Bluescreen When Remotely Monitoring MBS Server with Perfmon

ID: Q189656

The information in this article applies to:

SYMPTOMS

A server running Windows NT 4.0 Service Pack 3 and the Microsoft Commercial Internet System (MCIS) 1.0 Membership Broker or Agent services may bluescreen with a Stop 0xc0000021a when it is remotely monitored with the performance monitor application.

One of the following errors will be logged in the event log:

The buffer size returned by a collect procedure in Extensible Counter DLL "siccntrs.dll" for the "msnlogon" service was larger than the space available. Performance data returned by counter DLL will not be returned in Perf Data Block. Overflow size is data DWORD 0.
-or-
The buffer size returned by a collect procedure in Extensible Counter DLL "siccntrs.dll" for the "SicServ" service was larger than the space available. Performance data returned by counter DLL will not be returned in Perf Data Block. Overflow size is data DWORD 0.


CAUSE

The Siccntrs.dll performance monitor counter DLL was incorrectly checking a buffer size provided by Winlogon. As a result, Siccntrs.dll writes additional data outside of the buffer, which causes Winlogon to crash and Windows NT to ultimately bluescreen with a Stop 0xc0000021a.

See the Microsoft Knowledge Base article Q173060, "Performance Monitor Counters Cause Stop or Error Messages" for more information on why changes in Windows NT Service Pack 3 can cause this to occur.


RESOLUTION

Obtain the following fix or wait for the next Microsoft Commercial Internet System Service pack.

The hotfix should be version 7753 and the following timestamp: 


07/16/98  02:51p                25,872 siccntrs.dll (Alpha)

07/16/98  02:51p                20,416 siccntrs.dll (Intel)


STATUS

Microsoft has confirmed this to be a problem in Microsoft Commercial Internet System version 1.0 A supported fix is now available, but has not been fully regression-tested and should be applied only to systems experiencing this specific problem. Unless you are severely impacted by this specific problem, Microsoft recommends that you wait for the next Service Pack that contains this fix. Contact Microsoft Technical Support for more information.

Additional query words: 


Keywords          : 
Version           : WINNT:1.0
Platform          : winnt 
Issue type        : kbbug

Last Reviewed: July 20, 1999