Event Viewer Error: The performance strings in the Performance registry value is corrupted

[FranceBB]

Hey guys,

every time I start my XP I get the following entry in the EventViewer

Event ID: 3012 

Type: Error

Source: LoadPerf

The performance strings in the Performance registry value is corrupted when process Performance extension counter provider. BaseIndex value from Performance registry is the first DWORD in Data section, LastCounter value is the second DWORD in Data section, and LastHelp value is the third DWORD in Data section.

 

Then I get two info messages:

Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data contains the new values of the system Last Counter and Last Help registry entries.
Performance counters for the WmiApRpl (WmiApRpl) service were loaded successfully. The Record Data contains the new index values assigned to this service.
 

And when I reboot, the same thing happens.

By reading on the web they all seem to suggest the LODCTR /R command from the command line, however on XP it seems to be returning a list of commands and in particular I can see:

LODCTR /R:<FileName>
    restore perf registry strings and info using <FileName>

 

So... the question is: what's "filename"?

I tried to

cd %Systemroot%\System32

lodctr perfci.ini

 

and then rebooted, but it didn't work, I've got the same message back.

[jaclaz]

Very likely there is not that option in XP, see:

https://duvoice.com/support/howto/windows/perfmonreset

Do you have another XP machine?

jaclaz

[AstroSkipper]

On 5/20/2024 at 5:06 PM, FranceBB said:

Hey guys,

every time I start my XP I get the following entry in the EventViewer

Event ID: 3012 

Type: Error

Source: LoadPerf

The performance strings in the Performance registry value is corrupted when process Performance extension counter provider. BaseIndex value from Performance registry is the first DWORD in Data section, LastCounter value is the second DWORD in Data section, and LastHelp value is the third DWORD in Data section.

 

Then I get two info messages:

Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data contains the new values of the system Last Counter and Last Help registry entries.
Performance counters for the WmiApRpl (WmiApRpl) service were loaded successfully. The Record Data contains the new index values assigned to this service.
 

And when I reboot, the same thing happens.

By reading on the web they all seem to suggest the LODCTR /R command from the command line, however on XP it seems to be returning a list of commands and in particular I can see:

LODCTR /R:<FileName>
    restore perf registry strings and info using <FileName>

 

So... the question is: what's "filename"?

I tried to

cd %Systemroot%\System32

lodctr perfci.ini

 

and then rebooted, but it didn't work, I've got the same message back.

I found a German forum site where the same issue was reported under Windows XP long time ago: https://administrator.de/forum/win-xp-ereignis-id-3012-loadperf-16362.html 
Use an online translator! Maybe, the solution at the end of this thread works for you, too.

Cheers, AstroSkipper 

[FranceBB]

Thank you both.

I do have another XP machine laying around, but the other fix seemed a bit cleaner.

Following the discussion linked by AstroSkipper, I

1) Headed to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\WmiApRpl\Performance

2) Deleted the First Counter, First Help, Last Counter and Last Help entries

3) Headed to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Perflib

4) Set Last Counter to decimal 1846

5) Set Last Help to decimal 1847

6) Rebooted

 

 

It worked like a charm.  

[AstroSkipper]

51 minutes ago, FranceBB said:

Thank you both.

I do have another XP machine laying around, but the other fix seemed a bit cleaner.

Following the discussion linked by AstroSkipper, I

1) Headed to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\WmiApRpl\Performance

2) Deleted the First Counter, First Help, Last Counter and Last Help entries

3) Headed to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Perflib

4) Set Last Counter to decimal 1846

5) Set Last Help to decimal 1847

6) Rebooted

 

 

It worked like a charm.  

Glad it worked for you! 

[Dixel]

Got the same glitch on Vista, I simply disabled all performance timers and turned off the EventViewer.

[FranceBB]

54 minutes ago, Dixel said:

Got the same glitch on Vista, I simply disabled all performance timers and turned off the EventViewer.

To be fair, even if it's fixed now, I don't really care that much about having performance timers measuring stuff as I don't really look at them anyway, so the follow up question is gonna be: how do I get rid of them?

You know, the less things I have in the background sucking up resources the better.

I tried with CMD:

DISKPERF -N

but it says:

Both Logical and Physical Disk Performance counters on this system
        are automatically enabled on demand.
For legacy applications using IOCTL_DISK_PERFORMANCE to retrieve raw counters,
you can use -Y or -N to forcibly enable or disable. No restart is required.

 

Edited May 23 by FranceBB

[Dixel]

3 hours ago, FranceBB said:

To be fair, even if it's fixed now, I don't really care that much about having performance timers measuring stuff as I don't really look at them anyway, so the follow up question is gonna be: how do I get rid of them?

You know, the less things I have in the background sucking up resources the better.

I tried with CMD:

DISKPERF -N

but it says:

Both Logical and Physical Disk Performance counters on this system
        are automatically enabled on demand.
For legacy applications using IOCTL_DISK_PERFORMANCE to retrieve raw counters,
you can use -Y or -N to forcibly enable or disable. No restart is required.

 

I can forgot about XP, better ask @AstroSkipper, the guy who knows everything!

For Vista - Disable HDD Performance Counters

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfDisk\Performance]

"Disable Performance Counters"=dword:00000001

 

[Dixel]

WMItracing.log OFF (Vista)

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Tracing\WMI]

"SessionEnabled"=dword:00000000

"Level"=dword:00000000

 

[Dixel]

And now, disable Circular Kernel Context Logger and Audio logger.

Windows Registry Editor Version 5.00

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger]

"Status"=dword:00000000

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\Audio]

"Start"=dword:00000000

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\Circular Kernel Context Logger]

"Start"=dword:00000000

 

[jaclaz]

Exctrlst:

https://techcommunity.microsoft.com/t5/ask-the-performance-team/two-minute-drill-disabled-performance-counters-and-exctrlst-exe/ba-p/374538

https://www.softpedia.com/get/System/System-Info/Extensible-Counter-List.shtml

jaclaz

[dmiranda]

"But ... then, why?"

Wow. Funny how you learn new stuff all the time. 10 years ago I would have disabled them all and see what happened. But not without before researching here or elsewhere: what are the likely consequences of doing so? I never look at performance counters, and never have had an error saying "you're way down in performance in X", probably due to my stripping XP of useless tricks, functions and spyware/attack surface. So, I wonder and seek illustration on what do I lose by disabling those counters, anyway. I imagine I'll loose the performance tab info in the app "system explorer"? some functionality in "process lasso" and other process monitor tools? Any ideas? Thanks. 

Edited May 23 by dmiranda

[Dixel]

3 hours ago, dmiranda said:

So, I wonder and seek illustration on what do I lose by disabling those counters, anyway.

I disabled them all about 17 years ago on Vista, and even earlier on XP, lost nothing.

[dmiranda]

17 hours ago, jaclaz said:

Exctrlst

Neat program. I disabled all but perfos and perfproc (required by process lasso, etc, which anyway turns them on by itself, btw), and waiting to see if something fails before reenabing perfdisk and perfnet. Thanks!

Edited May 24 by dmiranda

[FranceBB]

Excellent program, I disabled the performance counters on everything. Thank you guys!