Microsoft-Windows-Perflib
59 events across 2 channels
Event ID 0 —
#Fields #
| Name | Description |
|---|---|
Name | — |
Status | — NTSTATUS reference |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Perflib",
"guid": "13B197BD-7CEE-4B4E-8DD0-59314CE374CE",
"event_source_name": "",
"event_id": 0,
"version": 0,
"level": 5,
"task": 0,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2023-11-05T22:40:53.996726+00:00",
"event_record_id": 177,
"correlation": {},
"execution": {
"process_id": 4360,
"thread_id": 4224
},
"channel": "Microsoft-Windows-Perflib/Operational",
"computer": "WinDev2310Eval",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"Name": "LoadPerfCounterTextStrings-End",
"Status": 0
},
"message": ""
}
References #
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 1000 — Access to performance data was denied to user "User" (value from GetUserName() for the running thread) as attempted from module "Module".
Event ID 1001 — The Collect procedure in Extensible Counter DLL "Library" for the "Service" service returned buffer size Size, which is larger than the space available.
Event ID 1002 — A Guard Page was modified by a Collect procedure in Extensible Counter DLL "Library" for the "Service" service.
Event ID 1003 — The Extensible Counter DLL "Library" for the "Service" service returned an incorrect object length.
Description
The Extensible Counter DLL "Library" for the "Service" service returned an incorrect object length. The sum of the ObjectCount object lengths returned did not match the size of the buffer returned.
Message #
Fields #
| Name | Description |
|---|---|
Library UnicodeString | — |
Service UnicodeString | — |
ObjectCount UInt32 | — |
Event ID 1004 — The Extensible Counter DLL "Library" for the "Service" service returned an incorrect instance length for the object with title index ObjectIndex.
Event ID 1005 — The attempt to locate the Open procedure "ProcName" in DLL "Library" for the "Service" service failed with Win32 error code Win32Error.
Description
The attempt to locate the Open procedure "ProcName" in DLL "Library" for the "Service" service failed with Win32 error code Win32Error. Performance data for this service will not be available.
Message #
Fields #
| Name | Description |
|---|---|
ProcName AnsiString | — |
Library UnicodeString | — |
Service UnicodeString | — |
Win32Error UInt32 | — |
Event ID 1006 — The attempt to locate the Collect procedure "ProcName" in DLL "Library" for the "Service" service failed with Win32 error code Win32Error.
Description
The attempt to locate the Collect procedure "ProcName" in DLL "Library" for the "Service" service failed with Win32 error code Win32Error. Performance data for this service will not be available.
Message #
Fields #
| Name | Description |
|---|---|
ProcName AnsiString | — |
Library UnicodeString | — |
Service UnicodeString | — |
Win32Error UInt32 | — |
Event ID 1007 — The attempt to locate the Close procedure "ProcName" in DLL "Library" for the "Service" service failed with Win32 error code Win32Error.
Description
The attempt to locate the Close procedure "ProcName" in DLL "Library" for the "Service" service failed with Win32 error code Win32Error. Performance data for this service will not be available.
Message #
Fields #
| Name | Description |
|---|---|
ProcName AnsiString | — |
Library UnicodeString | — |
Service UnicodeString | — |
Win32Error UInt32 | — |
Event ID 1008 — The Open procedure for service "Service" in DLL "Library" failed with error code Win32Error.
Event ID 1009 — The Open procedure in Extensible Counter DLL "Library" for the "Service" service generated exception ExceptionCode at address ExceptionAddress.
Description
The Open procedure in Extensible Counter DLL "Library" for the "Service" service generated exception ExceptionCode at address ExceptionAddress. Performance data for this service will not be available.
Message #
Fields #
| Name | Description |
|---|---|
Library UnicodeString | — |
Service UnicodeString | — |
ExceptionCode UInt32 | — |
ExceptionAddress Pointer | — |
Event ID 1010 — The Collect procedure in Extensible Counter DLL "Library" for the "Service" service generated exception ExceptionCode at address ExceptionAddress.
Event ID 1011 — The Close procedure in Extensible Counter DLL "Library" for the "Service" service generated exception ExceptionCode at address ExceptionAddress.
Event ID 1013 — The Collect procedure in Extensible Counter DLL "Library" for the "Service" service returned a buffer that was larger (by Size bytes) than the space allocated ...
Event ID 1014 — The Collect procedure for service "Service" in DLL "Library" failed with error code Win32Error.
Event ID 1015 — The performance data collection function for the "Service" service in the "Library" library did not complete in the allowed time.
Event ID 1016 — The Collect procedure in Extensible Counter DLL "Library" for the "Service" service returned pointer Buffer which is not aligned on an 8-byte boundary.
Event ID 1017 — Disabled performance counter data collection from the "Service" service because the performance counter library for that service has generated one or mo...
Message #
Fields #
| Name | Description |
|---|---|
Service UnicodeString | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Perflib",
"guid": "13B197BD-7CEE-4B4E-8DD0-59314CE374CE",
"event_source_name": "",
"event_id": 1017,
"version": 1,
"level": 2,
"task": 0,
"opcode": 0,
"keywords": 9223372036854775808,
"time_created": "2026-03-13T22:14:32.809990+00:00",
"event_record_id": 35951,
"correlation": {
"ActivityID": "7BEB09B9-CFB7-40A8-960D-B58001198067"
},
"execution": {
"process_id": 320,
"thread_id": 10536
},
"channel": "Application",
"computer": "LAB-WIN11.ludus.domain",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"Service": "ASP.NET_2.0.50727"
},
"message": ""
}
Event ID 1018 — Disabled performance counter data collection for this session from the "Service" service because the performance counter library for that service has ge...
Event ID 1019 — A definition field in an object returned by Extensible Counter DLL "Library" for the "Service" service was not correct.
Event ID 1020 — The required buffer size is greater than the buffer size passed to the Collect function of the "Library" Extensible Counter DLL for the "Service" service.
Event ID 1021 — Windows cannot open the 32-bit extensible counter DLL "Library" in a 64-bit environment (Win32 error code Win32Error).
Message #
Fields #
| Name | Description |
|---|---|
Library UnicodeString | — |
Win32Error UInt32 | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Perflib",
"guid": "13B197BD-7CEE-4B4E-8DD0-59314CE374CE",
"event_source_name": "",
"event_id": 1021,
"version": 1,
"level": 2,
"task": 0,
"opcode": 0,
"keywords": 9223372036854775808,
"time_created": "2026-03-13T22:14:32.809867+00:00",
"event_record_id": 35950,
"correlation": {
"ActivityID": "7BEB09B9-CFB7-40A8-960D-B58001198067"
},
"execution": {
"process_id": 320,
"thread_id": 10536
},
"channel": "Application",
"computer": "LAB-WIN11.ludus.domain",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"Library": "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\aspnet_perf.dll",
"Win32Error": 193
},
"message": ""
}
Event ID 1022 — Windows cannot open the 64-bit extensible counter DLL Library in a 32-bit environment (Win32 error code Win32Error).
Event ID 1023 — Windows cannot load the extensible counter DLL "C:\Windows\system32\ntdsperf.
#Description
Windows cannot load the extensible counter DLL "C:\Windows\system32\ntdsperf.dll" (Win32 error code 126!s!).
Message #
Fields #
| Name | Description |
|---|---|
Library UnicodeString | — |
Win32Error UInt32 | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Perflib",
"guid": "13B197BD-7CEE-4B4E-8DD0-59314CE374CE",
"event_source_name": "",
"event_id": 1023,
"version": 1,
"level": 2,
"task": 0,
"opcode": 0,
"keywords": 9223372036854775808,
"time_created": "2022-04-07T08:15:12.496963+00:00",
"event_record_id": 107,
"correlation": {},
"execution": {
"process_id": 2644,
"thread_id": 3324
},
"channel": "Application",
"computer": "WIN-FPV0DSIC9O6.lab.local",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"Library": "C:\\Windows\\system32\\ntdsperf.dll",
"Win32Error": 126
},
"message": "Windows cannot load the extensible counter DLL \"C:\\Windows\\system32\\ntdsperf.dll\" (Win32 error code 126!s!)."
}
References #
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 2000 — The Collect procedure in Extensible Counter DLL "Library" for the "Service" service returned a length (BytesLeft) that did not match the expected length (BytesAvailable).
Event ID 2001 — The "Service" service does not have a Performance subkey or the key could not be opened (Win32 error code NTSTATUS).
Event ID 2002 — The Open procedure for service "Service" in DLL "Library" did not complete in the allowed time.
Event ID 2003 — The configuration information of the performance library "Library" for the "Service" service does not match the trusted performance library information store...
Event ID 3002 — The number of objects allowed in a performance library has exceeded the maximum supported.
Description
The number of objects allowed in a performance library has exceeded the maximum supported.
Message #
Event ID 3003 — Unable to find the ProcName procedure name in the registry for service "Service".
Event ID 2147484664 — The Collect procedure in Extensible Counter DLL "param1" for the "param2" service returned pointer binary which is not aligned on an 8-byte boundary.
Event ID 2147485648 — The Collect procedure in Extensible Counter DLL "param1" for the "param2" service returned a length (binary) that did not match the expected length (%4).
Event ID 2147485649 — The "param1" service does not have a Performance subkey or the key could not be opened (Win32 error code %3).
Event ID 2147485650 — The Open procedure for service "param1" in DLL "param2" did not complete in the allowed time.
Event ID 2147485651 — The configuration information of the performance library "param1" for the "param2" service does not match the trusted performance library information store...
Event ID 3221226472 — Access to performance data was denied to user "param1" (value from GetUserName() for the running thread) as attempted from module "param2".
Event ID 3221226473 — The Collect procedure in Extensible Counter DLL "param1" for the "param2" service returned buffer size binary, which is larger than the space available.
Event ID 3221226474 — A Guard Page was modified by a Collect procedure in Extensible Counter DLL "param1" for the "param2" service.
Event ID 3221226475 — The Extensible Counter DLL "param1" for the "param2" service returned an incorrect object length.
Event ID 3221226476 — The Extensible Counter DLL "param1" for the "param2" service returned an incorrect instance length for the object with title index binary.
Event ID 3221226477 — The attempt to locate the Open procedure "param1" in DLL "param2" for the "param3" service failed with Win32 error code binary.
Description
The attempt to locate the Open procedure "param1" in DLL "param2" for the "param3" service failed with Win32 error code binary. Performance data for this service will not be available.
Message #
Fields #
| Name | Description |
|---|---|
param1 UnicodeString | — |
param2 UnicodeString | — |
param3 UnicodeString | — |
binary Binary | — |
Event ID 3221226478 — The attempt to locate the Collect procedure "param1" in DLL "param2" for the "param3" service failed with Win32 error code binary.
Description
The attempt to locate the Collect procedure "param1" in DLL "param2" for the "param3" service failed with Win32 error code binary. Performance data for this service will not be available.
Message #
Fields #
| Name | Description |
|---|---|
param1 UnicodeString | — |
param2 UnicodeString | — |
param3 UnicodeString | — |
binary Binary | — |
Event ID 3221226479 — The attempt to locate the Close procedure "param1" in DLL "param2" for the "param3" service failed with Win32 error code binary.
Description
The attempt to locate the Close procedure "param1" in DLL "param2" for the "param3" service failed with Win32 error code binary. Performance data for this service will not be available.
Message #
Fields #
| Name | Description |
|---|---|
param1 UnicodeString | — |
param2 UnicodeString | — |
param3 UnicodeString | — |
binary Binary | — |
Event ID 3221226480 — The Open procedure for service "param1" in DLL "param2" failed with error code binary.
Event ID 3221226481 — The Open procedure in Extensible Counter DLL "param1" for the "param2" service generated exception binary at address %4.
Event ID 3221226482 — The Collect procedure in Extensible Counter DLL "param1" for the "param2" service generated exception binary at address %4.
Event ID 3221226483 — The Close procedure in Extensible Counter DLL "param1" for the "param2" service generated exception binary at address %4.
Event ID 3221226485 — The Collect procedure in Extensible Counter DLL "param1" for the "param2" service returned a buffer that was larger (by binary bytes) than the space allocated ...
Event ID 3221226487 — The performance data collection function for the "param1" service in the "param2" library did not complete in the allowed time.
Event ID 3221226489 — Disabled performance counter data collection from the "param1" service because the performance counter library for that service has generated one or mo...
Event ID 3221226490 — Disabled performance counter data collection for this session from the "param1" service because the performance counter library for that service has ge...
Event ID 3221226491 — A definition field in an object returned by Extensible Counter DLL "param1" for the "param2" service was not correct.
Event ID 3221226492 — The required buffer size is greater than the buffer size passed to the Collect function of the "param1" Extensible Counter DLL for the "param2" service.
Event ID 3221226493 — Windows cannot open the 32-bit extensible counter DLL "param1" in a 64-bit environment (Win32 error code binary).
Event ID 3221226494 — Windows cannot open the 64-bit extensible counter DLL param1 in a 32-bit environment (Win32 error code binary).
Event ID 3221226495 — Windows cannot load the extensible counter DLL "param1" (Win32 error code binary).
Event ID 3221228474 — The number of objects allowed in a performance library has exceeded the maximum supported.
Description
The number of objects allowed in a performance library has exceeded the maximum supported.