This article was previously published under Q240389
This article has been archived. It is offered "as is" and will no longer be updated.
When you attempt to start a log with remote counters in System Monitor, the log may not be started. The lack of success starting the log may generate the following two events in the Event Viewer Application log:
Event ID: 2028 Source: SYSMONLOG The service was unable to add the counter \\Server_Name\Counter_Name to the LogName log or alert. The service will continue, but data for that counter will not be collected.
Event ID: 2029 The service was unable to add any counters to the LogName log or alert. The log or alert will not be started.
When you attempt to start a performance log, the following message may be displayed :
Performance Logs and Alerts The LogName log or alert has not started. Refresh the log or alert list to view current status, or see the application event log for any errors.
By default, the Performance Logs and Alerts service is started under the local computer's "system" account. Normally, the "system" account only has permission to access services and resources on the local computer, not logs on network computers.
To start the Performance Logs and Alerts service under a different account:
Right-click My Computer, and then click Manage.
Open Services and Applications.
Right-click Performance Logs and Alerts, then click Properties.
Click the Log On tab, and then click This account.
Type a user account, and then type a password with sufficient credentials to gain access to the remote computer.
This behavior is by design. As a result of the stronger security implemented in Windows 2000, the remote computer only enables a network connection for user accounts with sufficient permissions. The credentials of the System account do not have sufficient permissions. In order to monitor remote computers with System Monitor, sufficient permissions are required.