en[EVENT1020] Perflib error repair procedure

Atom | RSS

このサイトを検索 | Search this site

,Japan

to japanese

This article is about the Perflib error that is recorded in the event log when updating to Windows 10 May 2019 Update, version 1903 [Event ID 1020].

Since it is [Level: Error], it is a log that I would like to recover personally.

The following keywords are recorded in the event log.

• Perflib: performance counter libraries
• LSM: Local Session Manager
• perfts.dll

This log reports that something is wrong with perflib (performance counter library).

The LSM registered with the Windows service was working properly.

LSM

Local Session Manager

A core Windows service that manages local user sessions. Stopping or disabling this service will cause system instability.

[LSM Properties]

• Executable path: C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p
• Startup type: Automatic
• Service status: Running

Well, the main subject.

In conclusion, there was a problem with perfts.dll.

When I run the repaired steps in the past, 1020 events are no longer logged.

[procedure]

1. Rebuild performance counters
2. Rebuild perfts.dll

Event Log

The event log is reprinted.

Event Log:

message	The required buffer size exceeds the buffer size passed to the Collect function of the "LS:" service "C:\Windows\System32\perfts.dll" Extensible Counter DLL. The buffer size specified was 27696 and the required size was 35616.
log name	Application
Source	Perflib
Event ID	1020
level	error
user	SYSTEM

Repair procedure

There are two steps.

1. Rebuild performance counters
2. Rebuild perfts.dll

Specifically:

Step A

If you see Perflib errors or warnings in the event log, rebuilding the performance counters may help.

Run the following command from a command prompt (or Windows PowerShell) started in administrator mode.

> lodctr /R

>_	Administrator: Windows PowerShell	ー □ ×
PS C:\WINDOWS\system32 >lodctr /R Info: Successfully rebuilt performance counter settings from system backup store

Step B

PerfIniFile is required to rebuild perfts.dll.

I found lagcounterdef.ini in\LSM\Performance when I searched perfts.dll in Registry Editor.

PerfIniFile = lagcounterdef.ini

Set lagcounterdef.ini in the argument of the LODCTR command and rebuild (initialize) perfts.dll.

> LODCTR ...\lagcounterdef.ini

>_	Administrator: Windows PowerShell	ー □ ×
PS C:\WINDOWS\system32 >lodctr C:\Windows\INF\LSM\0411\lagcounterdef.ini

If no error message is displayed, the rebuild of perfts.dll is successful.

For example, if you see the following message, check the location of the INI file.

Initialization file ...\lagcounterdef.ini not found

Summary

Logs recorded as [Source: Perflib] are events related to performance counters.

If the log level is warning, it is possible to leave it alone and observe it, but I would like to fix the error.

I will review how to find the lagcounterdef.ini used this time.

[procedure]

1. Start Registry Editor
2. Search by DLL file name (eg perfts.dll)
3. Check the value of PerfIniFile (Example: lagcounterdef.ini)

When the DLL and INI file names are different, you can search according to the following rules.

C:\Windows\INF\\0411\xxx.ini

Here is a working example of Registry Editor.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LSM\Performance

 External link

• What to do when Event ID: 3009, 2007 is output when lodctr /R command is executed | support.microsoft.com
• To manually rebuild Performance Counter Library values | support.microsoft.com

Validation: Windows 10 Pro May 2019 Update, v1903.18362.239

：SC2

このサイトを検索 | Search this site