[German]Occasionally, users of Windows Clients and Windows Server notice an accumulation of error entries in the Event Viewer that seem to indicate a specific problem. An error with the ID 2001 is permanently reported in the Event Viewer. The error text states that "First Counter" in "usbperf\Performance" cannot be read. This indicates that the service "usbhub" has a problem calling it. After the bug came to my attention some time ago, I am preparing the issue as a blog post.
Advertising
A report at Facebook
I first came across this Windows error in a German Windows Server Facebook group. An administrator reported the error for a Windows Server 2012 R2 virtualized with VMware and asked for a workaround.
Solution for Eventlog error? ?
on VMware virtual server 2012R2 with error ID 2001 usbperf (The value of "First Counter" under the key "usbperf\Performance" cannot be read. Status codes were returned in the data).
There is no USB controller in the virt. Machines (get-childitem -recurse *.ini | Select-String -pattern "usbperf" -context 0 => also nothing found). Test installed USB controller, but also no improvement
lodctr /r and lodctr /d:usbperf incl. reboot WITHOUT success
anyone have an idea how to get rid of the event "stuffing"?
The administrator had still posted the above screenshot of an entry in the event viewer. A special feature mentioned in the above post is the use of a virtual machine for the Windows Server installation. Provided the VM is hosted under Hyper-V, there is no USB port available by default. In the above example, this scenario does not apply either, as VMware was used for virtualization. Therefore, uninstalling the USB controller did not help either. While the event entries are only a "cosmetic issue", they do flood the log files in question.
The error occurs frequently
The error occurs very frequently under Windows, as an Internet search revealed (here is an entry from 2012 on Windows 7), and points to an error in the handling of performance indicators. The lodctr ommand mentioned above can be run on Windows Server and allows registering or saving performance indicator names and registry settings to a file, as well as setting trusted services.
- The /r option restores the counter registration settings and explanatory text from the current registry settings and cached performance files related to the registry (see also this Microsoft post).
- The /d:usbperf option can be used to disable the service specified after the switch (usbperf in this case). The system then omits the performance check of the USB ports.
Both commands did not help in this case. The /d switch is not even documented in the Microsoft document linked above – but I found descriptions here, here, and here. An English post lists a number of event entries that can occur through the Performance Counter service.
Advertising
In this very old post about Windows 7, there is a hint to set the "feature search resource publishing" service to automatic. It is also suggested to perform a system file check with sfc /scannow in an administrative command prompt. This rules out a corrupted Windows as the cause, but should help in the rarest of cases.
Registry entries are missing
I had given the affected administrator the hint to check the registry entries. Microsoft has documented the keys in question in the article Manually rebuild performance counter library values. The affected person told me that these values were correct. I had then suggested in a reply to try to solve the problem by importing the key in question as per this Technet forum post. With that I was close to the solution. There the key was:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\usbhub\Performance
from another machine and the error was gone. The only thing that was stupid was that the wrong key was mentioned in the forum post. Because the feedback of the person concerned was namely:
the counters are missing in the CurrentControlSet and not in ControlSet001. Restart services and rest
The affected person then posted the above screenshot with his registry values under the following key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usbhub\Performance
This is the entry used by the affected services while running. The administrator concerned then advised me that the following commands should be executed:
New-ItemProperty -path "HKLM:\SYSTEM\CurrentControlSet\Services\usbhub\Performance" -name "First Counter" -PropertyType DWORD -value 4564 New-ItemProperty -path "HKLM:\SYSTEM\CurrentControlSet\Services\usbhub\Performance" -name "Last Counter" -PropertyType DWORD -value 4598 New-ItemProperty -path "HKLM:\SYSTEM\CurrentControlSet\Services\usbhub\Performance" -name "First Help" -PropertyType DWORD -value 4565 New-ItemProperty -path "HKLM:\SYSTEM\CurrentControlSet\Services\usbhub\Performance" -name "Last Help" -PropertyType DWORD -value 4599 Get-Service -Name "pla" | Restart-Service -Verbose Get-Service -Name "winmgmt" | Restart-Service -Force -Verbose
Maybe the above information will help those affected.
Having spent hours on this topic the solution was indeed that "the counters are missing in the CurrentControlSet and not in ControlSet001" Once the commands were executed and services re-started the issue was resolved! Many thanks for this post.
Spent a lot of time to search how to repair this error.
Your powershell script worked fine for me
Thank you very much
Man, this is very helpful! Thank you for your time and effort! Alternatively, if anyone needs, here is the CMD command lines for Windows to add the absent register entries:
REG add "HKLM\SYSTEM\CurrentControlSet\Services\usbhub\Performance" /v "First Counter" /t REG_DWORD /d 4564 /f
REG add "HKLM\SYSTEM\CurrentControlSet\Services\usbhub\Performance" /v "Last Counter" /t REG_DWORD /d 4598 /f
REG add "HKLM\SYSTEM\CurrentControlSet\Services\usbhub\Performance" /v "First Help" /t REG_DWORD /d 4565 /f
REG add "HKLM\SYSTEM\CurrentControlSet\Services\usbhub\Performance" /v "Last Help" /t REG_DWORD /d 4599 /f