Elastic Agent on windows Unhealthy : 1 error: initialization of reader failed: failed to expand counter (query='\Process(*)\% Processor Time'): The specified object was not found on the computer

[HansPeterSloot]

Hello all,

Just for the record.
One of my Agents (Windows Server) was unhealthy showing this message:
1 error: initialization of reader failed: failed to expand counter (query='\Process(*)% Processor Time'): The specified object was not found on the computer.

I found this performance counter

I compared the Unhealthy server with a healthy one

The command: lodctr /q showed a difference

[PerfProc] Performance Counters (Disabled)
instead of
[PerfProc] Performance Counters (Enabled)

This registry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfProc\Performance
had an entry

Close REG_SZ CloseSysProcessObject
Collect REG_SZ CollectSysProcessObjectData
Collect Supports Metadata REG_DWORD 0x1
Collect Timeout REG_DWORD 0x1f40
Library REG_EXPAND_SZ %SystemRoot%\System32\perfproc.dll
Object List REG_SZ 230 232 786 740 816 1408 1500 1548 1760
Open REG_SZ OpenSysProcessObject
Open Timeout REG_DWORD 0x2710
1014 REG_QWORD 0x1da1f6b3afea45f
**Disable Performance Counters REG_DWORD 0x1**

The other server did not have the last entry.
I set it to 0x0 instead of 0x1
That settled the issue.

[stephenb (Stephen Brown)]

Hi @HansPeterSloot

Thank you so much for posting this! I ran into this myself.

I will give it a try!

Funny I can not mark you as solution... if you add a quick post I can and show this as solved

[HansPeterSloot]

Super!
I just found it too important not to share.