Of Performance Counters, the Registry, and Windows Management Instrumentation Woes

[Gizmo]

God forbid that any of you should have a problem with WMI or the Performance Counter Registry (HKEY_PERFORMANCE_DATA, don't bother looking in Regedit, it ain't there). Getting this fixed can be a major undertaking. Symptoms of this being hosed are WMI classes that should exist (such as Win32_PerfRawData_PerfOS_Processor) or peformance counter objects that don't show up in Perfmon (such as Physical Disk).

Here's the procedure:

Symptom: A significant portion of the Win32_PerfRawData and Win32_PerfFormatedData WMI derived classes were returning 80041001, 80041002, or 80041010 when I tried to access them. In some cases, the classes were missing entirely. In other cases, they were there but not working right.

Here's what I had to do.

First, my performance registry was hosed (the performance registry is the interface that WMI uses to get a good deal of its information, in fact, it might get ALL of its info from there, I'm not sure). To fix the performance registry, I had to basically pull it out by its roots and reinstall it.

*********WARNING*********
//the following contains information on editing system files and the //registry. If you don't know what you are doing, you can turn your //system into a doorstop in a heartbeat! When you do, don't come crying //and sniveling to me; I will have no sympathy.
*******END WARNING*******

0. Backup up your copies of the perfc009.dat and perfh009.dat located in your %Systemroot%\System32 folder. For non-english systems, the '009' might be something else, as these files are localized for each system.

0a. If you have ANY reason to suspect that some of your service pack, patch, update, or hot fix files might have been replaced, reapply the relevant service packs, patches, updates, and hotfixes. In fact, you probably should do that anyway, just to be safe.

0b. Find all ini files used to load performance counters. The easy way to do this is to use the following command from a command prompt at the root of your system drive, and also the root of your 'Program Folders' drive, if you run a split configuration like me:
findstr /i /s /c:"drivername" *.ini

Unfortunately, findstr doesn't handle files that start with the unicode Byte Order Mark (FF FE or FF FF). Neither did any of several different grep utilities for windows that I tried. I finally ended up using a great little text editor called TextPad32. It has a 'Find in Files' feature that knows how to handle the Unicode BOM.

Make a note of all the files you find. You'll need this information later.

1. Get your original install CD, go the i386 folder, and extract the files perfc009.da_ and perfh009.da_. For help on using extract, just type:
extract
at the command line. Extract these files and replace the ones in %Systemroot%\System32.

2. Start your favorite registry editor. Look for the following registry key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Perflib

3. In the registry, change the LastCounter value to 1846 (decimal, 0x0736 Hex). Change the LastHelp value to 1847 (decimal, 0x0737 Hex).

4. Look for the following registry key:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servic es. This is the services registry hive. Look through each service key in turn, looking for any service keys that have a subkey named 'Performance'.

5. For each service key that has a performance subkey, delete the following value names:
FirstCounter
FirstHelp
LastCounter
LastHelp

This will get you back to a base performance registry set. You now have only basic performance counters. Any extended counters will need to be manually added.

6. For each INI file identified in step 0b do the following:
From a command prompt, CD to the directory containing the relevant INI file. Type the following command:
lodctr inifile
where inifile is the name of the ini file that you wish to load.

Note: Some of these may respond with an error 2 that they couldn't be loaded because the relevant registry key can't be opened. Generally, this is because the service doesn't exist. If you encounter this, check the relevant services registry key for the INI file you are loading (you can determine the service registry key by opening the INI file and looking at the [info] section for the entry called 'drivername' and seeing what it is set to). If the service is in fact not installed, then there most likely isn't a problem. However, I did find that in particular, MSSQL has a default INI file called sqlctr.ini. This tries to install counters for the default MSSQLServer service, which won't exist. However, there WILL BE INI files for each MSSQL instance that is running. Also, there will be a bunch of INI files that are in your Service Packs directory, and possibly also in the folders for each of the installed Windows patches. So long as your running installation is current with all of the service packs, updates, patches, and hot-fixes that it is supposed to have, these can be safely ignored.

Rinse and repeat for every perf counter file that you need to have enabled.

7. Reboot.

8. If you come back up and your performance registry still is showing all the objects it should, some of them may have gotten disabled because the performance registry was hosed previously. There are two ways to fix this:
8a. You can manually search through the performance subkeys of all the service keys in the services registry (HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servi ces). Look for a value name called Disable Performance Counters. If it is set to any value other than 0, the Performance Counters for that service have been disabled and will have to be re-enabled by setting the entry back to 0 and rebooting the system.
8b. Install the Support Tools for your platform (they should be on your install media; you can also download them from Microsoft). Run the Exctrlist.exe tool, and use it to re-enable any disabled performance counters.

9. Reboot again. At this point, your performance counter registry should be restored to normal operation, but WMI will probably still be hosed.

Note: The above information is based on information found at
http://support.theplanet.com/knowled...b.php?id=10089

Now, to fix your WMI:
10. From Start|Run or a command line, type:
net stop winmgmt

11. Go to %Systemroot%\System32\wbem. Delete the Repository directory and all of its contents.

12. From Start|Run or a command line, type:
net start winmgmt

13. From a command line, cd %SystemRoot%\system32\wbem
Type the following commands:
for %i in (*.dll) do regsvr32 -s %i
for %i in (*.exe) do %i /RegServer

(Note that none of the above will restore files that are actually MISSING from your WMI installation.

The information above is based on information found at:
http://windowsxp.mvps.org/repairwmi.htm

Finally, if that doesn't get your WMI back in working order, do the following:

14. winmgmt /clearadap

15. winmgmt /resyncperf

16. Reboot

At that point, you should hopefully have a fully repaired Performance Counters Registry, and a fully repaired and functional WMI. That's what it took for me. I really hope this helps someone else. And God help you if you actually need this information.

[chrisbard]

I once had to start manually for some odd reason the WMI service was stopped if I remember this right. However I noticed at that time that Microsoft was aware of this and I ended up here:

http://www.microsoft.com/technet/scr...p/wmidiag.mspx

Anyway many thanks for sharing !!!

[Gizmo]

Yeah, WMIDiag is a handy utility. It was what initially got me investigating some of the things I was seeing. A couple of sample programs I was playing with helped out a bunch also.