Performance Monitoring Events

[Robert Zahm]

I found the warnings listed below in the event logs of our Windows SBS2003
SP1 machine after startup. They were also logged when I attempted to email
myself the performance monitoring report (along with an error dialog that
told me that an error had occured, and that I should check the configuration
settings). I saw some things about unloading/reloading DLLs, reseting
performance counters, reinstalling IIS and updating registry entries, but I
would like a little more information and some reassurance before doing
anything like that.

Thanks,

Rob

Here are the events that are logged (from what I gather, I can ignore the
duplicate 5603 errors, but I'm guessing my problem lies with that last one):

Event Type: Warning
Event Source: WinMgmt
Event Category: None
Event ID: 5603
Date: 10/15/2005
Time: 9:29:39 PM
User: NT AUTHORITY\SYSTEM
Computer: BRADFORDDC01
Description:
A provider, PerfProv, has been registered in the WMI namespace,
ROOT\CIMV2\MicrosoftHealthMonitor\PerfMon, but did not specify the
HostingModel property. This provider will be run using the LocalSystem
account. This account is privileged and the provider may cause a security
violation if it does not correctly impersonate user requests. Ensure that
provider has been reviewed for security behavior and update the HostingModel
property of the provider registration to an account with the least
privileges possible for the required functionality.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Warning
Event Source: WinMgmt
Event Category: None
Event ID: 5603
Date: 10/15/2005
Time: 9:29:39 PM
User: NT AUTHORITY\SYSTEM
Computer: BRADFORDDC01
Description:
A provider, PerfProv, has been registered in the WMI namespace,
ROOT\CIMV2\MicrosoftHealthMonitor\PerfMon, but did not specify the
HostingModel property. This provider will be run using the LocalSystem
account. This account is privileged and the provider may cause a security
violation if it does not correctly impersonate user requests. Ensure that
provider has been reviewed for security behavior and update the HostingModel
property of the provider registration to an account with the least
privileges possible for the required functionality.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Warning
Event Source: Perflib
Event Category: None
Event ID: 2003
Date: 10/15/2005
Time: 9:29:43 PM
User: N/A
Computer: BRADFORDDC01
Description:
The configuration information of the performance library
"C:\WINDOWS\system32\inetsrv\w3ctrs.dll" for the "W3SVC" service does not
match the trusted performance library information stored in the registry.
The functions in this library will not be treated as trusted.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

[Jenny wu [MSFT]]

Hi Robert,

Thanks for posting here!

For your description, I understand that you got warning event 5603 and 2003
warning event when reboot server box. If I am off base, please don't
hesitate to let me know.

1. Event 5603

Based on my research, this is a by-design behavior. The reasoning behind
the warning is that the operating system informs the administrators that a
WMI provider runs under the LocalSystem context. This is the reason why we
see this warning anytime the WMI service starts up.

Actually, this does not indicate a system error. We can safely ignore the
event. Please do not worry.

2. Event 2003

This event could occur when server was heavy loaded or some particular
third-party software was installed on the server. Could you please tell me
if there is any server management software ware such as HP agent service
installed on the SBS server? If so, you may disable the third-party
management software to see if the problem will occur again. If the warning
only occurs when the server is starting up, there will be no impact to your
SBS server. I''ve tested the steps of KB267831 on my SBS 2003 server. It''s
safely to use the steps on a SBS 2003 server.

You can refer to the KB 267831 article to resolve the issue:
Event ID 2003 Warning Message Logged When Loading Performance Counters
http://support.microsoft.com/?id=267831

And also you can try to remove the "Library Validation Code" value from
registry to try to resolve the issue:

Open Regedit, locate the
"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Performance"
registry key and you will find the "Library Validation Code" value.

WARNING: If you use Registry Editor incorrectly, you may cause serious
problems that may require you to reinstall your operating system. Please
backup the registry keys before edit it.

How about the result?

What is more, you can view the following link to get more information about
the 2003 error event:
http://www.eventid.net/display.asp?eventid=2003&eventno=705&source=Perflib&p
hase=1

Related information:

Create and Configure Performance Monitor Alerts in Windows 2000
http://support.microsoft.com/?id=302558

Troubleshooting Performance Monitor Counter Problems
http://support.microsoft.com/?id=152513

How to manually rebuild Performance Counter Library values
http://support.microsoft.com/?id=300956

Events for Performance Monitor Extensions
http://support.microsoft.com/?id=226494

Hope above information helps! If you have any further concern on the issue
please feel free to let me know. I am happy to be assistance of you!

Have a nice day!

Best Regards,

Jenny Wu
Microsoft CSS Online Newsgroup Support
Get Secure! - www.microsoft.com/security
======================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
======================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------
>From: "Robert Zahm" <rob...@hotmail.com>
>Subject: Performance Monitoring Events
>Date: Wed, 19 Oct 2005 09:35:34 -0500
>Lines: 78
>X-Priority: 3
>X-MSMail-Priority: Normal
>X-Newsreader: Microsoft Outlook Express 6.00.2900.2670
>X-RFC2646: Format=Flowed; Original
>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670
>Message-ID: <#qyuepL1...@TK2MSFTNGP14.phx.gbl>
>Newsgroups: microsoft.public.windows.server.sbs
>NNTP-Posting-Host: 64-45-168-10.client.cypresscom.net 64.45.168.10
>Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP14.phx.gbl
>Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:162685
>X-Tomcat-NG: microsoft.public.windows.server.sbs

[Robert Zahm]

Jenny,

Thanks for your reply, I will try the KB steps you outlined over the
weekend.

Thanks,

Rob

""Jenny wu [MSFT]"" <v-ya...@online.microsoft.com> wrote in message
news:lQCWvET1...@TK2MSFTNGXA01.phx.gbl...

[Jenny wu [MSFT]]

Hi Rob,

Thanks for your update!

I am sorry for the delayed response due to weekend. Please understand that
the newsgroups are staffed weekdays by Microsoft Support professionals to
answer your systems and applications questions. Your understanding is
greatly appreciated!

I appreciate you time and efforts to the issue. Please feel free to post
back when you need further assistance on this issue and you are always
welcome!

Have a nice day!

Sincerely,

>References: <#qyuepL1...@TK2MSFTNGP14.phx.gbl>
<lQCWvET1...@TK2MSFTNGXA01.phx.gbl>
>Subject: Re: Performance Monitoring Events
>Date: Fri, 21 Oct 2005 13:09:55 -0500
>Lines: 223

>X-Priority: 3
>X-MSMail-Priority: Normal
>X-Newsreader: Microsoft Outlook Express 6.00.2900.2670

>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670

>X-RFC2646: Format=Flowed; Original
>Message-ID: <u2qDlqm...@tk2msftngp13.phx.gbl>

>Newsgroups: microsoft.public.windows.server.sbs
>NNTP-Posting-Host: 64-45-168-10.client.cypresscom.net 64.45.168.10

>Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!tk2msftngp13.phx.gbl
>Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:163443
>X-Tomcat-NG: microsoft.public.windows.server.sbs

[Robert Zahm]

Jenny,

I didn't end up getting a chance to try this out this weekend, so most
likely I will have to push it back a week.

Thanks,

Rob

""Jenny wu [MSFT]"" <v-ya...@online.microsoft.com> wrote in message

news:QFY3cVI2...@TK2MSFTNGXA01.phx.gbl...

[Jenny wu [MSFT]]

Hi Rob,

Ok, I will wait for you . Just post back when you need further assistance
to the issue. I am happy to be assistance of you and you are always welcome!

Have a nice day!

Sincerely,

<u2qDlqm...@tk2msftngp13.phx.gbl>
<QFY3cVI2...@TK2MSFTNGXA01.phx.gbl>

>Subject: Re: Performance Monitoring Events

>Date: Mon, 24 Oct 2005 11:15:14 -0500
>Lines: 327

>X-Priority: 3
>X-MSMail-Priority: Normal
>X-Newsreader: Microsoft Outlook Express 6.00.2900.2670
>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670
>X-RFC2646: Format=Flowed; Original

>Message-ID: <eNS0eYL2...@TK2MSFTNGP10.phx.gbl>

>Newsgroups: microsoft.public.windows.server.sbs
>NNTP-Posting-Host: 64-45-168-10.client.cypresscom.net 64.45.168.10

>Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP10.phx.gbl
>Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:164063
>X-Tomcat-NG: microsoft.public.windows.server.sbs

[Robert Zahm]

Jenny,

With regards to the Library Validation Code registry entry, do I simply
delete the entire key, or modify the data and "clear" it out that way?

Thanks,

Rob

""Jenny wu [MSFT]"" <v-ya...@online.microsoft.com> wrote in message
news:lQCWvET1...@TK2MSFTNGXA01.phx.gbl...

[Jenny wu [MSFT]]

Hi Rob,

Thanks for your update!

Have you followed KB 267831 to try to unload and reload the IIS performance
DLLs? If not, please try to register these DLLs to try to remove the issue.

After done that, if the issue persists, you can try to delete the "Library
Validation Code" registry key to resolve the issue. Generally, the "Library
Validation Code" value is checked against the file creation time and the
file size of the "%systemroot%\system32\inetsrv\w3ctrs.dll" DLL. This 2003
event error will be posted if they do not match.

I am currently waiting for your test result and look forward to your reply!

Have a nice day!

Sincerely,

Jenny Wu

>References: <#qyuepL1...@TK2MSFTNGP14.phx.gbl>
<lQCWvET1...@TK2MSFTNGXA01.phx.gbl>
>Subject: Re: Performance Monitoring Events

>Date: Thu, 27 Oct 2005 17:42:59 -0500
>Lines: 223

>X-Priority: 3
>X-MSMail-Priority: Normal
>X-Newsreader: Microsoft Outlook Express 6.00.2900.2670

>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670

>X-RFC2646: Format=Flowed; Original
>Message-ID: <#AeMJf02...@tk2msftngp13.phx.gbl>

>Newsgroups: microsoft.public.windows.server.sbs
>NNTP-Posting-Host: 64-45-168-10.client.cypresscom.net 64.45.168.10

>Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!tk2msftngp13.phx.gbl
>Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:165275
>X-Tomcat-NG: microsoft.public.windows.server.sbs

[Robert Zahm]

Jenny,

Yes, I tried unloading the counters, but msftpsvc generated errors:

unloading:
Unable to open driver SYSTEM\CurrentControlSet\Services\msftpsvc. Status: 2
loading:
Unable to find initialization file ftpctrs.ini

I deleted the library validation code registry key, but I still receive
errors when trying to send the performance report to myself.

Thanks,

Rob

""Jenny wu [MSFT]"" <v-ya...@online.microsoft.com> wrote in message

news:kYpCc662...@TK2MSFTNGXA01.phx.gbl...

[Robert Zahm]

Jenny,

Also, I would like to clarify that I am able to get the report to generate,
it just doesn't work when I try to send it to myself.

I also cannot get the usage report to work:
* In "Server Management," click on "Monitoring and Reporting"
* Click "View Usage Report"
* Click "Create New Report"
* This pops up a dialog, and no matter what dates I include on the report,
when I click "Create Report," I am told that no usage data is available for
that time period. Any ideas?

Thanks,

Rob

"Robert Zahm" <rob...@hotmail.com> wrote in message
news:uVxhda92...@TK2MSFTNGP09.phx.gbl...

[Jenny wu [MSFT]]

Hi Rob,

Thanks for your update!

I am sorry for the delayed response due to weekend. Please understand that

the newsgroups are staffed weekdays by Microsoft Support professionals to
answer your systems and applications questions. Your understanding is
greatly appreciated!

For time critical issues (not business down), we encourage you to contact
CSS directly for more immediate assistance:
International Support (non-US/Canada):
http://support.microsoft.com/common/international.aspx

US and Canada:
http://support.microsoft.com/default.aspx?scid=fh;EN-US;OfferProPhone

To continue working with me in the newsgroups, please see the following:

If there is no FTP Service configured on IIS Server,after you type unlodctr
msftpsvc, there will be an error message respond as:

Unable to open driver SYSTEM\CurrentControlSet\Services\msftpsvc. Status: 2

You can ignore this info since you did not install FTP Service on IIS and
continue unload and reload the IIS performance DLLs followed KB 267831 and
then see if the issue will be fixed.

If the issue persists, I suggest that you follow the steps below to rebuild
the Performance Counter Library:

1. Expand the Perfc009.dat file and the Perfh009.dat file. These files are
located on the Windows 2000 CD-ROM. The compressed files are found at
DriveLetter:\i386\perfc009.da_ and at DriveLetter:\i386\perfh009.da_.
Replace the files that are in the %Systemroot%\System32 folder.

For additional information about the EXPAND command, click the following
article number to view the article in the Microsoft Knowledge Base:
314958 HOW TO: Use the COMPRESS, COMPACT, and EXPAND Commands to Compress
and Expand Files and Folders in Windows 2000

2. Start Registry Editor, and then locate the following key in the
registry:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Perflib

3. In the registry, change the LastCounter value to 1846 (decimal), and
change the LastHelp value to 1847 (decimal).

4. Locate the following registry key to search for services that have a
Performance subkey:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services
5. Remove the following values from the Performance subkey (if they exist):
? FirstCounter ? FirstHelp ? LastCounter ? LastHelp

You can also use the Exctrlst.exe tool to locate the performance counter
dynamic-link library files (DLLs) that are installed, and then access the
registry to remove the DWORD values. You now have a workable performance
registry that contains only system base counters.

After you have completed this procedure, you must re-add the extensible
counters from the list of services. Before you do so, however, you must
identify the .ini file that is used to load the counters:
1. Open a command prompt window.
2. At the command prompt, type cd %Systemroot%\System32, and then press
ENTER.
3. At the command prompt, type findstr drivername *.ini, and then press
ENTER.
4. Note the name of the .ini file for each drivername in the list.
5. At the command prompt, type the following line, and then press ENTER:
lodctr inifile where inifile is the name of the .ini file for the driver
that you want to reload. For example, if you want to reload the ASP
driver, the list that you noted in step 4 shows that Axperf.ini is the .ini
file for the ASP driver (axperf.ini:drivername=ASP). Therefore, to reload
the ASP driver, type lodctr axperf.ini at the command prompt, and then
press ENTER.
6. Repeat step 5 for each .ini file in the list.
7. Restart your computer.

For more info, please refer to:
300956 How to manually rebuild Performance Counter Library values
http://support.microsoft.com/?id=300956

Then, wait to see how it goes.

Hope above information helps! I appreciate your time and efforts to perform
test and look forward to your reply!

Have a nice day!

Sincerely,

<#AeMJf02...@tk2msftngp13.phx.gbl>
<kYpCc662...@TK2MSFTNGXA01.phx.gbl>
<uVxhda92...@TK2MSFTNGP09.phx.gbl>

>Subject: Re: Performance Monitoring Events

>Date: Fri, 28 Oct 2005 14:31:46 -0500
>Lines: 372

>X-Priority: 3
>X-MSMail-Priority: Normal
>X-Newsreader: Microsoft Outlook Express 6.00.2900.2670
>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670

>X-RFC2646: Format=Flowed; Response
>Message-ID: <#8Kr0Y$2FHA...@TK2MSFTNGP10.phx.gbl>

>Newsgroups: microsoft.public.windows.server.sbs
>NNTP-Posting-Host: 64-45-168-10.client.cypresscom.net 64.45.168.10

>Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP10.phx.gbl
>Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:165655
>X-Tomcat-NG: microsoft.public.windows.server.sbs

[Robert Zahm]

Jenny,

I follow the instructions from the KB article to rebuild the performance
counters. I still receive the same results though; I can view the
performance report while logged into the server through server management,
but when I click "Change Server Status Report Settings" and then "Send Now"
I still receive the following error, "An error occurred while sending the
Server Status Report. Verify that report configuration settings are
correct, and then try again."

It doesn't seem to be a performance counter problem (since I can view
everything while logged into the server), but I am unable to send myself the
performance report. I don't have Exchange installed, does it need Exchange
in order to send out this report? I am able to receive alerts from
SharePoint, so I know that the SMTP server is working.

I am also still unable to view the Usage Report (I click Create New Report,
and no matter what dates I enter, I always get a page that states, "No usage
data is available for this time period."

Thanks,

Rob

""Jenny wu [MSFT]"" <v-ya...@online.microsoft.com> wrote in message

news:0pTXoyh3...@TK2MSFTNGXA01.phx.gbl...

[Robert Zahm]

Here are some warnings and errors from the event logs:

Event Type: Warning
Event Source: WinMgmt
Event Category: None

Event ID: 63
Date: 11/9/2005
Time: 1:51:22 PM
User: NT AUTHORITY\SYSTEM
Computer: ECHDC1

Description:
A provider, PerfProv, has been registered in the WMI namespace,

ROOT\CIMV2\MicrosoftHealthMonitor\PerfMon, to use the LocalSystem account.

This account is privileged and the provider may cause a security violation
if it does not correctly impersonate user requests.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Warning
Event Source: WinMgmt
Event Category: None

Event ID: 63
Date: 11/9/2005
Time: 1:51:22 PM
User: NT AUTHORITY\SYSTEM
Computer: ECHDC1

Description:
A provider, PerfProv, has been registered in the WMI namespace,

ROOT\CIMV2\MicrosoftHealthMonitor\PerfMon, to use the LocalSystem account.

This account is privileged and the provider may cause a security violation
if it does not correctly impersonate user requests.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Error

Event Source: Perflib
Event Category: None

Event ID: 1008
Date: 11/9/2005
Time: 1:51:23 PM
User: N/A
Computer: ECHDC1
Description:
The Open Procedure for service "ASP.NET" in DLL
"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll" failed.
Performance data for this service will not be available. The Status code
returned is the first DWORD in the attached data.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Data:
0000: 05 40 00 80 .@.€

Event Type: Error

Event Source: Perflib
Event Category: None

Event ID: 1008
Date: 11/9/2005
Time: 1:51:23 PM
User: N/A
Computer: ECHDC1
Description:
The Open Procedure for service "ASP.NET_1.1.4322" in DLL
"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll" failed.
Performance data for this service will not be available. The Status code
returned is the first DWORD in the attached data.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Data:
0000: cb 00 07 80 Ë..€

Event Type: Warning
Event Source: Perflib
Event Category: None
Event ID: 2003

Date: 11/9/2005
Time: 1:51:23 PM
User: N/A
Computer: ECHDC1

Description:
The configuration information of the performance library

"C:\WINDOWS\system32\infoctrs.dll" for the "InetInfo" service does not match

the trusted performance library information stored in the registry. The
functions in this library will not be treated as trusted.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Warning
Event Source: WinMgmt
Event Category: None

Event ID: 63
Date: 11/9/2005
Time: 1:56:44 PM
User: NT AUTHORITY\SYSTEM
Computer: ECHDC1

Description:
A provider, PerfProv, has been registered in the WMI namespace,

ROOT\CIMV2\MicrosoftHealthMonitor\PerfMon, to use the LocalSystem account.

This account is privileged and the provider may cause a security violation
if it does not correctly impersonate user requests.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Warning
Event Source: WinMgmt
Event Category: None

Event ID: 63
Date: 11/9/2005
Time: 1:56:44 PM
User: NT AUTHORITY\SYSTEM
Computer: ECHDC1

Description:
A provider, PerfProv, has been registered in the WMI namespace,

ROOT\CIMV2\MicrosoftHealthMonitor\PerfMon, to use the LocalSystem account.

This account is privileged and the provider may cause a security violation
if it does not correctly impersonate user requests.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Warning
Event Source: smtpsvc
Event Category: None
Event ID: 4006
Date: 11/9/2005
Time: 1:57:30 PM
User: N/A
Computer: ECHDC1
Description:
Message delivery to the host XXX.XXX.XXX.XX failed while delivering to the
remote domain 'XXX.org' for the following reason: The connection was dropped
by the remote host.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Data:
0000: d3 02 04 c0 Ó..À

Thanks,

Rob

"Robert Zahm" <rob...@hotmail.com> wrote in message

news:OQ6zCfW5...@TK2MSFTNGP10.phx.gbl...

[Robert Zahm]

I also found a KB article (323350) to test the SMTP Services in Win2k3.

When I set the sender as some...@domain.com, I am unable to use my address
(rober...@differentdomain.com) as a recipient. However, if I set
rober...@differentdomain.com as the sender and recipient, then I am able
to complete the test. Is there someplace where I can set up the sender
e-mail address for this report? I have tried setting me e-mail address as
the reply-to e-mail address, but that did not help

Thanks,

Rob

"Robert Zahm" <rob...@hotmail.com> wrote in message

news:u8D1TiW5...@TK2MSFTNGP09.phx.gbl...

> 0000: 05 40 00 80 .@.?

>
>
> Event Type: Error
> Event Source: Perflib
> Event Category: None
> Event ID: 1008
> Date: 11/9/2005
> Time: 1:51:23 PM
> User: N/A
> Computer: ECHDC1
> Description:
> The Open Procedure for service "ASP.NET_1.1.4322" in DLL
> "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll" failed.
> Performance data for this service will not be available. The Status code
> returned is the first DWORD in the attached data.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:

> 0000: cb 00 07 80 À..?

> 0000: d3 02 04 c0 ”..¿

[Jenny wu [MSFT]]

Hi Rob,

Thanks for your update!

Regarding to your description, I understand that the Exchange server is
installed on the SBS server box. Although the Windows 2003 SMTP service can
be used to send emails, the SBS 2003 Monitoring and Reporting service is
designed to closely work with Exchange Server 2003. And your scenario can
not be supported in the newsgroup, I suggest you install Exchange server on
the SBS server box and configure Exchange server as your domain mail server
to take full advantage of the SBS 2003 functions. The Exchange server
installation is included in the SBS 2003 installation disks.

The SBS 2003 provide CEICW (Configuration E-mail and Internet Wizard) to
simple network connection and mail server configuration. For more detail
information, you can refer to the KB 825763:

825763 How to configure Internet access in Windows Small Business Server
2003
http://support.microsoft.com/?id=825763

If you have any further concern on the issue please let me know. I am happy

to be assistance of you!

Have a nice day!

Sincerely,

<#8Kr0Y$2FHA...@TK2MSFTNGP10.phx.gbl>
<0pTXoyh3...@TK2MSFTNGXA01.phx.gbl>
<OQ6zCfW5...@TK2MSFTNGP10.phx.gbl>
<u8D1TiW5...@TK2MSFTNGP09.phx.gbl>

>Subject: Re: Performance Monitoring Events

>Date: Wed, 9 Nov 2005 15:03:44 -0600
>Lines: 803

>X-Priority: 3
>X-MSMail-Priority: Normal
>X-Newsreader: Microsoft Outlook Express 6.00.2900.2670

>X-RFC2646: Format=Flowed; Response

>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670

>Message-ID: <OH$7SEX5F...@TK2MSFTNGP14.phx.gbl>

>Newsgroups: microsoft.public.windows.server.sbs
>NNTP-Posting-Host: 64-45-168-10.client.cypresscom.net 64.45.168.10

>Path: TK2MSFTNGXA02.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP14.phx.gbl
>Xref: TK2MSFTNGXA02.phx.gbl microsoft.public.windows.server.sbs:220603
>X-Tomcat-NG: microsoft.public.windows.server.sbs

[Robert Zahm]

Jenny,

So I must install Exchange in order to send the performance emails out?

Also, any idea as to why the Usage Report will not generate any meaningful
data?

Thanks,

Rob

""Jenny wu [MSFT]"" <v-ya...@online.microsoft.com> wrote in message

news:lFmz%23Sf5F...@TK2MSFTNGXA02.phx.gbl...

[Jenny wu [MSFT]]

Hi Robert,

Thanks for your update! Yes, you are right. There is only this scenario can
be supported in the newsgroup.

What is your meaning of "why the Usage Report will not generate any
meaningful data?"? Could you describe your situation more detail?

The SBS 2003 usage report includes a predefined collection of statistics
that can help you understand how clients access and use the Internet,
e-mail, fax, remote connectivity, and Outlook Web Access features. By
proactively monitoring these areas and establishing a baseline of server
usage, you can evaluate resource needs and plan for future requirements
that can help make employees more productive and your network more
supportable.

After you run the Monitoring Configuration Wizard, server usage data is
collected continuously and stored in a database. By default, the server
usage report is sent to specified recipients in e-mail every other Monday
at 07:00 A.M. You can view the latest information in the Monitoring and
Reporting snap-in in Server Management by clicking Refresh.

The usage and performance report is based on the performance/health monitor
results. After we run the reporting wizard, the SBS server will begin to
save value collected by the monitoring components to the SBS monitoring
database. The SBS reporting utility needs to collect usage data for more
than 24 hours so that the report can be generated.

You can do follow steps to reset performance and usage settings:

NOTE: After doing the following steps, the original performance and usage
data will be removed. The server will start to collect new counter value
from the beginning.

1. Open Server Management console, navigate to 'Monitoring and Reporting'
snap-in. In the right panel, click 'Set Up Monitoring Reports and Alerts'.

2. In the wizard, click 'Next'->Select 'Reinstall monitoring
features'->Select the options if you want to receive the report e-mails.
Check 'View the usage report in Server Management' option. If you want to
receive the usage report e-mail, also check the option below->Add the users
which you allow them to view the usage report to the authorized
list->Select the option if you want to receive the performance
alerts->Click 'Finish' button to complete the configurations.

3. After doing the above steps, the performance and usage data will be
reset. Please wait for 24 hours and then you will see the reports through
the Monitoring and Reporting console.

If you have any questions or concerns related to this issue, please let me
know.

For your convenience, I list customize Usage status report settings' steps

1. Open Server Management, In the console tree, click Monitoring and
Reporting.
2. In the details pane, click Change Server Status Report Settings.
3. In the reports list, click the report to which you want to attach a log
file, and then click Edit.
4. On the Content tab, under Log files to send with the report, click the
log files you want to attach to the report.
5. To attach a log file that does not appear under Log files to send with
the report, click Add to browse for the log file.

Hope above information helps! I am happy to be assistance of you and look
forward to your reply!

Have a nice day!

Sincerely,

<#8Kr0Y$2FHA...@TK2MSFTNGP10.phx.gbl>
<0pTXoyh3...@TK2MSFTNGXA01.phx.gbl>
<OQ6zCfW5...@TK2MSFTNGP10.phx.gbl>
<u8D1TiW5...@TK2MSFTNGP09.phx.gbl>
<OH$7SEX5F...@TK2MSFTNGP14.phx.gbl>
<lFmz#Sf5FH...@TK2MSFTNGXA02.phx.gbl>

>Subject: Re: Performance Monitoring Events

>Date: Thu, 10 Nov 2005 09:30:11 -0600
>Lines: 973

>X-Priority: 3
>X-MSMail-Priority: Normal
>X-Newsreader: Microsoft Outlook Express 6.00.2900.2670
>X-RFC2646: Format=Flowed; Original
>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670

>Message-ID: <ePc5kug5...@tk2msftngp13.phx.gbl>

>Newsgroups: microsoft.public.windows.server.sbs
>NNTP-Posting-Host: 64-45-168-10.client.cypresscom.net 64.45.168.10

>Path: TK2MSFTNGXA02.phx.gbl!TK2MSFTNGP08.phx.gbl!tk2msftngp13.phx.gbl
>Xref: TK2MSFTNGXA02.phx.gbl microsoft.public.windows.server.sbs:220909
>X-Tomcat-NG: microsoft.public.windows.server.sbs

[Robert Zahm]

Jenny,

Sorry, I thought that this was part of my initial post, but I see now that
it was actually a separate post. I have a few remaining questions:

Performance Report
---------------------
Is there any way I can save a daily copy of this report to the hard disk, or
can it only be exported via email? If I could save it to the hard disk, I
would be able to write a script to attach it to an email to myself and send
it through the SMTP server.

Usage Report
--------------
I try to create a usage report through the following steps:

* In "Server Management," click on "Monitoring and Reporting"
* Click "View Usage Report"
* Click "Create New Report"

* This takes me to a page where I can enter specific dates for the report,

and no matter what dates I include on the report, when I click "Create
Report," I am told that no usage data is available for that time period.
Any ideas?

I have tried the setting the monitoring through the wizard up a few times,
but this report never works.

I also saw that the following event was logged after I rebooted the server
last night, could this be causing any problems?

Event Type: Warning
Event Source: Wingate

Event Category: None
Event ID: 5603

Date: 11/10/2005
Time: 8:01:06 PM

User: NT AUTHORITY\SYSTEM
Computer: BRADFORDDC01
Description:
A provider, PerfProv, has been registered in the WMI namespace,
ROOT\CIMV2\MicrosoftHealthMonitor\PerfMon, but did not specify the
HostingModel property. This provider will be run using the LocalSystem
account. This account is privileged and the provider may cause a security
violation if it does not correctly impersonate user requests. Ensure that
provider has been reviewed for security behavior and update the HostingModel
property of the provider registration to an account with the least
privileges possible for the required functionality.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

This doesn't sound like it would be causing any problems to me, but I
figured I would mention it since it sounds like it is related to the
performance monitoring process.

Thanks,

Rob

""Jenny wu [MSFT]"" <v-ya...@online.microsoft.com> wrote in message

news:9WTdxWr5...@TK2MSFTNGXA02.phx.gbl...

[Jenny wu [MSFT]]

Hi Robert,

Thanks for your update!

I am sorry for the delayed response due to weekend. Please understand that

the newsgroups are staffed weekdays by Microsoft Support professionals to
answer your systems and applications questions. Your understanding is
greatly appreciated!

For time critical issues (not business down), we encourage you to contact
CSS directly for more immediate assistance:
International Support (non-US/Canada):
http://support.microsoft.com/common/international.aspx

US and Canada:
http://support.microsoft.com/default.aspx?scid=fh;EN-US;OfferProPhone

To continue working with me in the newsgroups, please see the following:

For your now situation, I would suggest you to reinstall the monitoring
components to try to resolve this issue and avoid any further potential
issue.

Note: Please make a full backup of the SBS 2003 server before the following
steps..

I. Uninstall Monitoring

1. Click Start, click Control Panel, and then click Add or Remove
Programs.
2. Select Windows Small Business Server 2003 and then click
Change/Remove. The Setup Wizard appears.
3. Click Next to start the wizard.
4. On the Windows Configuration page, click Next.
5. On the Component Selection page, in the Action column, change
Server Tools to Maintenance, change Monitoring component to Remove, and
then click Next.
6. On the Component Summary page, click Next.
7. Click Finish.

II. Uninstall Microsoft SQL Server Desktop Engine (SBSMONITORING)

In Add or Remove Programs, select Microsoft SQL Server Desktop Engine
(SBSMONITORING) and then click Remove. A dialog box appears. To confirm
that you want to remove, click Yes.

III. Rename the folder

Start Windows Explorer, and then locate and rename the following folder:

C:\Program Files\Microsoft SQL Server\MSSQL$SBSMONITORING

to C:\Program Files\Microsoft SQL Server\Old.MSSQL$SBSMONITORING

IV. Use Registry Editor to delete the following registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\SmallBusinessServer\Monitoring
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\SBSMonitoring

V. Install the Monitoring component

1. In Add or Remove Programs, select Windows Small Business Server
2003 and then click Change/Remove. The Setup Wizard appears.
2. Click Next.
3. On the Windows Configuration page, click Next.
4. On the Component Selection page, in the Action column, change
Server Tools to Maintenance, change Monitoring component to Install, and
then click Next.
5. On the Logon Information page, click Next.
6. On the Component Summary page, click Next.
7. Click Finish.

And then try to test to see if the Usage report data can be collect
properly.

To the Performance Report mail question, the Monitoring and Reporting
wizard is designed mainly for remote management for Administrator, it is
sent to specified recipients in e-mail and we can not save it to hard disk.
And the report only provide brief summary for the server health and give us
a notification about some important performance points.

I appreciate your time. I am happy to be assistance of you and look forward
to your reply!

Have a nice day!

Sincerely,

<ePc5kug5...@tk2msftngp13.phx.gbl>
<9WTdxWr5...@TK2MSFTNGXA02.phx.gbl>

>Subject: Re: Performance Monitoring Events

>Date: Fri, 11 Nov 2005 08:26:56 -0600
>Lines: 1229

>X-Priority: 3
>X-MSMail-Priority: Normal
>X-Newsreader: Microsoft Outlook Express 6.00.2900.2670
>X-RFC2646: Format=Flowed; Original
>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670

>Message-ID: <ObFm5vs5...@TK2MSFTNGP10.phx.gbl>

>Newsgroups: microsoft.public.windows.server.sbs
>NNTP-Posting-Host: 64-45-168-10.client.cypresscom.net 64.45.168.10

>Path: TK2MSFTNGXA02.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP10.phx.gbl
>Xref: TK2MSFTNGXA02.phx.gbl microsoft.public.windows.server.sbs:221323
>X-Tomcat-NG: microsoft.public.windows.server.sbs

[Robert Zahm]

Jenny,

We actually reinstalled SBS on this box a few months ago, and we noticed
this problem under both installations, so I am not hopeful that reinstalling
these components will help. Is there any way for me to save the performance
report to a file, and then I could write a script to email it to myself? Is
there any other way to debug the usage report problems?

Thanks,

Rob

""Jenny wu [MSFT]"" <v-ya...@online.microsoft.com> wrote in message

news:SRVQoqQ6...@TK2MSFTNGXA02.phx.gbl...

[Robert Zahm]

Jenny,

Sorry, I didn't see the part of your post regarding the saving of the
Performance report to a file, sorry for asking twice! Guess it was worth a
shot...

Thanks,

Rob

"Robert Zahm" <rob...@hotmail.com> wrote in message

news:OqBfXOS6...@TK2MSFTNGP12.phx.gbl...

[Jenny wu [MSFT]]

Hi Robert,

Thanks for your update!

For your description, I understand that when you attempt to view the usage
report, the info 'No usage data is available for this time period'
displayed. And you got 5603 warning event.

You have confirmed that nevertheless you choose 'Modify existing settings'
or 'Reinstall monitoring features' to view performance report, after you
wait for 24 hours, you still can not get the performance usage report.

Let us perform the following test to see if the issue be fixed:

I. First, please click Start -> Run, type Services.msc, check if the
following service is running and configured to startup type as Automatical:
MSSQL$SBSMONITORING
SQLAgent$SBSMONITORING

If the services are startup, I suggest you do the following:

1. Control Panel -> Add Remove Program -> Windows Small Business Server
2003. Set Server Tools to Maintenance. Set Monitoring to Uninstall
2. Control Panel -> Add Remove Program -> SBSMONITORING -> Remove
3. Delete C:\program files\Microsoft SQL Server\MSSQL$SBSMONITORING Folder
4. Reboot
5. Control Panel -> Add Remove Program -> Windows Small Business Server
2003. Set Server Tools to Maintenance. Set Monitoring to Install
6. Reboot
7. Start MSSQL$SBSMONITORING and SQLAgent$SBSMONITORING
8. In Server Mangement Console -> Monitoring and Reporting: run the Set Up
Monitoring Reports and Alerts wizard again to see how everything is going.

*Note: The SBS reporting utility needs to collect usage data for more than
24 hours so that the report can be generated. So please perform test 24
hours later.

II. If the issue still exists, and you still got error "No usage data is
available for this time period". After I researched the issue, I think that
the problem should be lies in corrupted monitoring database instance or
components. So I suggest you perform a clean reinstall the Monitor
component to make anything well.

I suggest you follow my suggestions in my previous post to reinstall the
component, and wait for 24 hours and then try to view the report again,
tell me the result.

And only I have confirmed the monitor component is installed well, I can do
a further anlayze for you. Please cooperate me to work with the issue. I
appreciate your time.

If the issue still exists, please help me collect the following files for
further research:
a. The SBSMSI-Monitoring.log, eventlog.txt and errorlog.txt in the
C:\Program Files\Microsoft Integration\Windows Small Business Server
2003\Logs directory.

b. The MSDE_SBSMonitoring.log file in the C:\Program Files\Microsoft
Windows Small Business Server\Support\MSDE_SBSMonitoring.log

To the Performance Report mail question, the Monitoring and Reporting
wizard is designed mainly for remote management for Administrator, it is
sent to specified recipients in e-mail and we can not save it to hard disk

directly. And the report only provide brief summary for the server health
and give us a notification about some important performance points. Can't
you send the report to internal user account?

I appreciate your time and patient to the issue. I am happy to be
assistance of you and look forward to your update.

Have a nice day!

Sincerely,

--------------------

>From: "Robert Zahm" <rob...@hotmail.com>
>References: <#qyuepL1...@TK2MSFTNGP14.phx.gbl>
<lQCWvET1...@TK2MSFTNGXA01.phx.gbl>
<#AeMJf02...@tk2msftngp13.phx.gbl>
<kYpCc662...@TK2MSFTNGXA01.phx.gbl>
<uVxhda92...@TK2MSFTNGP09.phx.gbl>
<#8Kr0Y$2FHA...@TK2MSFTNGP10.phx.gbl>
<0pTXoyh3...@TK2MSFTNGXA01.phx.gbl>
<OQ6zCfW5...@TK2MSFTNGP10.phx.gbl>
<u8D1TiW5...@TK2MSFTNGP09.phx.gbl>
<OH$7SEX5F...@TK2MSFTNGP14.phx.gbl>
<lFmz#Sf5FH...@TK2MSFTNGXA02.phx.gbl>
<ePc5kug5...@tk2msftngp13.phx.gbl>
<9WTdxWr5...@TK2MSFTNGXA02.phx.gbl>

<ObFm5vs5...@TK2MSFTNGP10.phx.gbl>
<SRVQoqQ6...@TK2MSFTNGXA02.phx.gbl>
<OqBfXOS6...@TK2MSFTNGP12.phx.gbl>

>Subject: Re: Performance Monitoring Events

>Date: Mon, 14 Nov 2005 11:16:58 -0600
>Lines: 1548

>X-Priority: 3
>X-MSMail-Priority: Normal
>X-Newsreader: Microsoft Outlook Express 6.00.2900.2670
>X-RFC2646: Format=Flowed; Response
>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670

>Message-ID: <OWp358T6...@tk2msftngp13.phx.gbl>

>Newsgroups: microsoft.public.windows.server.sbs
>NNTP-Posting-Host: 64-45-168-10.client.cypresscom.net 64.45.168.10
>Path: TK2MSFTNGXA02.phx.gbl!TK2MSFTNGP08.phx.gbl!tk2msftngp13.phx.gbl

>Xref: TK2MSFTNGXA02.phx.gbl microsoft.public.windows.server.sbs:222106