Perflib counter causes EventID 1008 flood in eventlog

Several months ago we started to implement SCOM in our environment.
When we added SQL Server Management Packs to monitor our SQL infrastructure we started to get the follow errors in the eventlog:

The description for Event ID 1008 from source Microsoft-Windows-Perflib cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event: 
WmiApRpl
C:\Windows\system32\wbem\wmiaprpl.dll
8

The handle is invalid

After searching for weeks and a lot of trial and error we finally found a solution that worked.Go to the following registry key:

HKLM \ SYSTEM \ CurrentControlSet \ Services \ [service name] \ Performance

Add a DWORD value:

"Disable Performance Counters"

Set the DWORD value to 1

Go to the permissions of the Performance key and set it to the following:

CREATOR OWNER -> Read
SYSTEM -> Read

The permissions has to be set like above, otherwise the system will turn the performance counter back on.

After this procedure the errors should disappear.

Leave a Reply

Your email address will not be published. Required fields are marked *


*