HDS triggers WMI Performance "checking"

[Tsiidu]

This is a long story (I've been hunting down this problem for months (on/off)), but I'll try to keep it short as possible. First I would like to say that I don't have much knowledge of Microsoft WMI performance stuff, so I probably use wrong terms when I describe this problem (I had problems conveying a meaningful/correct topic subject).

The problem started about mid-May when I saw the following 2 errors in my windows event viewer (date/time differs, otherwise exactly the same errors):

Code: Select all

Event Type:	Error
Event Source:	PerfNet
Event Category:	None
Event ID:	2004
Date:		11.7.2011
Time:		11:39:54
User:		N/A
Computer:	***
Description:
Unable to open the Server service. Server performance data will not be returned. Error code returned is in data DWORD 0.

Code: Select all

Event Type:	Error
Event Source:	WmiAdapter
Event Category:	None
Event ID:	4099
Date:		11.7.2011
Time:		11:39:54
User:		***\***
Computer:	***
Description:
Open of service failed.

I have "Server" and "WmiAdapter" services disabled. No problems what so ever so far.. running system for many years.

After many twists and turns, I stumbled into this Microsoft page: http://www.microsoft.com/technet/suppor ... WmiAdapter

It has the following script that reveals if there are high performance counter objects in WMI:

Code: Select all

' Find all performance classes
computer = "."
namespace = "root\wmi"

Set WMISvc = GetObject("winmgmts:\\" & computer & "\" & namespace)
Set colSWbemObjectSet = WMISvc.Subclassesof("Win32_Perf")
for each cls in colSwbemObjectSet
   wscript.echo "Class name: " & cls.path_
next

(Save it as "somename.vbs" file and run it from cmd line console: cscript somename.vbs)

My PC shows the following after running the script (machine name obscured):

Code: Select all

Class name: \\***\ROOT\wmi:Win32_PerfRawData
Class name: \\***\ROOT\wmi:VirtualMachineStatistics
Class name: \\***\ROOT\wmi:VirtualProcessorStatistics
Class name: \\***\ROOT\wmi:Win32_PerfFormattedData

The above MS page tells that: "If Win32_PerfRaw and Win32_PerfFormattedData are the only subclasses, then there are no high-performance objects in WMI."

Next I figured out that the 2 high-performance objects "VirtualMachineStatistics" and "VirtualProcessorStatistics" belonged to installed Microsoft Virtual PC (I've version 2007 SP1 (v6.0.192.0)).

Then I wondered what was changed in mid-May that started these event errors. I haven't upgraded MS Virtual PC for a long time.. finally I noticed that HD Sentinel had a 3.60 update at the beginning of May (I probably updated to that next weekend, which is about mid-May).

These errors recur every time when HDS "reloads" HD's (e.g. when systray icons "refresh" (vanish & reappear)). E.g. when attaching an USB HD or removing it. Or when computer comes out of hibernate (and possibly from sleep state). (When booting Windows normally, this doesn't happen!)

Next I downgraded HDS to 3.50 (installed over 3.60), and the event errors did not appear anymore!

BOTTOM LINE: There was something changed in HDS 3.60 that now "triggers" an WMI Performance counter high-performance object "checking" (I really can't figure out what to call it, hopefully you understand).

Requirements to reproduce the problem:
1) HD Sentinel 3.60
2) "Server" and "WmiAdapter" services disabled.
3) High-performance objects in WMI (e.g. installing Microsoft Virtual PC 2007 SP1 (v6.0.192.0))
4) Hibernate or attach/remove USB HD.


Was the change necessary in HDS 3.60? I really wouldn't like to A) uninstall MS VPC, B) enable server service, C) see my event viewer/log spammed with the error events, nor D) downgrade HDS and not receive any upgrades anymore.

[hdsentinel]

Hi,

Thanks for the information and your attention.
However, I do not really feel it is a bug.
If some parts of the OS (the mentioned services) are disabled and Windows tries to manage the associated objects (the performance counters in this case), something is "broken" and the events are logged. I'd call this is normal.

Can you please tell me the reason why do you prefer to have the "Server" and "WmiAdapter" services disabled?

I can confirm that yes, there is a change in Hard Disk Sentinel 3.60 (compared to 3.50), exactly as you wrote:
when the software detects the change of configuration (for example upon inserting or removal of an external drive) it issues a

PdhEnumObjects( ..... , true)

function to refresh the object cache (list of performance objects).
( http://msdn.microsoft.com/en-us/library ... s.85).aspx )

This is used to make sure that Hard Disk Sentinel reads all (possible) disk performance objects after the change of the configuration. Otherwise, only limited information would be available, which would result that for example the "Disk Performance" page would be empty for the newly connected device(s).
(you can compare, Hard Disk Sentinel 3.50 does not show real-time performance information for newly inserted drives but 3.60 will do so if the performance objects and function of WIndows are both working correctly).

Was this change necessary?
No, it is just an improved functionality.
If you prefer, there could be a method (option) to disable using this function (so there should be no such issues in the future versions as then it would work exactly as 3.50 in this field).

Just please let me know why disabling the services (some parts of the OS) is necessary

[Tsiidu]

I do not really feel it is a bug.

Hence I used "problem" word.. though I acknowledge that this post is in the "bug" forum.

Was this change necessary?
No, it is just an improved functionality.

Ok. Sometimes programs change and introduce behavior that isn't directly implied and could be corrected by a work-around or revising the code. This clearly is not the case here, the change/behavior is intended.

If you want to add an option to disable this, then by all means do it, I don't care much about the disc performance tab.. at least not constantly.

Just please let me know why disabling the services (some parts of the OS) is necessary

You got to be kidding, right? Shortly: A) less stuff in memory/running in background, and more importantly, B) Closing SEVERAL attack vectors.

If you know what you're doing, you can disable LOTS of services and run Windows perfectly fine (and faster/safer).

Thanks for the fast replies (to this and to the other topic)!

[hdsentinel]

Yes I see
Of course, I understand that it is good idea to disable some features of the OS to make it faster and/or more reliable, just sometimes disabling functions may cause harmful effects (for example some software may not run correctly or at all).

Maybe this is not the case and I completely understand that if you do not want some functionality, you can any time disable it.