Perfmon Counter Fails to start.
A perfmon counter fails to start. A pop up window displays this message:
The KCTR$1155 log or alert has not started. Refresh the log or alert list to view current status, or see the application log for any errors. Some logs and alerts might require a few minutes to start, especially if they include many counters.
After trying to start the counter manually, you find this in the event log:
Event Type: Warning
Event Source: SysmonLog
Event Category: None
Event ID: 2004
The service was unable to open the log file d:\<workingDir>\KLogs\KLOG$1155.csv for log KCTR$1155 and will be stopped. Check the log folder for existence, spelling, permissions, and ensure that no other logs or applications are writing to this log file. You can reenter the log file name using the configuration program. This log will not be started. The error returned is: Unable to create the specified log file.
Monitor counters are "not responding". When you try to start the counter on the desktop using Perfmon.exe, it remains red and does not start.
This may be happening because performance logs and alert service is running as network service. Please change this to the "local system" account.
Why is this required?
Change the Performance Logs and Alerts service to run as the "local system" account.
6.3 (also applies to other versions)
VSA - All versions