BUG: Perflib Event 1001 Posted Erroneously

• Microsoft Win32 Application Programming Interface (API), included with:
  • Microsoft Windows NT 4.0

SYMPTOMS

When using Performance Monitor or some tool that queries performance data, the system may post an event ID 1001 for the Perflib source in the Application Event Log.

CAUSE

Windows NT checks if the buffer amount used for performance data collection is equal or greater than the buffer supplied. If so it posts the event. However, it should post the event if the buffer amount used only exceeds the buffer amount supplied.

RESOLUTION

There are two approaches to resolve to this problem.

If you do not have any control of the named performance monitoring extension that causes the event log error use this workaround. A custom performance monitoring tool can supply a buffer that is more than necessary for the data collection. For example, if the amount of buffer used when collecting performance data is 1028 bytes, it should supply a buffer a little larger than that. Providing a buffer size of the precisely the necessary size may cause the problem. Note that Performance Monitor that comes with Windows NT would rarely use a buffer of precise size.

If you are the author of the performance monitoring extension use this workaround. Modify the performance monitoring extension when checking for available buffer size in the Collect procedure. The event occurs if a performance monitor extension returns status ERROR_SUCCESS if the supplied buffer amount is equal to the needed buffer space. To workaround the problem, the extension can be written to return ERROR_MORE_DATA if the supplied buffer amount is less than or equal to the needed buffer space.

An example of this workaround would be to have the following code in the Collect procedure of the performance monitoring extension.

    if ( *lpcbTotalBytes <= SpaceNeeded ) {
	    *lpcbTotalBytes = (DWORD) 0;
	    *lpNumObjectTypes = (DWORD) 0;
        return ERROR_MORE_DATA;
    } 

STATUS

Microsoft has confirmed this to be a bug in the Microsoft products listed at the beginning of this article.This bug was corrected in Windows 2000.

MORE INFORMATION

Typically, when the Application Event Log gets an event 1001 from the Perflib source, it indicates a bug with the named performance monitor extension. An example of the details of this event is:

• The buffer size returned by a collect procedure in Extensible Counter DLL "Perfgen.dll" for the "PerfGen" service was larger than the space available. Performance data returned by counter DLL will be not be returned in Perf Data Block. Overflow size is data DWORD 0.



• The data field of the event details dialog box contains a number in hexadecimal that describes the number of bytes that was overflowed.

REFERENCES

Platform SDK;Windows Base Services;Performance Monitoring;Performance Data;Adding Performance Counters

Additional query words:

Keywords : kbKernBase kbNTOS400 kbPerfMon kbDSupport kbGrpKernBase
Version : winnt:4.0
Platform : winnt
Issue type : kbbug