Log Dejargonizer

Windows Application Log · Event 1008

Event 1008: A performance counter set failed to load

Windows tried to collect performance counters from a component and the component's counter library would not open. Nothing that the component actually does is affected — only the numbers about it. The real error code is not in the message; it is in the event's binary data, which is why this one is so often given up on.

Also written as Perflib 1008Event ID 1008 perflib

What it means for you

On a personal computer

This is Windows failing to read a statistic, not failing to do a job. Whatever service is named in the message is still running normally — Windows just cannot report numbers about it in Task Manager or Performance Monitor. On a home PC there is nothing to fix and nothing at risk.

For an analyst

Matters exactly as much as your monitoring depends on it. A broken counter set breaks the corresponding Win32_PerfFormattedData WMI classes too, so agents that collect through WMI lose the same metrics and often report the host as unhealthy for the wrong reason. Rebuild counters with lodctr /R rather than chasing individual DLLs.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
Log Name:      Application
Source:        Microsoft-Windows-Perflib
Event ID:      1008
Level:         Error
Computer:      APP-SRV-02

The Open Procedure for service "BITS" in DLL "C:\Windows\System32\bitsperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

The fields that decide it

Everything else in the log line is context.

Service name
Which counter set failed. Named by service short name — BITS, WmiApRpl, TermService and the ASP.NET counters are the recurring ones.
DLL path
The performance counter library Windows tried to load. If the file is not there, the counter set was left registered by software that has been uninstalled.
Data section
The part the message tells you about and then does not show you. The first four bytes of the event's binary Data are the Win32 error code, little-endian — read them in the Details tab under the XML or binary view. 02 00 00 00 is error 2, file not found, which is the usual answer.
Repetition
Perflib retries on a schedule, so one broken counter set produces a steady trickle rather than a single entry. The count tells you nothing extra.

Ordinary reasons this happens

Most of the time it is one of these.

  • Software uninstalled without deregistering its performance counters, leaving a registry entry pointing at a DLL that no longer exists.
  • A corrupted performance counter registry hive, which typically breaks several counter sets at once.
  • A 32-bit counter library on a 64-bit system where only one of the two counter registries was updated.
  • A Windows feature or role removed while its counters stayed registered.
  • An in-place upgrade or a servicing operation that left the counter definitions inconsistent.

When it is not ordinary

A performance counter DLL registration pointing at an unexpected binary, which Windows loads into a collecting process.

What gives it awayThe DLL path in the event is not under a vendor directory, or names a file that no product on the machine owns. Perflib DLLs load inside whatever process is collecting counters, which is what makes the registration worth reading.

ATT&CK T1574.001

What to do next

  1. Decide whether you actually collect the named counters. If nothing monitors them, this event costs you nothing and does not need fixing.
  2. Read the real error code from the event's binary data — first four bytes, little-endian. Error 2 (file not found) and error 5 (access denied) cover almost every case and point at different fixes.
  3. Check whether the DLL in the message exists. If it does not, the counter set belongs to software that has been removed.
  4. If several different services are named, do not chase them individually — rebuild the counters: `lodctr /R` from an elevated prompt, then `lodctr /R` from C:\Windows\SysWOW64 on 64-bit systems, then `winmgmt.exe /RESYNCPERF`, then reboot.
  5. Confirm the rebuild worked by checking that the counters return: `Get-Counter -ListSet <name>` for the service that was failing.
  6. If the DLL path looks unfamiliar or lives outside a program's own install directory, treat the registration itself as the finding rather than repairing it.

Queries to run

powershell 1020 and 1023 are the sibling failures. Pulling all three shows whether one counter set is broken or the whole subsystem is. 
Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='Microsoft-Windows-Perflib'; Id=1008,1020,1023} -MaxEvents 50 | Select-Object TimeCreated, Id, Message
powershell What is actually available now. Compare against what you expect to be collecting. 
Get-Counter -ListSet * | Select-Object CounterSetName | Sort-Object CounterSetName
powershell Lists every registered performance counter library and its state, including disabled ones. The fastest way to find a registration pointing at a DLL that is gone. 
lodctr /Q
powershell A quick check that the WMI performance classes still work, since they break alongside the counters and are what most monitoring agents actually read. 
Get-CimInstance Win32_PerfFormattedData_PerfOS_System | Select-Object ProcessorQueueLength, SystemUpTime

Common questions

Is Perflib Event 1008 a real problem?

Only for monitoring. The service named in the event keeps running normally; what fails is Windows' ability to publish performance counters about it. If you use Performance Monitor, a monitoring agent, or anything reading Win32_PerfFormattedData classes, those specific metrics will be missing. If you do not, there is nothing to fix.

How do I read the error code in Event 1008?

The message tells you the code is in the first four bytes of the Data section but does not display it. Open the event, switch to the Details tab, and read the binary data — the four bytes are the Win32 error code in little-endian order, so 02 00 00 00 is error 2, 'the system cannot find the file specified', and 05 00 00 00 is error 5, access denied. Error 2 means the DLL in the message is not on disk.

How do I fix broken performance counters in Windows?

Rebuild them. From an elevated command prompt run `lodctr /R`, then run `lodctr /R` again from C:\Windows\SysWOW64 on a 64-bit system, then `winmgmt.exe /RESYNCPERF` to resynchronise the WMI performance classes, then restart. This rebuilds the counter registry from the definitions Windows and installed products supply, which fixes the whole class of Perflib errors rather than one entry at a time.

Why does Event 1008 keep naming BITS?

Because the Background Intelligent Transfer Service ships a counter library that is frequently left in an inconsistent state by servicing operations, and it is one of the counter sets Windows tries to open most often. It is the most commonly reported instance of this event and it is not specific to BITS — the same fix applies whatever service is named.

Read next

Vendor documentation

Last reviewed 7 September 2026