Windows Performance Counter names lost

Despite working with Microsoft Windows for over 20 years I’ve never seen this happen before.

One of our customers reported that one of our Windows services was failing to start on their server. When I investigated I found that the failure was in the service’s initialisation routine where it attempts to reset its performance counters. There wasn’t much error handling around this code as we’ve never experienced any failures in this code and it’s difficult to see how resetting a performance counter could fail.

There wasn’t much diagnostic information available in the service’s log other than an indication that it was the counter reset that failed. However, the previous day the customer had told us that they had increased the disk allocation on this server and rebooted it. That implies that the server had been running short of disk space, so had this caused some corruption ?

I started PerfMon and was surprised to see that all the counter names had disappeared and had been replaced by numeric values. This appeared to confirm the corruption theory.

A quick look in the event log confirmed this:

At this point I thought we might be looking at a re-install of Windows but fortunately I found a post that indicated it was possible to reload the counter names by running the command:

C:\Windows\System32\loadctr.exe /r

 
and the rebooting Windows.

After doing this everything appeared to be back to normal and the service that was previously failing to start was successfully started.

 

Advertisements