Event ID 1013

[beckas]

Has anyone seen this NT Event Viewer error before? It just happened on one of my Exchange servers. I'm thinking that it may have been caused by Network Associates GroupShield or NetShield.

Event ID: 1013
Source: Perflib
Type: Error
Category: None

The collect procedure in Extensible Counter DLL "GSPerf.dll" for the "AVExch32Service" service returned a buffer that was larger than the space allocated and may have corrupted the application's heap. This DLL should be disabled or removed from the system until the problem has been corrected to prevent further corruption. The application accessing this performance data should be restarted. The Performance data returned by counter DLL will be not be returned in Perf Data Block. Overflow size is data DWORD 0.

 

[mtoto]

Dear Beckas
Many problems encountered with Microsoft products are presented with solutions at support.microsoft.com.

 

[beckas]

Thank you but I already searched support.microsoft.com on this topic and I did not find any information.

 

[beckas]

I called NAI support and I was told that this error is related to the Network Associates GroupShield product. The Exchange performance monitor service is having some sort of problem reading the GroupShield service. This suddenly appeared after we installed Symantec ITA. I was told that fix to this problem relates to going into the registry and changing a key or two.

 

[ChrisHirst]

The GSPerf.dll and AVExch32Service are a bit of a giveaway to the source of the problem. Did you check the NAI Knowledge base?. This is the nearest solution I can find.

SolutionID: 1.0.14526446.2706559

actually relates to event id 1008 but you may get some pointers from here.

Chris