System performance counters are corrupted !

Question

System performance counters are corrupted !

Samuel Parker 20

Hi guys

We recently noticed that our systems management agents stopped reporting accurate CPU and Memory metrics. After checking the servers, we found that the system performance counter registry structures appear to be corrupted. Because of this, several monitoring tools are unable to collect the expected performance data.

We have restarted the affected services, but the problem continues to occur. It looks like the performance counters may need to be completely rebuilt.

Could someone advise us on the proper way to use lodctr /r to rebuild all system performance counters? Are there any additional steps we should take afterward to make sure the counters are registered and working correctly ?

0 comments

2 answers

Your answer

Answer 1

Hi Samuel Parker,

Please open an administrative Command Prompt and navigate to the Windows System32 directory. From there, execute the lodctr /R command. You must use an uppercase R, as this specific switch instructs the operating system to rebuild the counters from scratch using system initialization files rather than looking for a manual backup file. After this completes, you need to navigate to the Windows SysWOW64 directory and run the exact same command. Running it from this second location is critical on 64-bit servers to ensure that the 32-bit performance counters are also successfully repaired for any older agents.

Once the registry structures are rebuilt, you must align these changes with the Windows Management Instrumentation service. WMI caches performance counter data, so you need to execute the winmgmt /resyncperf command to force WMI to recognize the fresh counters. Finally, restart the Windows Management Instrumentation service along with your monitoring agents, and your CPU and memory metrics will report correctly.

Hope this answer has brought you some useful information. If it did, please hit “accept answer”. Should you have any questions, feel free to leave a comment.

VPHAN

Answer 2

Use an elevated Command Prompt and rebuild the counters from both system directories:

Rebuild the counters:

cd c:\windows\system32
lodctr /R
cd c:\windows\sysWOW64
lodctr /R

/R must be uppercase, and administrative rights are required.

Resync the counters with WMI:

WINMGMT.EXE /RESYNCPERF

Restart the Performance Logs and Alerts service:

Get-Service -Name "pla" | Restart-Service -Verbose

Restart the Windows Management Instrumentation service:

Get-Service -Name "winmgmt" | Restart-Service -Force -Verbose

Create a new Data Collector Set and test with that instead of reusing an existing one.

Additional checks:

Verify the counters are not disabled in the registry under: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\%servicename%\Performance
If DisablePerformanceCounters exists, it should be set to 0.
- 1 = counter disabled
- 2 = 32-bit counter disabled
- 4 = 64-bit counter disabled

If lodctr /R does not recover all counters, check c:\windows\system32\PerfStringBackup.INI. If that file is missing information or is drastically smaller than expected, a backup copy from an identical machine can be used. Back up the existing file before replacing it.

If specific counters such as IIS counters are still missing, reinstall them from their counter .ini files. Many of these files are under c:\Windows\winsxs. For IIS-related counters, multiple matching folders may exist, so the correct .ini may need to be identified by trial and error. A successful load is logged as Event ID 1000 from Microsoft-Windows-LoadPerf.

If a full manual rebuild of the base performance counter library values is required, that involves registry changes and replacing Perfc009.dat and Perfh009.dat. This is higher risk because incorrect registry changes can cause serious problems, and removing Performance subkey values may cause installed .NET Framework applications to fail until counters are rebuilt again.