My blog moved to http://techibee.com

Subject says it all. Since last couple of months I have been doing blogging in my new blog(http://www.techibee.com/). I have some strong supporting reasons to move to another blog. I request all my readers to subscribe to new blog either through EMAIL or through RSS reader to stay tuned with my updates. Believe, I have been posting some serious powershell and GPOs related stuff in my new blog and will definately help my niche.

Happy Learning..,
Sitaram Pamarthi

Unable to start Counter logs in Perfmon

Sometimes you might see error like below while starting "Counter logs" tasks from perfmon and additionally you will see Event ID 2003 with source "Sysmonlog" in Application Event viewer and Event ID 7024 with source "Service Control Manager" in System event viewer.

 

The test1 log or alert has not started. Refresh the log or alert list to view current status, or see the application event log for any errors.  Some logs and alerts might require a few minutes to start,  especially if they include many counters or they contain counters to be collected from a remote system that is no longer on the network. For further information see the troubleshooting section in the online help.

If the above mentioned symptoms matches your problem, then it can be fixed by following the below steps.

 

• Open regedit and navigate to "HKLM\MACHINE\SYSTEM\CurrentControlSet\Services\SysmonLog\Log Queries" registry key and go to permissions 
• Grant full permissions to "Network Service" and propagate them to child objects.
• Now try to start your counter log job; it should start now without any issues.

 

Hope this helps you...

 

Happy Learning...,
Sitaram Pamarthi

 

Tags: problems with perfmon, unable to start counter logs, Error starting counter logs

Good bye NewSID

When I was with my old organization, we used to deploy operating system with the help of Ghost -- an imaging technique. So, after completing the imaging process, we used to run newsid.exe to make the new installation unique in environment.

But surprisingly, the author of newsid has taken a decision to retire that decade old utility. Believe me, it is no more available at any MS websites. MS suggesting it's customers to user sysprep instead of newsid as sysprep does lot more things which newsid will not.

You can refer to below URL to know reasons behind it's retirement.

http://blogs.technet.com/markrussinovich/archive/2009/11/03/3291024.aspx

 Happy Learning..,

Sitaram Pamarthi