Performance Monitor Counters Cause Stop or Error MessagesLast reviewed: March 5, 1998Article ID: Q173060 |
The information in this article applies to:
IMPORTANT: This article contains information about editing the registry. Before you edit the registry, you should first make a backup copy of the registry files (System.dat and User.dat). Both are hidden files in the Windows folder.
SYMPTOMSWhen you use Performance Monitor to monitor a computer (either locally or from a remote computer), the following blue screen STOP message may be produced on the computer being monitored:
STOP:0xC000021A (0xe1638608, 0xc0000005, 0x00000000, 0x00000000).-or- You get the following message every time you click the + (plus) button while monitoring locally in Performance Monitor:
WinLogon.exe App. Error - The instruction at x77f648e2 referenced memory at x001cce35. The memory could not be read. Click OK to terminate the app.NOTE: Actual memory locations will vary.
CAUSEWhen you use Performance Monitor to monitor a computer remotely, the initiating computer attaches to the target computer's Winlogon process through RPC. The Winlogon process has a perflib component in it for collecting data. The shared data is passed from the performance counters' .DLL to Winlogon on the target computer. The performance counters' DLLs sometimes overwrite their buffers. In the case of remote monitoring, this overwrite occurs in the context of the Winlogon process on the target computer, which causes it to have an access violation, compromises the Winlogon subsystem (which may create a breach of security), and forces Windows NT into kernel mode to start checking for bugs. The performance counter DLLs make three functions available to other modules: Open, Collect, and Close. It is usually the Collect function that causes the problem.
RESOLUTIONHave the malfunctioning extensible Performance Counter fixed so that it does not overwrite its buffers. -or– Disable the malfunctioning performance counter's .dll by renaming or removing its entry from the Windows NT registry. To locate all extensible performance counters, use Exctrlst.exe, which is part of the Windows NT 4.0 Resource Kit. You can run Exctrlst.exe locally or remotely to bring up a list of all of the extensible counters found in the computer's registry. The counters’ registry entries are located at the following key:
Hkey_Local_Machine\System\CurrentControlSet\Services\ Service_Name\Performance\Library.NOTE: The above registry key is one path; it has been wrapped for readability. To disable an extensible counter .dll: WARNING: Using Registry Editor incorrectly can cause serious problems that may require you to reinstall Windows 95. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. For information about how to edit the registry, view the Changing Keys and Values online Help topic in Registry Editor (Regedit.exe). Note that you should make a backup copy of the registry files (System.dat and User.dat) before you edit the registry.
For more information on performance counters, see the following article in the Microsoft Knowledge Base:
ARTICLE-ID: Q152513 TITLE : Troubleshooting Performance Monitor Counter Problems.- or – If you prefer, you can also solve this problem by configuring Windows NT to write a guard page on either side of the shared memory buffer with various levels of checking. This setting was enabled by default in early Windows NT service packs. The guard pages caused too many page faults for large counters, however, which degraded system performance significantly. In Service Pack 3, the guard pages and checking were turned off by default. To enable the guard page setting, use the following steps: WARNING: Using Registry Editor incorrectly can cause serious problems that may require you to reinstall Windows 95. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. For information about how to edit the registry, view the Changing Keys and Values online Help topic in Registry Editor (Regedit.exe). Note that you should make a backup copy of the registry files (System.dat and User.dat) before you edit the registry.
|
Additional query words: 0xc21A perfmon
© 1998 Microsoft Corporation. All rights reserved. Terms of Use. |