Windows Eveng Log Event ID 2017 occurs when using windows_exporter.

[tanaka-takayoshi]

When using windows_exporter as a part of our software, Windows Event Logs are generated frequently. I wonder this problem is caused by windows_exporter since it happens only when windows_exporter is enabled.

Here is an environment where I confirmed the problem.

• AWS Region: ap-northeast-1 (Tokyo)
• AMI: ami-0ef36caf57299116f（Windows_Server-2022-Japanese-Full-Base-2023.09.13）
• Instance Type: t3.medium
• storage: only the default root volume（gp2/30GiB）
• VPC: default VPC
• subnet: public subnet
• Security Group: only RDP for inbound, all allowed for outbound

Here is an event log detail.

レベル 日付と時刻   ソース イベント ID タスクのカテゴリ
警告(WARN)    2023/10/29 7:18:09  Microsoft-Windows-PerfOS    2017    なし  NUMA の物理メモリの使用率データを収集できません。データ セクションの最初の 4 バイト (DWORD) に、状態コードが含まれています。

The event description can be translated as follows.

Unable to collect NUMA physical memory utilization data. The first four bytes (DWORD) of the Data section contains the status code.

It happens twice in three days in my environment. However, it happens five times in an hour in another environment which our customer owns. The problem is that frequent occurrences reduce the searchability of the event log.

We found the following workaround but it didn't solve this problem.

https://community.spiceworks.com/topic/1163346-event-2017-perfos#entry-6271939

C:\Windows\system32> lodctr /r
Error: Unable to rebuild performance counter setting from system backup store, error code is 2

C:\Windows\system32> lodctr /r
Info: Successfully rebuilt performance counter setting from system backup store

[breed808]

What collectors are enabled when this error message is raised? The only NUMA references I can see in the code base are in the hyperv collector.

[github-actions[bot]]

This issue has been marked as stale because it has been open for 90 days with no activity. This thread will be automatically closed in 30 days if no further activity occurs.