System Monitor: Perflib_Perfdata_*.dat

[Guest]

Every time I reboot the above captioned files change their names ever so
slightly: ie: Perflib_Perfdata_0d.dat or Perflib_Perfdata_a0.dat , etc. These
files appear in Windows\temp and Documents and Settings\Local|temp. I have
been told that these files are created by System Monitor. They may be created
because of an improper shut down of a program or may be Orphaned Files left
by the System Monitor. In safe mode they can be deleted but, immediately
return when system is restarted normally. I can not open the files. I would
appreciate any asistance you may offer that will rid me of these annoying
files. Thanks in Advance for your assistance. Chefbigfeet

 

[Wesley Vogel]

Disable the Performance Logs and Alerts service.

smlogsvc.exe = Performance Logs and Alerts Service

Programs such as EasyCleaner can create Perflib_Perfdataxxx.dat files.

Here's more than you may want to know.

Perflib stands for Performance Library. Perfdata stands for Performance
Data.

The %SystemRoot%\System32\Perflib_Perfdataxxx.dat files are created by the
System Monitor. And/or
%userprofile%\Local Settings\Temp\Perflib_Perfdataxxx.dat.
or
C:\Documents and Settings\Your Name Here\Local
Settings\Temp\Perflib_Perfdataxxx.dat. When you shutdown normally, the file
should be deleted.

If you have an abormal shutdown, these files can become orphaned, and
accumulate on your computer.

Under some yet to be determined circumstances, these files can become
orphaned during normal operation.

The Windows Performance tool is composed of two parts: System Monitor and
Performance Logs and Alerts. With System Monitor, you can collect and view
real-time data about memory, disk, processor, network, and other activity in
graph, histogram, or report form.

To open Performance...
Start | Run | Type: perfmon.msc | Click OK

You can view this by opening the Task Manager. The Performance tab displays
a dynamic overview of your computer's performance, such as CPU and various
kinds of memory usage.

Also caused by:
Rundll32.exe advapi32.dll,ProcessIdleTasks
Event ID: 1000
Event Source: LoadPerf

Perflib_Perfdataxxx.dat Files Accumulate Under %SystemRoot%\System32
http://support.microsoft.com/default.aspx?scid=kb;en-us;285798

What are the %SystemRoot%\System32\Perflib_Perfdataxxx.dat files?
http://www.jsiinc.com/SUBG/TIP3300/rh3343.htm

-----

prflbmsg.dll = Perflib Event Messages

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM
Logging Directory
Value Type: REG_SZ
C:\WINDOWS\system32\WBEM\Logs\

Repository Directory
Value Type: REG_EXPAND_SZ
%SystemRoot%\system32\WBEM\Repository

Working Directory
Value Type: REG_EXPAND_SZ
%SystemRoot%\system32\WBEM

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib
---

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
Perflib

Description
The Perflib subkey stores configuration data for the Windows Performance
Library, which collects and organizes data for performance tools, such as
System Monitor.

In addition to entries, the Perflib subkey contains a Language-code subkey
for each spoken language you configure for Windows 2000. The Language-code
subkey stores performance counter names and their descriptions in the
specified language. The Language-code subkey is named for the language code
for that language. For example, the counters and descriptions for the
English language are stored in a subkey named 009, the language code for
English (United States).
---

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\
Application Sources
REG_MULTI_SZ
Perflib

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\
Application\Perflib
EventMessageFile
Value Type: REG_EXPAND_SZ
%SystemRoot%\System32\prflbmsg.dll

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\
Application Sources
REG_MULTI_SZ
Perflib

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\
Application\Perflib
EventMessageFile
Value Type: REG_EXPAND_SZ
%SystemRoot%\System32\prflbmsg.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\
Application Sources
REG_MULTI_SZ
Perflib

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\
Application\Perflib
EventMessageFile
Value Type: REG_EXPAND_SZ
%SystemRoot%\System32\prflbmsg.dll

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Guest]

Thank You very much for the information. I disabled Performance Logs and
Alerts Service on the Control Panel, but the files still remain and I still
can not delete them except in Safe Mode, but, the return again on Normal
Startup. When I try to open them they say that the file is in use. Please
close any programs using the file aand delete. I tried to "Run" smlogsvc.exe
but, nothing happens. Any other suggestions would greatly be appreciated.
Looking forward to your assitance. Regards, Chefbigfeet

 

[Wesley Vogel]

This may have nothing to do with anything, but see if you have a trace.log
in

C:\WINDOWS\System32\LogFiles\WMI\

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Guest]

Good Evening, Wesley: Thank yiou for your continuing assistance with this
problem. I did a search of the Registry and found the following: Name: 000
Type: Reg_SZ Data: trace.log. Now that I have found this item, what shall I
do with it. Please assist me in this situation. Regards and Thanks for be
there for Us, Chefbigfeet

 

[Wesley Vogel]

I meant, do you actually have a trace.log on your machine?

Where in the registry?

To copy a registry key name
1. In the registry tree (on the left), right click a registry key.
2. Select Copy Key Name.
3. Paste the name of the registry key into another program or document.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Guest]

Good Evening Wesley:
I went back to the Registry and search for the trace.log again but, this
time it was not found. I did not do any thing to remove it. What should I do
now? Thanks again for the continued assistance, it is greatly appreciated.
Regards, Chefbigfeet

 

[Guest]

Good Evening to all:
I had hoped that I would hear more about correcting my issue with the
Perflib_Perfdata_*dat files for I am still troubled by there continued
presents. Wesley has been very helpful but, the issue still remains. If
anyone has any other course of action to take in this matter, please assist
me. Your valued input would greatly be appreciated. Chefbigfeet

 

[frodo]

don't worry about them! they're temp files and not that big. Most likely
you have installed a new app recently that uses the .NET framework; this
framework opens up some performance counters by default. depending on
your configuration you will get these temp files, as well as the
occasional entry in the Event Log, some just informational and some Red-X
Errors; don't worry about them, they're not "real" errors.

You can control the performance counters w/ a tool called the "Extensible
Performance Counter Lister"; google for it. HOWEVER, using it to turn off
counters may simply increase the number of errors accumlating in the
event log; again, they're not "real" errors and can be ignored, but these
may bother you more than the temp files!

BTW, there are HUNDREDS of these performance counters scattered throughout
the XP OS, and the overhead they inflict is very small - don't worry about
them!