I have an repeatable issue on several Windows servers where I have started using performance monitor counters. The servers in question are a running a mix of Windows 2003 and Windows 2008 R2. I am primarily using the Windows Server 2003-2012 Services and Counters template and the Windows Disk I/O template.
When a server first starts up, I am able to obtain values for all counters without any issues. However, at a somewhat random interval the application monitor starts showing the state as Unknown, and the component monitors return the error "Performance counter not found. HResult: The specified object is not found on the system." The only fix I have been able to find is to restart the Remote Registry service on the affected server, after which the component monitors return to an Up state, and I am able to retrieve the performance stats. But, invariably, it will eventually happen again.
If I use the component monitor wizard to browse the available performance counters on a system while it is in this state, the majority of categories show up as empty (i.e. Processor, Memory, Disk, etc.). However, some application counters are still available (i.e. HTTP Service, IPSec driver, Terminal Services, etc.). Again, restarting the Remote Registry service on the affected server does fix the problem for a random amount of time. Some servers have the issue more frequently than others. The affected servers have a wide-variety of application loads, from SQL Server to domain controllers to Java application servers. I see the problem on both physical and virtual servers. About the only consistent item would be that all the systems do run McAfee VirusScan Enterprise v8.8. However, the McAfee agent and logs do now show any violations.
I have temporarily created an alert to monitor this situation, and restart the Remote Registry service when the the application monitor is in an "Unknown" state for more than 15 minutes. But it is definitely a work around.
This appears to be a Windows issue, related to RPC communications, rather than a SAM issue. I just wondered if anyone has run into this and discovered the source of the problem, or have any suggestion.