Best Practices - Windows Agent
Overview
In situations where FireScope agents installed on Windows systems fail to return the expected data, the following procedures can be used to restore functionality.
Symptoms
- Agent is restarting over and over again.
- Agent fails to start.
Solution
This might be due to the Performance Counter, which might be either disabled or corrupted. Enabling or rebuilding the Performance Counters on the affected systems will solve the problem. You can check this by running a query ( lodctr /q ) command you will be able to find out whether the Performance Counter is disabled or corrupted. The following is an example of disabled Performance Counter.
- lodctr /q
[PerfOS] Performance Counters (Disabled)
DLL Name: %SystemRoot%\System32\perfos.dll
Open Procedure: OpenOSObject
Collect Procedure: CollectOSObjectData
Close Procedure: CloseOSObject
- If Performance counter is disabled execute the command lodctr /e:PerfOS to enable it.
- If the Performance Counter is corrupted, rebuilding it will solve the problem. To rebuild, execute the command lodctr /R. For Windows Server 2008 64bit or Windows Server 2008 R2 or Windows 2012 systems you have to manually rebuild the Performance Counter. Please visit the link below for more information
https://support.microsoft.com/en-us/help/2554336/how-to-manually-rebuild-performance-counters-for-windows-server-2008-64bit-or-windows-server-2008-r2-systems