VMWare 6.0 Event Log Errors

[RogerWilson]

This morning I needed to check something in my event log on my laptop and discovered that the VMWare Workstation 6.0 vmauthd service was excessively logging the following error to my event log:

Log Name: Application

Source: vmauthd

Event ID: 100

Level: Error

Message: Malformed perfmon object, index=5

Upon reviewing several of these errors the only thing that changes is the index. Based upon a VMWare Forum suggestion, http://www.vmware.com/community/message.jspa?messageID=3063 I checked out the performance counters. Although the article points to different services, I did observe that the PolicyAgent counters were disabled. I re-enabled them only to find a new error in the event log:

Log Name: Application

Source: Perflib

Event ID: 1005

Level: Error

Message: Unable to locate the open procedure "OpenIPSecPerformanceData" in DLL "C:\Windows\System32\ipsecsvc.dll" for the "PolicyAgent" service. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

Param1: OpenIPSecPerformanceData

Param2: C:\Windows\System32\ipsecsvc.dll

Param3: PolicyAgent

Data Size: 4

Data: 7F000000

At this point, I'm stumped. I verified that the ipsecsvc.dll is the same DLL on another similar Windows Vista system (which does not exhibit this problem). I wouldn't mind this so much, but VMWare Workstation is logging the first error repeatedly every couple of seconds, making my Application Event log useless.

[mclevenger]

I'm getting these errors error as well

[NO_FEAR]

It appears that VMware is logging windows errors as well. From m knowledge an IPSec Service error can be found on windows XP computers. Your windows Xp operating system has this process locked by Isass.exe. In other words, for security windows tries to prevent anything VMware included from accessing this dll. Don’t try to remove any process using the dll, you will wreck windows (usually). Normally one could solve IP Security Service problem by going to Event Viewer->Security and then:

“For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp (this is supposed to be a hyperlink that sends data about your problem to Microsoft).”

Good luck though.

[SteDon81]

has anyone already found a working solution for this problem? Also my application event log is flooded by these "Malformed perfmon object" messages.

How can I avoid this issue effectively?

Regards,

Stefan D.

[ranish]

I also have this annoying problem. Vista Home Premium x64.

VMWare please give us indications on how to fix it.

[SteDon81]

Hi,

to evade this annoying error, today I uninstalled VMWare. After having a better oversight over my Application log again, I noticed, that also MS SQLServer logs some errors with performance indicators that cannot be found.

Unfortunately, I do not have the install CD of VMWare at hand and I can only reinstall today evening. But in the meantime I report here what I discovered and tried, such that perhaps others can try if this solves the "malformed perfmon" problem:

1) I discovered, that the service for Performance Indicators (don't know the name in english, in german it's "Leistungsprotokolle und -warnungen") was not running. So I started it manually.

2) Once started, this service reported errors in Application log, that it cannot find any string tables for the performance indicators (event id 3006).

3) Unbelievable, but true: A click on help brought me to the hint of Microsoft to rebuild the string tables.

4) Type in a command prompt (the shell has to be started with elevated rights!) "Lodctr /r" (see http://www.microsoft.com/technet/support/ee/transform.aspx?ProdName=Windows%20Operating%20System&Pro...

5) After a restart, the service for performance indicators was running without errors in the log and also the MS SQLServer didn't log these errors anymore.

Now it woult be interesting, if this also could cure the problem with VMWare Workstation.

Regards,

Stefan D.

[SteDon81]

Wow, I think I've got it!

Yesterday I reinstalled VMWare and now no "malformed perfmon object" error messages appear in the log!

I won't count on it, but I suppose that the major tasks to solve the problem are:

1) Start the "Performance Indicator" service (e.g. by setting its starting type to Automatic)

2) rebuild the perfmon database (as described in my previous post)

I hope this helps other people as well!

Regards,

Stefan D.

[ranish]

Great SteDon81!!!

Your suggestion definitely works!

In Italian the service name is 'Avvisi e Registri di prestazioni'.

Thank your very much for stopping this annoying problem!

[SteDon81]

ranish,

thank you for your response. I'm glad that I could help at least one that experienced this problem, too!

Now have as much fun with VMWare 6 as I do

[jbb23]

Once I did the above I also had to restart the VMWare Auth Service to get the errors to stop but that seems to have done it.

Thanks,

Jase

[ddrake4]

I had this same issue with VMWare 7 on Windows 7 64bit host.

The fix worked I had to set two services to Automatic: 'Performance Logs & Alerts' and 'Performance Counter DLL Host', then fix the strings and reboot.