Welcome to ISAserver.org
Forums |
Register |
Login |
My Profile |
Inbox |
RSS 
|
My Subscription |
My Forums |
Address Book |
Member List |
Search |
FAQ |
Ticket List |
Log Out
Firewall Service shutdown with Event ID 5
|
Users viewing this topic:
none
|
Logged in as: Guest
|
Login  | |
|
Firewall Service shutdown with Event ID 5 - 1.Mar.2007 2:08:43 PM
|
|
|
ABCPL
Posts: 13
Joined: 21.Nov.2006
Status: offline
|
Hello all!
I just installed ISA 2006 a few days ago and today, the Microsoft Firewall service choked and I had to restart it manually.
The error messages were:
Source: Microsoft ISA Server Web Proxy
Event ID: 5
Information for the ISA server Web filter log could not be logged to the text file ISALOG_20070301_WEB_000.iis in the path c:\Program Files\Microsoft ISA Server\ISALogs. Error code:
Then there is an informational event stating that the Firewall service was stopped gracefully.
This is a W2K3 server with the latest SP and Hotfixes and nothing else running on it except the defaults that Windows Server 2003 and ISA install. No backups or 3rd party apps or AV. I don't think it's a HD issue, this is a brand new server configured in RAID 1 and there are no disk events and a CHKDSK showed no problems. The server has a moderate traffic on it on average about 160MB of logs per day.
I switched back to MSDE database logging for both logs.
Does anyone have any ideas what could be causing this?
Any help would be appreciated,
Paul
|
|
|
|
|
RE: Firewall Service shutdown with Event ID 5 - 2.Mar.2007 10:58:22 AM
|
|
|
tshinder
Posts: 47490
Joined: 10.Jan.2001
From: Texas
Status: offline
|
Hi Paul,
I've seen the same thing with MSDE logging. Let me know if it happens again and we'll move it up the food chain.
Thanks!
Tom
_____________________________
Thomas W Shinder, M.D.
Sr. Consultant/Technical Writer
Prowess Consulting http://www.prowessconsulting.com/
Blog: http://blogs.isaserver.org/shinder/
GET THE NEW ISA 2006 Book!: http://tinyurl.com/2gpoo8
|
|
|
|
|
RE: Firewall Service shutdown with Event ID 5 - 7.Mar.2007 10:00:43 AM
|
|
|
imboguss
Posts: 1
Joined: 20.Sep.2002
Status: offline
|
This has been happening to me 2 or 3 times a day for the last week or two!
No idea why it is happening.
|
|
|
|
|
RE: Firewall Service shutdown with Event ID 5 - 7.Mar.2007 5:04:29 PM
|
|
|
ABCPL
Posts: 13
Joined: 21.Nov.2006
Status: offline
|
Tom,
This happened to me twice, once on a test box and now on the production server.
the other thing that I did was to set the service to restart if it fails because both times, I just had to hit the play button to get everything running again.
I have not seen the error again on the production box but the database loggin sure is a pig for drive space usage.
Thank you,
Paul
|
|
|
|
|
RE: Firewall Service shutdown with Event ID 5 - 14.Mar.2007 11:55:41 PM
|
|
|
ibre34
Posts: 11
Joined: 10.Nov.2005
Status: offline
|
Hi
This happend to me today
It's happend only when I configure the Isa Server log format.
When I configure W3C log format all it's OK
The problem is I need the Isa Server format log for Webtrend analysis
I have 1 array, 2 ISA 2006 Ent boxes, NLB, CARP
I have heavy traffic. More than 1Gb log per day
Any ideas?
|
|
|
|
|
RE: Firewall Service shutdown with Event ID 5 - 19.Mar.2007 1:14:26 PM
|
|
|
ibre34
Posts: 11
Joined: 10.Nov.2005
Status: offline
|
Well.. I am going to call PSS
I'll let you know
Best regards
|
|
|
|
|
RE: Firewall Service shutdown with Event ID 5 - 26.Mar.2007 10:38:43 AM
|
|
|
ibre34
Posts: 11
Joined: 10.Nov.2005
Status: offline
|
Problem solved
Go to Configure Web Proxy Logging
Press tab Fields
Uncheck field "Referring Server"
Save changes
4 days without problems :)
|
|
|
|
|
RE: Firewall Service shutdown with Event ID 5 - 26.Mar.2007 11:52:45 AM
|
|
|
ibre34
Posts: 11
Joined: 10.Nov.2005
Status: offline
|
Yes, it's easy when you know it :)
It seems there is a problem with the defined lenght for the field. If the data is longer than the defined lenght ISA can not write the log and the the firewall service stops.
|
|
|
|
|
RE: Firewall Service shutdown with Event ID 5 - 30.Mar.2007 11:31:45 AM
|
|
|
cbuechler
Posts: 23
Joined: 20.Feb.2006
Status: offline
|
Having the same problem myself with the firewall service dying with Event ID 5. Using ISA logging format, ISA 2006 on Server 2003 R2 SP2. It's been dying a couple times a day since we moved over from ISA 2004. I just unchecked "Referring server" after finding this, will report back if this does or doesn't seem to fix it.
Thanks to ibre34 for posting this potential solution!
|
|
|
|
|
RE: Firewall Service shutdown with Event ID 5 - 30.Mar.2007 12:21:54 PM
|
|
|
ibre34
Posts: 11
Joined: 10.Nov.2005
Status: offline
|
I haven't had more problems since I unchecked "referring server"
|
|
|
|
|
RE: Firewall Service shutdown with Event ID 5 - 4.Apr.2007 1:09:22 PM
|
|
|
cbuechler
Posts: 23
Joined: 20.Feb.2006
Status: offline
|
Following up, this definitely fixed the problem for me as well.
|
|
|
|
|
RE: Firewall Service shutdown with Event ID 5 - 10.Apr.2007 8:42:53 AM
|
|
|
unstable
Posts: 2
Joined: 10.Apr.2007
Status: offline
|
I have almost a smiliar problem. The only difference that it is FWS log causing error. And there is no Referring Server field in it, so no easy solution for me. And what even worse, now Firewall Service refuses to restart manually. I tried to disable logging and restart FWS, but it kept coming up with an error in the event log that says something about CreateSharedMemory error during performance counters initialization (ID 11004).
< Message edited by unstable -- 10.Apr.2007 8:44:00 AM >
|
|
|
|
 New Messages |
 No New Messages |
 Hot Topic w/ New Messages |
 Hot Topic w/o New Messages |
 Locked w/ New Messages |
 Locked w/o New Messages |
|
 Post New Thread
Reply to Message
Post New Poll
Submit Vote
Delete My Own Post
Delete My Own Thread
Rate Posts |
|
Printable Version
