Event ID 3006 and Exchange Server 2007 performance counters

An Exchange Server 2007 server with incorrectly loaded performance counters may result in many instances of event ID 3006 being logged to the Application Event Log.

Event Type: Warning
Event Source: LoadPerf
Event Category: None
Event ID: 3006
Date:  10/09/2007
Time:  12:51:51
User:  N/A
Computer: SERVER
Description:
Unable to read the performance counter strings of the 011 language ID. The Win32 status returned by the call is the first DWORD in Data section.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 02 00 00 00 20 01 00 00   …. …

One solution to these Event Log warnings is to run “Lodctr /r” from a command line.  A description of the Lodctr utility is available here.

Running this command may cause the following errors to appear in the Application Event Log, which identify the particular performance counters that are causing the issue.

Event Type: Error
Event Source: LoadPerf
Event Category: None
Event ID: 3009
Date:  10/09/2007
Time:  12:52:05
User:  N/A
Computer: SERVER
Description:
Installing the performance counter strings for service MSExchangeFDS:UM (%2) failed. The Error code is the first DWORD in Data section.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:

0000: 27 05 00 00 d1 11 00 00   ‘…Ñ…
Event Type: Warning
Event Source: LoadPerf
Event Category: None
Event ID: 2007
Date:  10/09/2007
Time:  12:52:05
User:  N/A
Computer: SERVER
Description:
Cannot repair performance counters for MSExchangeFDS:UM service. Please re-install manually using LODCTR tool.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:

0000: 27 05 00 00 17 05 00 00   ‘…….

In this situation the performance counters must be reloaded manually.  In the case of Exchange Server 2007 the performance counters can be reloaded from C:\Program Files\Microsoft\Exchange Server\Setup\Perf.  In this example the MSExchangeFDS:UM counter is the cause of the error, which is loaded from the FDSUMPerformanceCounters.ini file.

exchangeperfcounters.JPG

C:\Program Files\Microsoft\Exchange Server\Setup\Perf>lodctr fdsumperformancecounters.ini

If the reload is successful the following event is logged.

Event Type: Information
Event Source: LoadPerf
Event Category: None
Event ID: 1000
Date:  10/09/2007
Time:  13:06:27
User:  N/A
Computer: SERVER
Description:
Performance counters for the MSExchangeFDS:UM (MSExchangeFDS:UM) service were loaded successfully. The Record Data contains the new index values assigned to this service.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 88 18 00 00 90 18 00 00   ˆ……
0008: 89 18 00 00 91 18 00 00   ‰…‘…

This will resolve the repeated logging of the event ID 3006 entries to the Application Event Log.

About Paul Cunningham

Paul is a Microsoft Exchange Server MVP and publisher of Exchange Server Pro. He also holds several Microsoft certifications including for Exchange Server 2007, 2010 and 2013. Find Paul on Twitter, LinkedIn or Google+, or get in touch for consulting/support engagements.

Leave a Comment

*

We are an Authorized DigiCert™ SSL Partner.