Welcome to ISAserver.org

Logs go BLANK - logging to SQL2005, no alerts, no events

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [ISA 2006 Firewall] >> Logging and Reporting >> Logs go BLANK - logging to SQL2005, no alerts, no events

Page: [1]

Message

<< Older Topic Newer Topic >>

Logs go BLANK - logging to SQL2005, no alerts, no events - 28.Apr.2008 11:51:44 AM

jenwilson

Posts: 4
Joined: 31.Jan.2008
Status: offline

Hi,

we have a 2 server ISA 2006 Enterprise array running on Windows Server 2003.

Logging both Web Proxy and Firewall logs to a seperate SQL Server 2005.

Works fine except when we run a scheduled deletion job (non locking) on the SQL 2005 db to remove an hours worth of data that is older than 21 days - this job runs at 15 mins past the hour, every hour.

Perhaps once a day (tends to be at 13:15 which is when we think we have the heaviest traffic/logging) we see people losing connectivity to web servers and also our NAGIOS server monitor (monitoring servers behind the Firewall) goes red. This lasts for approx 30 to 90 secs.

When we look at the logs on the Firewall we see a big gap with NO logs for this period (normally we would have 1000's or tens of 1000's).

When we look at the SQL 2005 server we also see a big gap with NO logs for this period.

There are no alerts generated on the Firewall or SQL Server 2005 and no events logged on the system or application event logs on either the Firewall or the SQL 2005 server.

We have run the ISA Diagnostics during this period and it looks fine - shows packets being correctly matched and allowed etc.

The Log Failure alerts on the Firewall have been changed so that they don't stop the Firewall service so the Firewall should carry on if there is a Logging Failure.

The Firewall shows no issues re: Performance ie memory and CPU stay within normal parameters.

Appears to be a weird issue between the Firewall and the SQL 2005 server.

Anybody have any ideas or seen this one before?

Regards,

Jen.