5 Replies Latest reply on Sep 5, 2017 10:28 AM by olegas22

    Windows performance recorder: The system collector properties does not match with the internal state.

    olegas22

      Hello,

       

      The problem: we can’t stop "NT Kernel Logger" and we aren’t able to save data collected by Windows Performance Recorder; it generates "The system collector properties does not match with the internal state." error message when you attempt to save data.

       

      I have confirmed this problem on multiple corporate machines featuring Windows 7 SP1 x64 with McAfee Agent 5.0.5.658, McAfee Endpoint Security 10.5, McAfee DLP 10.0.250.92. For the record, we were able to use Windows Performance Recorder successfully in the past on the same machines, then something changed and broke the functionality. One of the changes was: a new version of McAfee was deployed to our machines.

       

      See this thread for more info about the steps to recreate and observed results, along with call stacks. I suspect McAfee is responsible for this behavior by restarting "NT Kernel logger" as WPR is starting its capture, which later causes WPR report the mismatch error.

       

      Is anyone else experiencing this problem?

      Am I on the right track?

       

      Unfortunately, I'm not able to stop, disable, uninstall or otherwise remove McAfee from the equation on target machine, as a troubleshooting step.

       

      Thank you