Large number of Perflib 1008 errors in application event log in Windows 2000

Article translations Article translations
Article ID: 828872 - View products that this article applies to.
Notice
This article applies to Windows 2000. Support for Windows 2000 ends on July 13, 2010. The Windows 2000 End-of-Support Solution Center is a starting point for planning your migration strategy from Windows 2000. For more information see the Microsoft Support Lifecycle Policy.
Expand all | Collapse all

SYMPTOMS

The Event Viewer application log displays many of the following messages in short intervals:

Event Type: Error
Event Source: Perflib
Event Category: None
Event ID: 1008
Description:
The Open Procedure for service "Nbf" in DLL "C:\WINNT\system32\Perfctrs.dll" failed. Performance data for this service will not be available. Status code returned is DWORD 0.

Data Words: 0000: 00000002

CAUSE

This issue may occur after you disable the NetBEUI (NetBIOS Enhanced User Interface) protocol. In the message that is referenced in the "Symptoms" section, PerfLib is a performance counter library. The Perfctrs DLL monitors some network counters. The counter for the NetBIOS Frames Protocol (NBF) service, the NetBEUI network protocol, causes the error.

When you first create a performance query, Perflib checks the availability of all counters that are listed in the registry. If a counter is not available, the application log displays an event message. This event message occurs when one or more of the following conditions are true:
  • The NetBEUI protocol does not bind to the network adapter, because either the adapter or the driver is defective, and its extensible performance monitor counters are enumerated.
  • NetBEUI is bound to a network adapter that is not connected to the local area network (LAN).
  • NetBEUI is installed, but it is disabled on the network adapter card.

This issue may occur if your computer loads a performance monitoring-based program at startup.

RESOLUTION

To troubleshoot this issue, follow these steps:
  1. Update network adapter drivers.
  2. Make sure that there are no nonpresent, ghosted, or hidden network adapters in your computer.
    For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
    269155 Error message when you try to set an IP address on a network adapter
  3. If the issue persists, follow these steps to remove and then reinstall each network adapter:
    1. Right-click My Computer, click Properties, click the Hardware tab, and then click Device Manager.
    2. Click the network adapter, and then click Remove.
    3. Restart the computer, and then let the system automatically detect and install the drivers for the network adapter.


    Note This step will detect and correct corrupted registry entries on network adapter bindings.
  4. Repeat step 3 for all network adapters.

MORE INFORMATION

Event ID 1008 translates to PERFLIB_OPEN_PROC_FAILURE.

If the Open function for an extension does not return ERROR_SUCCESS, Perflib posts the status code in the data field of the event. In the example that is referenced in the "Symptoms" section of this article, Perflib posts "Data Words: 00000002." The status code helps the author of the extension to determine why the Open function failed.

WORKAROUND

To work around this issue, use one or both of the following methods:
  • Remove the NetBEUI protocol if you do not require it.

    Note The event may be logged even if NetBEUI is disabled on the network adapter card.
  • Prevent Perflib from checking the NBF counters.

    Note The following information applies to 1008 events in general, not only to the NBF service.

    To prevent the performance counter library (Perflib) from checking counters, you can disable the Extensible Performance Counters library or remove it. Use one of the following methods to do this:
    • To use the Extensible Counter tool (ExCtrlLst.exe) to disable the Perfctrs.dll performance counters, follow these steps:
      1. Start the Exctrlst.exe tool. This tool is in the Microsoft Windows 2000 Resource Kit.
      2. Select the DLL (Perfctrs.dll) that did not open in the Extensible Performance Counters list box.
      3. Click to clear the Performance Counters Enabled check box.
      4. Restart the computer.

      This procedure does not resolve this issue, but it may prevent future error messages. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
      248993 PRB: Performance object is not displayed in Performance Monitor
    • To disable the performance counters by modifying a specific registry entry, follow these steps:

      Note You can set this value programmatically through your performance data collection program, or you can use Registry Editor. If you use Registry Editor, information from the counters will not be available unless you change the subkey value to 0 or delete the subkey.
      Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
      322756 How to back up and restore the registry in Windows
      1. Start Registry Editor.
      2. Locate and then click the following service_name\Performance subkey in the registry:
        \HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NBF\Performance
      3. Click Add Value on the Edit menu, and then add the following values:
        Collapse this tableExpand this table
        Value name:Disable Performance Counters
        Data type: REG_DWORD
        Radix: Decimal
        Value data:1
      4. Quit Registry Editor.
      5. Restart the computer.

      Note Counters will not load, and you will not be able to collect NetBEUI and TCPIP performance data.
    • To remove the performance counters by modifying a specific registry entry, follow these steps:

      Note To prevent Event 1008 errors, you can generally export the Performance registry subkey and then remove the Performance registry branch of the service_name service that is mentioned in the Event 1008 error text, where Nbf is the service_name in the event message that is referenced in the "Symptoms" section of this article.
      1. Start Registry Editor.
      2. Locate and then click the following service_name\Performance key in the registry:
        HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Nbf\Performance
      3. Export the performance key, and then delete it from the registry.

        Note If you do not use Performance Monitor or any other performance monitor program to track NetBEUI performance, remove the Performance registry branch for the NBF service (NetBEUI protocol).
      4. Restart the computer.

REFERENCES

For additional information, click the following article numbers to view the articles in the Microsoft Knowledge Base:
226494 INFO: Events for Performance Monitor extensions
811066 EventLogLevel registry setting does not suppress all event messages for extensible counters as expected
186713 Event ID 1010, 1008, 1011, and 4005 with CIM and Perflib
300956 How to manually rebuild performance counter library values
299059 You receive Application Center Event ID: 1008 Perflib error messages on Performance Data Counters
248993 PRB: Performance object is not displayed in Performance Monitor

Properties

Article ID: 828872 - Last Review: February 5, 2007 - Revision: 2.5
APPLIES TO
  • Microsoft Windows 2000 Advanced Server
  • Microsoft Windows 2000 Advanced Server SP1
  • Microsoft Windows 2000 Advanced Server SP2
  • Microsoft Windows 2000 Advanced Server SP3
  • Microsoft Windows 2000 Professional Edition
  • Microsoft Windows 2000 Professional SP1
  • Microsoft Windows 2000 Professional SP2
  • Microsoft Windows 2000 Service Pack 3
  • Microsoft Windows 2000 Server
  • Microsoft Windows 2000 Server SP1
  • Microsoft Windows 2000 Server SP2
  • Microsoft Windows 2000 Service Pack 3
  • Microsoft Windows 2000 Professional SP4
  • Microsoft Windows 2000 Advanced Server SP4
  • Microsoft Windows 2000 Server SP4
Keywords: 
kbprb KB828872

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com