Large number of Perflib 1008 errors in application event log in Windows 2000 (828872)

SYMPTOMS

Important This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows Registry

The Event Viewer application log displays many of the following messages in short intervals:

Event Type: Error
Event Source: Perflib
Event Category: None
Event ID: 1008
Description:
The Open Procedure for service "Nbf" in DLL "C:\WINNT\system32\Perfctrs.dll" failed. Performance data for this service will not be available. Status code returned is DWORD 0.

Data Words: 0000: 00000002

CAUSE

This issue may occur after you disable the NetBEUI (NetBIOS Enhanced User Interface) protocol. In the message that is referenced in the "Symptoms" section, PerfLib is a performance counter library. The Perfctrs DLL monitors some network counters. The counter for the NetBIOS Frames Protocol (NBF) service, the NetBEUI network protocol, causes the error.

When you first create a performance query, Perflib checks the availability of all counters that are listed in the registry. If a counter is not available, the application log displays an event message. This event message occurs when one or more of the following conditions are true:

The NetBEUI protocol does not bind to the network adapter, because either the adapter or the driver is defective, and its extensible performance monitor counters are enumerated.
NetBEUI is bound to a network adapter that is not connected to the local area network (LAN).
NetBEUI is installed, but it is disabled on the network adapter card.

This issue may occur if your computer loads a performance monitoring-based program at startup.

RESOLUTION

To troubleshoot this issue, follow these steps:

Update network adapter drivers.
Make sure that there are no nonpresent, ghosted, or hidden network adapters in your computer.
For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
269155 Error message when you try to set an IP address on a network adapter
If the issue persists, follow these steps to remove and then reinstall each network adapter:
1. Right-click My Computer, click Properties, click the Hardware tab, and then click Device Manager.
2. Click the network adapter, and then click Remove.
3. Restart the computer, and then let the system automatically detect and install the drivers for the network adapter.
Note This step will detect and correct corrupted registry entries on network adapter bindings.
Repeat step 3 for all network adapters.

WORKAROUND

To work around this issue, use one or both of the following methods:

Remove the NetBEUI protocol if you do not require it.

Note The event may be logged even if NetBEUI is disabled on the network adapter card.
Prevent Perflib from checking the NBF counters.

Note The following information applies to 1008 events in general, not only to the NBF service.

To prevent the performance counter library (Perflib) from checking counters, you can disable the Extensible Performance Counters library or remove it. Use one of the following methods to do this:
- To use the Extensible Counter tool (ExCtrlLst.exe) to disable the Perfctrs.dll performance counters, follow these steps:
  1. Start the Exctrlst.exe tool. This tool is in the Microsoft Windows 2000 Resource Kit.
  2. Select the DLL (Perfctrs.dll) that did not open in the Extensible Performance Counters list box.
  3. Click to clear the Performance Counters Enabled check box.
  4. Restart the computer.
  This procedure does not resolve this issue, but it may prevent future error messages. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
  248993 PRB: Performance object is not displayed in Performance Monitor
- To disable the performance counters by modifying a specific registry entry, follow these steps:
  
  Note You can set this value programmatically through your performance data collection program, or you can use Registry Editor. If you use Registry Editor, information from the counters will not be available unless you change the subkey value to 0 or delete the subkey.
  Warning If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.
  1. Start Registry Editor.
  2. Locate and then click the following service_name\Performance subkey in the registry:
    \HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NBF\Performance
  3. Click Add Value on the Edit menu, and then add the following values:
    Value name: Disable Performance Counters
    Data type: REG_DWORD
    Radix: Decimal
    Value data: 1
  4. Quit Registry Editor.
  5. Restart the computer.
  Note Counters will not load, and you will not be able to collect NetBEUI and TCPIP performance data.
- To remove the performance counters by modifying a specific registry entry, follow these steps:
  
  Note To prevent Event 1008 errors, you can generally export the Performance registry subkey and then remove the Performance registry branch of the service_name service that is mentioned in the Event 1008 error text, where Nbf is the service_name in the event message that is referenced in the "Symptoms" section of this article.
  1. Start Registry Editor.
  2. Locate and then click the following service_name\Performance key in the registry:
    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Nbf\Performance
  3. Export the performance key, and then delete it from the registry.
    
    Note If you do not use Performance Monitor or any other performance monitor program to track NetBEUI performance, remove the Performance registry branch for the NBF service (NetBEUI protocol).
  4. Restart the computer.

REFERENCES

For additional information, click the following article numbers to view the articles in the Microsoft Knowledge Base:

226494 INFO: Events for Performance Monitor extensions

811066 EventLogLevel registry setting does not suppress all event messages for extensible counters as expected

186713 Event ID 1010, 1008, 1011, and 4005 with CIM and Perflib

300956 How to manually rebuild performance counter library values

299059 You receive Application Center Event ID: 1008 Perflib error messages on Performance Data Counters