Windows Event ID 6144 – Kernel-General: System Performance Counter Collection Started

Start by examining the complete event details to understand the context and timing.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → System
3. Filter the log by clicking Filter Current Log in the Actions pane
4. Enter 6144 in the Event IDs field and click OK
5. Double-click on recent Event ID 6144 entries to view detailed information
6. Check the General tab for event description and the Details tab for XML data
7. Note the timestamp and correlate with system startup times or monitoring tool activity

Use PowerShell to query multiple events efficiently:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=6144} -MaxEvents 20 | Format-Table TimeCreated, Id, LevelDisplayName, Message -AutoSize

Verify that performance monitoring services are running correctly and investigate any service-related issues.

1. Open Services console by pressing Win + R, typing services.msc, and pressing Enter
2. Locate and check the status of these key services:
   • Performance Logs and Alerts (pla)
   • Windows Management Instrumentation (winmgmt)
   • Performance Counter DLL Host (PerfHost)
3. Right-click each service and select Properties to verify startup type
4. Check the Dependencies tab to understand service relationships

Use PowerShell to check service status programmatically:

Get-Service -Name "pla", "winmgmt", "PerfHost" | Format-Table Name, Status, StartType, DisplayName -AutoSize

Restart performance-related services if needed:

Restart-Service -Name "pla" -Force
Restart-Service -Name "PerfHost" -Force

Identify which applications or services are triggering performance counter collection to understand the event context.

1. Open Task Manager by pressing Ctrl + Shift + Esc
2. Click the Details tab and look for processes that commonly use performance counters:
   • perfmon.exe (Performance Monitor)
   • logman.exe (Performance Logs utility)
   • powershell.exe or pwsh.exe (if running Get-Counter commands)
   • Third-party monitoring agents
3. Check the Services tab for monitoring-related services
4. Use Resource Monitor (resmon.exe) to see detailed process activity

Query running processes that might access performance counters:

Get-Process | Where-Object {$_.ProcessName -match "perfmon|logman|nagios|scom|zabbix"} | Format-Table ProcessName, Id, StartTime, CPU -AutoSize

Check for scheduled tasks that might trigger monitoring:

Get-ScheduledTask | Where-Object {$_.TaskName -match "perf|monitor|counter"} | Format-Table TaskName, State, LastRunTime -AutoSize

Examine the Windows registry to verify performance counter configuration and identify potential issues.

1. Open Registry Editor by pressing Win + R, typing regedit, and pressing Enter
2. Navigate to HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib
3. Check the Last Counter and Last Help values to verify counter database integrity
4. Examine HKLM\SYSTEM\CurrentControlSet\Services for performance counter providers
5. Look for services with Performance subkeys that indicate counter providers

Use PowerShell to check performance counter configuration:

# Check performance counter database integrity
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib" -Name "Last Counter", "Last Help"

Rebuild performance counters if corruption is detected:

# Run as Administrator
lodctr /R
# Restart performance counter services
Restart-Service -Name "pla", "PerfHost" -Force

Implement comprehensive monitoring to track Event ID 6144 patterns and correlate with system performance.

1. Create a custom Event Viewer view for performance-related events
2. In Event Viewer, right-click Custom Views and select Create Custom View
3. Set up filters for Event IDs: 6144, 6145, 6146 (performance counter events)
4. Include additional sources: Kernel-General, Performance Logs and Alerts
5. Save the view as "Performance Counter Monitoring"

Set up automated monitoring with PowerShell:

# Create a monitoring script for Event ID 6144
$FilterHashtable = @{
    LogName = 'System'
    Id = 6144
    StartTime = (Get-Date).AddHours(-24)
}

$Events = Get-WinEvent -FilterHashtable $FilterHashtable -ErrorAction SilentlyContinue

if ($Events) {
    Write-Host "Found $($Events.Count) Event ID 6144 occurrences in the last 24 hours"
    $Events | Format-Table TimeCreated, Id, LevelDisplayName -AutoSize
} else {
    Write-Host "No Event ID 6144 found in the last 24 hours"
}

Create a scheduled task for continuous monitoring:

# Register a scheduled task to monitor performance counter events
$Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\Monitor-PerfCounters.ps1"
$Trigger = New-ScheduledTaskTrigger -Daily -At "09:00AM"
$Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries
Register-ScheduledTask -TaskName "Monitor Performance Counters" -Action $Action -Trigger $Trigger -Settings $Settings