Application Log Keeps Filling up - in SECs!

[SepMan76]

Help!

I do not know W2K Server well enough to diagnosis this problem. I keep getting a message that the Application Log is full and must be cleared. When cleared, the log fills up within minutes. A Comma-delimited file of the log can be viewed/downloaded at:

http://63.162.201.105/temp/app_log_full.csv

It has something to do with "perflib"... I don't know what that is. Any help is appriciated. Thank you!

Chris

 

[Jpoandl]

To get rid of the APP Log is FULL message, configure your event viewer to OVERWITE EVENTS AS NEEDED.

Open Event Viewer: Right Click on Application log and then click properties. Towards the middle of the screen you will see the option to OVERWRITE EVENTS AS NEEDED. This will resolve that event log full message from popping up.

The error itself seems to be related to Perfmon.

http://support.microsoft.com/support/kb/articles/Q163/7/27.asp

Are you running performance monitor?

http://support.microsoft.com/support/kb/articles/Q174/6/90.ASP

Could have something to do with Compaq Insight Managment agents? See this:

http://support.microsoft.com/support/kb/articles/Q186/7/13.ASP

Definately check out Technet.com for more information. There seems to be a ton of information on this.
Joseph L. Poandl
MCSE 2000

 

[MIShandled]

I had the same problem. W2000 loves to log. The "OVERWRITE AS NEEDED" fix above worked for me. When you do this, make sure your log file size is big enough so that you can see information as far back as you want. Also, make sure you set this on each log.

 

[SepMan76]

OK... the OVERWRITE EVENTS AS NEEDED keeps the error message from coming up, but I would like to diagnosis and fix the problem. The Error that keeps building up is:

Event Type: Error
Event Source: Perflib
Event Category: None
Event ID: 1008
Date: 8/22/2001
Time: 12:46:39 PM
User: N/A
Computer: GSERVER
Description:
The Open Procedure for service "Nbf" in DLL "C:\WINNT\system32\perfctrs.dll" failed. Performance data for this service will not be available. Status code returned is data DWORD 0.
Data:
0000: 02 00 00 00 ....


Can I turn of logging for this or is there someway to fix it?

 

[Jpoandl]

Your better off fixing the error. What services are running on this server (Exchange/proxy/DHCP/etc)?

Are you running Compaq Insight MAnager on this server?


The NBF part of this event viewer error refers to NetBeui. If you don't need NETBEUI, uninstall it. It's probably causing extra network traffic anyway. Use TCP/IP.

Also, all of the technet article say to re-install the service pack or update to the latest service pack if possible. I think you should re-install your service pack. This is a safe thing to do and may get rid of the error.


If the above doesn't work, try this:

It's probably possible to turn of logging of this error. Check this out:

http://support.microsoft.com/support/kb/articles/Q226/4/94.ASP

http://support.microsoft.com/support/kb/articles/Q247/2/26.ASP

Joseph L. Poandl
MCSE 2000

 

[jahlmer]

I say install the latest service pack, and if that doesn't help use the fix from the following article.

http://support.microsoft.com/support/kb/articles/Q259/2/41.ASP

 

[SepMan76]

I uninstalled NETBEUI and re-installed SP2... problem fixed!

Thanks all!

 

[Jpoandl]

sweet Joseph L. Poandl
MCSE 2000