Article ID: 240389 - View products that this article applies to.
This article was previously published under Q240389
When you attempt to start a log with remote counters in System Monitor, the log may not be started. The lack of success starting the log may generate the following two events in the Event Viewer Application log:
Event ID: 2028 Source: SYSMONLOG The service was unable to add the counter \\Server_Name\Counter_Name
to the LogName log or alert. The service will continue, but data for that counter will not be collected.
Event ID: 2029 The service was unable to add any counters to the LogName log or alert. The log or alert will not be started.
-or-When you attempt to start a performance log, the following message may be displayed :
Performance Logs and Alerts
The LogName log or alert has not started. Refresh the log or alert list to view current status, or see the application event log for any errors.
By default, the Performance Logs and Alerts service is started under the local computer's "system" account. Normally, the "system" account only has permission to access services and resources on the local computer, not logs on network computers.
To start the Performance Logs and Alerts service under a different account:
This behavior is by design. As a result of the stronger security implemented in Windows 2000, the remote computer only enables a network connection for user accounts with sufficient permissions. The credentials of the System account do not have sufficient permissions. In order to monitor remote computers with System Monitor, sufficient permissions are required.