Perflib_Perfdata_***.dat
in [Windows XP Basics]
|
Prev: TrayApp
Next: chkdsk failure
From: Wesley Vogel on 3 Mar 2006 10:22 Here's more than you may want to know. Perflib stands for Performance library. Perfdata stands for Performance Data. The %SystemRoot%\System32\Perflib_Perfdataxxx.dat files are created by the System Monitor. And/or %userprofile%\Local Settings\Temp\Perflib_Perfdataxxx.dat. or C:\Documents and Settings\Your Name Here\Local Settings\Temp\Perflib_Perfdataxxx.dat. When you shutdown normally, the file should be deleted. If you have an abormal shutdown, these files can become orphaned, and accumulate on your computer. Under some yet to be determined circumstances, these files can become orphaned during normal operation. The Windows Performance tool is composed of two parts: System Monitor and Performance Logs and Alerts. With System Monitor, you can collect and view real-time data about memory, disk, processor, network, and other activity in graph, histogram, or report form. To open Performance... Start | Run | Type: perfmon.msc | OK You can view this by opening the Task Manager. The Performance tab displays a dynamic overview of your computer's performance, such as CPU and various kinds of memory usage. Also caused by: Rundll32.exe advapi32.dll,ProcessIdleTasks Event ID: 1000 Event Source: LoadPerf Perflib_Perfdataxxx.dat Files Accumulate Under %SystemRoot%\System32 http://support.microsoft.com/default.aspx?scid=kb;en-us;285798 What are the %SystemRoot%\System32\Perflib_Perfdataxxx.dat files? http://www.jsiinc.com/SUBG/TIP3300/rh3343.htm ----- prflbmsg.dll = Perflib Event Messages HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM Logging Directory Value Type: REG_SZ C:\WINDOWS\system32\WBEM\Logs\ Repository Directory Value Type: REG_EXPAND_SZ %SystemRoot%\system32\WBEM\Repository Working Directory Value Type: REG_EXPAND_SZ %SystemRoot%\system32\WBEM HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib --- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion Perflib Description The Perflib subkey stores configuration data for the Windows Performance Library, which collects and organizes data for performance tools, such as System Monitor. In addition to entries, the Perflib subkey contains a Language-code subkey for each spoken language you configure for Windows 2000. The Language-code subkey stores performance counter names and their descriptions in the specified language. The Language-code subkey is named for the language code for that language. For example, the counters and descriptions for the English language are stored in a subkey named 009, the language code for English (United States). --- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\ Application Sources REG_MULTI_SZ Perflib HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\ Application\Perflib EventMessageFile Value Type: REG_EXPAND_SZ %SystemRoot%\System32\prflbmsg.dll HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\ Application Sources REG_MULTI_SZ Perflib HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\ Application\Perflib EventMessageFile Value Type: REG_EXPAND_SZ %SystemRoot%\System32\prflbmsg.dll HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\ Application Sources REG_MULTI_SZ Perflib HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\ Application\Perflib EventMessageFile Value Type: REG_EXPAND_SZ %SystemRoot%\System32\prflbmsg.dll -- Hope this helps. Let us know. Wes MS-MVP Windows Shell/User In news:FBD89967-8428-411C-A8AC-2330F9F3DD2F(a)microsoft.com, Milt <Milt(a)discussions.microsoft.com> hunted and pecked: > I don't have SNMP installed so that wasn't it. I did find out by the > process of elimination that if I disable the Norton Ghost 10 tray icon in > MSConfig/Startup the files are no longer generated. So while I still don't > know why they're there, I do know how to stop them. And I didn't want the > Ghost icon in my "Notification Area" anyhow. Thanks for your responses. > > Milt > > "Milt" wrote: > >> I periodically have files, "Perflib_Perfdata_***.dat" show up in my Temp. >> folder. (The *** are dynamic; they change with date and time.) They >> resist being deleted. I have not tried deleting them in Safe Mode, >> though. I'm not sure what they are and if there's any reason to leave >> them. Can anyone please tell me what they are, and if it's OK to go into >> Safe Mode and try to delete them? >> >> Thanks, >> Milt
From: Milt on 3 Mar 2006 11:03 Thanks Wes. I did want to know what they were and where they come from. Milt "Wesley Vogel" wrote: > Here's more than you may want to know. > > Perflib stands for Performance library. Perfdata stands for Performance > Data. > > The %SystemRoot%\System32\Perflib_Perfdataxxx.dat files are created by the > System Monitor. And/or > %userprofile%\Local Settings\Temp\Perflib_Perfdataxxx.dat. > or > C:\Documents and Settings\Your Name Here\Local > Settings\Temp\Perflib_Perfdataxxx.dat. When you shutdown normally, the file > should be deleted. > > If you have an abormal shutdown, these files can become orphaned, and > accumulate on your computer. > > Under some yet to be determined circumstances, these files can become > orphaned during normal operation. > > The Windows Performance tool is composed of two parts: System Monitor and > Performance Logs and Alerts. With System Monitor, you can collect and view > real-time data about memory, disk, processor, network, and other activity in > graph, histogram, or report form. > > To open Performance... > Start | Run | Type: perfmon.msc | OK > > You can view this by opening the Task Manager. The Performance tab displays > a dynamic overview of your computer's performance, such as CPU and various > kinds of memory usage. > > Also caused by: > Rundll32.exe advapi32.dll,ProcessIdleTasks > Event ID: 1000 > Event Source: LoadPerf > > Perflib_Perfdataxxx.dat Files Accumulate Under %SystemRoot%\System32 > http://support.microsoft.com/default.aspx?scid=kb;en-us;285798 > > What are the %SystemRoot%\System32\Perflib_Perfdataxxx.dat files? > http://www.jsiinc.com/SUBG/TIP3300/rh3343.htm > > ----- > > prflbmsg.dll = Perflib Event Messages > > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM > Logging Directory > Value Type: REG_SZ > C:\WINDOWS\system32\WBEM\Logs\ > > Repository Directory > Value Type: REG_EXPAND_SZ > %SystemRoot%\system32\WBEM\Repository > > Working Directory > Value Type: REG_EXPAND_SZ > %SystemRoot%\system32\WBEM > > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib > > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib > --- > > HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion > Perflib > > Description > The Perflib subkey stores configuration data for the Windows Performance > Library, which collects and organizes data for performance tools, such as > System Monitor. > > In addition to entries, the Perflib subkey contains a Language-code subkey > for each spoken language you configure for Windows 2000. The Language-code > subkey stores performance counter names and their descriptions in the > specified language. The Language-code subkey is named for the language code > for that language. For example, the counters and descriptions for the > English language are stored in a subkey named 009, the language code for > English (United States). > --- > > HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\ > Application Sources > REG_MULTI_SZ > Perflib > > HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\ > Application\Perflib > EventMessageFile > Value Type: REG_EXPAND_SZ > %SystemRoot%\System32\prflbmsg.dll > > HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\ > Application Sources > REG_MULTI_SZ > Perflib > > HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\ > Application\Perflib > EventMessageFile > Value Type: REG_EXPAND_SZ > %SystemRoot%\System32\prflbmsg.dll > > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\ > Application Sources > REG_MULTI_SZ > Perflib > > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\ > Application\Perflib > EventMessageFile > Value Type: REG_EXPAND_SZ > %SystemRoot%\System32\prflbmsg.dll > > -- > Hope this helps. Let us know. > > Wes > MS-MVP Windows Shell/User > > In news:FBD89967-8428-411C-A8AC-2330F9F3DD2F(a)microsoft.com, > Milt <Milt(a)discussions.microsoft.com> hunted and pecked: > > I don't have SNMP installed so that wasn't it. I did find out by the > > process of elimination that if I disable the Norton Ghost 10 tray icon in > > MSConfig/Startup the files are no longer generated. So while I still don't > > know why they're there, I do know how to stop them. And I didn't want the > > Ghost icon in my "Notification Area" anyhow. Thanks for your responses. > > > > Milt > > > > "Milt" wrote: > > > >> I periodically have files, "Perflib_Perfdata_***.dat" show up in my Temp. > >> folder. (The *** are dynamic; they change with date and time.) They > >> resist being deleted. I have not tried deleting them in Safe Mode, > >> though. I'm not sure what they are and if there's any reason to leave > >> them. Can anyone please tell me what they are, and if it's OK to go into > >> Safe Mode and try to delete them? > >> > >> Thanks, > >> Milt > >
From: PopS on 3 Mar 2006 12:38 Many programs generate those; they're sort of scratch pads and data that might be wanted, to try to speed things up. You should be able to delete any tha aren't in use, which would be the ones prior to the last time you restarted the machine, so always start with the oldest ones. They're supposed to be deleted automatically but often things keep that from happening (crashes, power glitches, improper shut downs, etc.). If you can't delete old ones, then there is some sort of a problem. Going to Safe Mode might help delete some of them, but they'll be regenerated on an as needed basis. "Milt" <Milt(a)discussions.microsoft.com> wrote in message news:150DD379-E149-46F0-A18C-44A4310666C7(a)microsoft.com... >I periodically have files, "Perflib_Perfdata_***.dat" show up in >my Temp. > folder. (The *** are dynamic; they change with date and time.) > They resist > being deleted. I have not tried deleting them in Safe Mode, > though. I'm not > sure what they are and if there's any reason to leave them. Can > anyone please > tell me what they are, and if it's OK to go into Safe Mode and > try to delete > them? > > Thanks, > Milt
From: Wesley Vogel on 5 Mar 2006 11:50
Keep having fun. :-) -- Hope this helps. Let us know. Wes MS-MVP Windows Shell/User In news:8B4D1D9C-9047-4EE5-A56F-F068AF1BD00F(a)microsoft.com, Milt <Milt(a)discussions.microsoft.com> hunted and pecked: > Thanks Wes. I did want to know what they were and where they come from. > > Milt > > "Wesley Vogel" wrote: > >> Here's more than you may want to know. >> >> Perflib stands for Performance library. Perfdata stands for Performance >> Data. >> >> The %SystemRoot%\System32\Perflib_Perfdataxxx.dat files are created by >> the System Monitor. And/or >> %userprofile%\Local Settings\Temp\Perflib_Perfdataxxx.dat. >> or >> C:\Documents and Settings\Your Name Here\Local >> Settings\Temp\Perflib_Perfdataxxx.dat. When you shutdown normally, the >> file should be deleted. >> >> If you have an abormal shutdown, these files can become orphaned, and >> accumulate on your computer. >> >> Under some yet to be determined circumstances, these files can become >> orphaned during normal operation. >> >> The Windows Performance tool is composed of two parts: System Monitor and >> Performance Logs and Alerts. With System Monitor, you can collect and >> view real-time data about memory, disk, processor, network, and other >> activity in graph, histogram, or report form. >> >> To open Performance... >> Start | Run | Type: perfmon.msc | OK >> >> You can view this by opening the Task Manager. The Performance tab >> displays a dynamic overview of your computer's performance, such as CPU >> and various kinds of memory usage. >> >> Also caused by: >> Rundll32.exe advapi32.dll,ProcessIdleTasks >> Event ID: 1000 >> Event Source: LoadPerf >> >> Perflib_Perfdataxxx.dat Files Accumulate Under %SystemRoot%\System32 >> http://support.microsoft.com/default.aspx?scid=kb;en-us;285798 >> >> What are the %SystemRoot%\System32\Perflib_Perfdataxxx.dat files? >> http://www.jsiinc.com/SUBG/TIP3300/rh3343.htm >> >> ----- >> >> prflbmsg.dll = Perflib Event Messages >> >> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM >> Logging Directory >> Value Type: REG_SZ >> C:\WINDOWS\system32\WBEM\Logs\ >> >> Repository Directory >> Value Type: REG_EXPAND_SZ >> %SystemRoot%\system32\WBEM\Repository >> >> Working Directory >> Value Type: REG_EXPAND_SZ >> %SystemRoot%\system32\WBEM >> >> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib >> >> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib >> --- >> >> HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion >> Perflib >> >> Description >> The Perflib subkey stores configuration data for the Windows Performance >> Library, which collects and organizes data for performance tools, such as >> System Monitor. >> >> In addition to entries, the Perflib subkey contains a Language-code >> subkey for each spoken language you configure for Windows 2000. The >> Language-code subkey stores performance counter names and their >> descriptions in the specified language. The Language-code subkey is >> named for the language code for that language. For example, the counters >> and descriptions for the English language are stored in a subkey named >> 009, the language code for English (United States). >> --- >> >> HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\ >> Application Sources >> REG_MULTI_SZ >> Perflib >> >> HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\ >> Application\Perflib >> EventMessageFile >> Value Type: REG_EXPAND_SZ >> %SystemRoot%\System32\prflbmsg.dll >> >> HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\ >> Application Sources >> REG_MULTI_SZ >> Perflib >> >> HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\ >> Application\Perflib >> EventMessageFile >> Value Type: REG_EXPAND_SZ >> %SystemRoot%\System32\prflbmsg.dll >> >> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\ >> Application Sources >> REG_MULTI_SZ >> Perflib >> >> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\ >> Application\Perflib >> EventMessageFile >> Value Type: REG_EXPAND_SZ >> %SystemRoot%\System32\prflbmsg.dll >> >> -- >> Hope this helps. Let us know. >> >> Wes >> MS-MVP Windows Shell/User >> >> In news:FBD89967-8428-411C-A8AC-2330F9F3DD2F(a)microsoft.com, >> Milt <Milt(a)discussions.microsoft.com> hunted and pecked: >>> I don't have SNMP installed so that wasn't it. I did find out by the >>> process of elimination that if I disable the Norton Ghost 10 tray icon >>> in MSConfig/Startup the files are no longer generated. So while I still >>> don't know why they're there, I do know how to stop them. And I didn't >>> want the Ghost icon in my "Notification Area" anyhow. Thanks for your >>> responses. >>> >>> Milt >>> >>> "Milt" wrote: >>> >>>> I periodically have files, "Perflib_Perfdata_***.dat" show up in my >>>> Temp. folder. (The *** are dynamic; they change with date and time.) >>>> They resist being deleted. I have not tried deleting them in Safe Mode, >>>> though. I'm not sure what they are and if there's any reason to leave >>>> them. Can anyone please tell me what they are, and if it's OK to go >>>> into Safe Mode and try to delete them? >>>> >>>> Thanks, >>>> Milt |