I'm experiencing some problems with my ISA 2006 Ent servers. After a while of operation the following message appears in the system log: "The size of the free non-paged pool fell below the system-defined minimum. ISA Server will reject new connections unless they are initiated by the ISA Server computer. In addition, the timeout for idle TCP connections was reduced. This alert may indicate an attack on the ISA Server computer. Use the log viewer to examine ISA Server traffic. This event may also be raised when the ISA Server computer does not have the resources needed to handle legitimate traffic. If this is the case, you may need to add more memory to the system." Event ID 21280.
The ISA server (FW) then seems unresponsive and the only way resolve this, as far as I've been able to figure out, is rebooting it.
Has anyone else experienced this?
Server: HP Proliant DL380G3 with 4Gb Ram, 2x 3.2Ghz Xeon, 2x 73Gb HD RAID1. Users: Approximately 4-600 Total and 2-300 Web Proxy connections.
From: Stockholm / Sweden
Hello, if you are running out of memory it could be the MSDE database that consumes all the memory, since the default settings for a SQL server is to use all it can get it's hands of. Use the Task manager to see if thats the problem, if thats the case you can limit to whats you like, but don't set it to low since that will stop the SQL from working as it should and you will end up with other problems instead.
Here is how you do it:
You will need to know the SQL instance name to use osql and this can be found in the Services list. In my case, the service was named MSSQL$MSFW and MSFW is the instance name.
Two scripts are shown below, one to check your server's max memory setting, and one to change the value.
To view the memory on your server, copy the following commands to a text file (eg. c:\checkmemory.sql):
USE master EXEC sp_configure 'show advanced options', 1 RECONFIGURE WITH OVERRIDE
USE master EXEC sp_configure 'max server memory (MB)'
USE master EXEC sp_configure 'show advanced options', 0 RECONFIGURE WITH OVERRIDE
You can now check the 'max server memory' setting on your server by running the following from a command prompt on the server:
Thank you very much for your response. This unfortunately not what causes the problem. I've already limited the memory usage for the MSDE database to 512Mb. But I'm sure these scripts comes in handy for other users.
It looks like the servers runs out of available sockets, not memory.
I'm curious if you have any success in resolving this problem. We are experiencing the exact same problem. I haven't been able to find much information about this specific error, but I did find this one Microsoft KB article for ISA 2000 that looks related.
The article points to problems that may occur when "the link between ISA and the Web server that hosts the content is faster than the link between ISA and the internal client that sends the request." This may be our problem as our users are frequently accessing a web site that we host locally. I'm not sure if their is a fix for ISA 2006, though. There is also a reference to tuning non-paged pool size in this article, but it doesn't tell you how to do it.
first - check your Task Manager(on Performance tab) for value of Kernel nonpaged memory. Number near to 256 000KB causes our problem. It is a max. unpaged kernel memory defined in 32bits W2003 systems.
Make a performance Counter log for "Pool nonpaged bytes" and see it for hours or days. If value of kernel nonpaged memory grows, you can first of all estimate when your system will reach 256MB critical value.
next - find a process resp. driver which makes your problem. Use two tools - poolmon.exe from support tools on your Server2003 install CD(in \SUPPORT\TOOLS\support.cab) and memtriage.exe from Windows Server 2003 Resource Kit Tools(download).
start memtriage.exe from cmd line and use its help to make files with informations about your memory utilization. One from files is localtag.txt useful for translation tags of processes to names of files. More about tags and pool usage here.
start poolmon and use it like here. Press P until Poolmon displays the second column "type" and shows the value unpaged. Press B to sort the columns from largest to smallest.
use localtag.txt file to find the associated file or component. My problem was caused by drivers of third-party network monitoring tool, that causes kernel unpaged memory leak. After removing this tool from system, my problem disappeared. But same problem may be generated by network card drivers or other component.