    
    - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    - <System>
      <Provider Name="Microsoft-Windows-Perflib" Guid="{13B197BD-7CEE-4B4E-8DD0-59314CE374CE}" EventSourceName="Perflib" /> 
      <EventID Qualifiers="49152">1008</EventID> 
      <Version>0</Version> 
      <Level>2</Level> 
      <Task>0</Task> 
      <Opcode>0</Opcode> 
      <Keywords>0x80000000000000</Keywords> 
      <TimeCreated SystemTime="2015-03-23T10:57:08.000000000Z" /> 
      <EventRecordID>53171</EventRecordID> 
      <Correlation /> 
      <Execution ProcessID="0" ThreadID="0" /> 
      <Channel>Application</Channel> 
      <Computer></Computer> 
      <Security /> 
      </System>
    - <UserData>
    - <EventXML xmlns="Perflib">
      <param1>BITS</param1> 
      <param2>C:\Windows\System32\bitsperf.dll</param2> 
      <binaryDataSize>8</binaryDataSize> 
      <binaryData>0500000000000000</binaryData> 
      </EventXML>
      </UserData>
      </Event>
      
    1008 The Open Procedure for service "WmiApRpl" in DLL "C:\WINDOWS\system32\wbem\wmiaprpl.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.
    
    
    - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    - <System>
      <Provider Name="Microsoft-Windows-Perflib" Guid="{13B197BD-7CEE-4B4E-8DD0-59314CE374CE}" EventSourceName="Perflib" /> 
      <EventID Qualifiers="49152">1008</EventID> 
      <Version>0</Version> 
      <Level>2</Level> 
      <Task>0</Task> 
      <Opcode>0</Opcode> 
      <Keywords>0x80000000000000</Keywords> 
      <TimeCreated SystemTime="2015-03-23T10:57:00.000000000Z" /> 
      <EventRecordID>53169</EventRecordID> 
      <Correlation /> 
      <Execution ProcessID="0" ThreadID="0" /> 
      <Channel>Application</Channel> 
      <Computer></Computer> 
      <Security /> 
      </System>
    - <UserData>
    - <EventXML xmlns="Perflib">
      <param1>WmiApRpl</param1> 
      <param2>C:\WINDOWS\system32\wbem\wmiaprpl.dll</param2> 
      <binaryDataSize>8</binaryDataSize> 
      <binaryData>1500000000000000</binaryData> 
      </EventXML>
      </UserData>
      </Event>
    
    1008 The Open Procedure for service "FIMSynchronizationService" in DLL "C:\Program Files\Microsoft Office Servers\15.0\Synchronization Service\Bin\mmsperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.
    
    - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    - <System>
      <Provider Name="Microsoft-Windows-Perflib" Guid="{13B197BD-7CEE-4B4E-8DD0-59314CE374CE}" EventSourceName="Perflib" /> 
      <EventID Qualifiers="49152">1008</EventID> 
      <Version>0</Version> 
      <Level>2</Level> 
      <Task>0</Task> 
      <Opcode>0</Opcode> 
      <Keywords>0x80000000000000</Keywords> 
      <TimeCreated SystemTime="2015-03-23T03:38:24.000000000Z" /> 
      <EventRecordID>52857</EventRecordID> 
      <Correlation /> 
      <Execution ProcessID="0" ThreadID="0" /> 
      <Channel>Application</Channel> 
      <Computer></Computer> 
      <Security /> 
      </System>
    - <UserData>
    - <EventXML xmlns="Perflib">
      <param1>FIMSynchronizationService</param1> 
      <param2>C:\Program Files\Microsoft Office Servers\15.0\Synchronization Service\Bin\mmsperf.dll</param2> 
      <binaryDataSize>8</binaryDataSize> 
      <binaryData>0200000000000000</binaryData> 
      </EventXML>
      </UserData>
      </Event>  


    Thursday, March 26, 2015 3:41 PM
  • Thanks.

    Have you tried rebuilding the perf counters?

    http://blogs.technet.com/b/yongrhee/archive/2009/10/06/how-to-rebuild-performance-counters-on-windows-vista-server2008-7-server2008r2.aspx


    Trevor Seward

    Follow or contact me at...
      

    This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

    Thursday, March 26, 2015 9:58 PM
    Moderator
  • Yes I followed the exact same article
    Friday, March 27, 2015 8:38 AM
  • Hi Danny,

    Please check the solutions in the two articles below to see if the issue can be resolved:

    Event ID 1008 — Performance Library Availability: https://technet.microsoft.com/en-us/library/cc774913%28v=ws.10%29.aspx?f=255&MSPPError=-2147217396

    Event ID 2004 — Network Performance Counter Availability: https://technet.microsoft.com/en-us/library/cc727117(v=ws.10).aspx

    Best regards,

    Victoria


    TechNet Community Support
    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Thursday, April 2, 2015 7:40 AM
    Moderator
  • Hi Victoria,

    I already tried both links but no success.

    Thursday, April 2, 2015 7:43 AM
  • Hi Danny,

    I understand that the two links does not work for our issue. Could you please perform the following steps to rebuild the performance counter?

    I will take USB counter (usbhub) as example. We need to use command lodctr <<var>inifile</var>> to rebuid the USB command counter. So the key point is how to find the correct .ini file.

    ---------------------------------

    1. The .ini file for the USB counter is usbperf.ini, we can get this in the registry key below.e.g. HKLM\System\CurrentControlSet\services\usbhub\performance\perfinifile

    2. I use the “usbperf” to search in the Windows folder, found the following folder which contains this file. Then try to use the lodctr .ini to reload the usbper.ini under the following folders.

    C:\windows\inf\usbhub\0000\usbperf.ini  ===Don’t work.

    C:\Windows\WinSxS\amd64_microsoft-windows-usbperf.resources_31bf3856ad364e35_6.3.9600.16384_en-us_ca78f49af4a1a728 ===Don’t work.

    C:\Windows\WinSxS\amd64_microsoft-windows-usbperf_31bf3856ad364e35_6.3.9600.16384_none_90a0d03b4c066e9d\usbperf.ini  === This worked.

    There are usbperf.dll, usbper.ini and usbperfsym.h under this folder. So, please use the correct *.ini file name to search under the C:\Windows\WinSxs folder. Then change to the correct folder which include three files and run the lodctr *.ini to add the missing counter. Please note that the folder’s name which include “resources” will not works. 

    3. Repeat the step 1-2 to rebuild other missing counters.

    Moreover, I consulted the OS engineers, they suggested that we could safely ignore the events, since these errors will not cause any functionality impact on the server and all of the normal operations would continue to work.

    Thanks,

    Victoria

    TechNet Community Support
    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.


    Tuesday, April 14, 2015 1:09 AM
    Moderator
  • Sorry for the late response. But no luck with the rebuild.

    I will ignore the errors. Thx for the help so far

    Regards

    Danny

    Tuesday, April 21, 2015 6:48 AM
  • Seems like SharePoint itself does NOT like this idea, and will flag this as a potential security risk.

    So I would not recommend it.

    Wednesday, February 1, 2017 2:23 PM
  • I tend to get this error pretty much in all vanilla SharePoint 2013/2016 installs.
    Wednesday, February 1, 2017 2:25 PM