'Category does not exist' error when viewing IIS Worker Processes in IIS Manager

I ran into an interesting problem recently when using the new Worker Processes feature in the Internet Information Services (IIS) Manager for IIS 7.0. The Worker Processes feature is a great addition to IIS, and it's used to view practical information about the worker processes that are currently in use on your system; for example: the names of application pools that are associated with worker processes, worker process PIDs, CPU and byte usage statistics, etc.

So it's understandable that I was a little taken aback when I double-clicked the feature recently and I was greeted with an error dialog that stated "There was an error while performing this operation. Details: Category does not exist."

The last time that I saw that error dialog was a couple of years ago during the early days of the Windows Server 2008 beta when some of the IIS features had not been fully-written, so I emailed Carlos Aguilar Mares like I always do when I have a question about why I think something in the UI isn't behaving as expected. Carlos asked me to take a look at the performance counters on my server, and it was missing the "Process" counters. Armed with this knowledge, Carlos put me in touch with Matt E. and Wedson F. here at Microsoft, and the two of them worked with me to troubleshoot what was going on.

First of all, Matt had me take a look in the Windows Application log for any events with "Perflib" as the source, and I found the following two events:

Event #1

Log Name:	Application
Source:	Microsoft-Windows-Perflib
Date:	9/28/2008 5:19:26 PM
Event ID:	1010
Task Category:	None
Level:	Error
Keywords:	Classic
User:	N/A
Computer:	webserver.domain.local
Description:	The Collect Procedure for the "PerfProc" service in DLL "C:\Windows\system32\perfproc.dll" generated an exception or returned an invalid status. The performance data returned by the counter DLL will not be returned in the Perf Data Block. The first four bytes (DWORD) of the Data section contains the exception code or status code.
Binary Data:	050000C0

Event #2

Log Name:	Application
Source:	Microsoft-Windows-Perflib
Date:	9/28/2008 5:19:27 PM
Event ID:	1017
Task Category:	None
Level:	Error
Keywords:	Classic
User:	N/A
Computer:	webserver.domain.local
Description:	Disabled performance counter data collection from the "PerfProc" service because the performance counter library for that service has generated one or more errors. The errors that forced this action have been written to the application event log. Correct the errors before enabling the performance counters for this service.

The binary data ("050000C0") for the first error was obviously the HRESULT for an access violation in little-endian format (e.g. "0xC0000005"), and the second error explained why my counters were missing - something went wrong at some point and Windows disabled the process performance counters. Wedson had me run the following command:

lodctr /q:PerfProc

Which returned the following output:

Performance Counter ID Queries [PERFLIB]:
    Base Index: 0x00000737 (1847)
    Last Counter Text ID: 0x00001E86 (7814)
    Last Help Text ID: 0x00001E87 (7815)

[PerfProc] Performance Counters (Disabled)
    DLL Name: perfproc.dll
    Open Procedure: OpenSysProcessObject
    Collect Procedure: CollectSysProcessObjectData
    Close Procedure: CloseSysProcessObject

This showed that the PerfProc performance counters were disabled, and to remedy the problem I just needed to run the following command:

lodctr /e:PerfProc

After running this command, my process performance counters showed up in the Windows Performance Monitor and the IIS Worker Processes feature started working again.

Parting Thoughts and Such

Matt sent me a recap email later explaining that the crux of the problem was that the provider for the "Process" performance counter had been disabled on my server because that performance counter's collect procedure had caused an access violation ("0xC0000005") at some point in the past; this is usually due to some other performance counter misbehaving and corrupting the memory heap. In a general situation, checking the event viewer for errors with "Perflib" as the source will let you know if something has caused an error, and you can use "lodctr /q:<provider name>" to query the status of a provider or "lodctr /e:<provider name>" to enable a provider. In this particular situation, after the "PerfProc" provider was re-enabled the Worker Processes feature in IIS Manager resumed working.

My thanks to Carlos, Matt, and Wedson for all the help. ;-]