Welcome to ISAserver.org

SQL logging

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [ISA Server 2004 Firewall] >> Logging and Reporting >> SQL logging

Page: [1]

Message

<< Older Topic Newer Topic >>

SQL logging - 1.Mar.2006 11:06:12 PM

ryanrock

Posts: 20
Joined: 4.Mar.2003
From: Colorado
Status: offline

So I followed the instructions in: http://support.microsoft.com/kb/838710/en-us about setting up ISA 2004 to a SQL database. When I enable logging the firewall service stops and I get this error in the event log:
Event Type: Error
Event Source: Microsoft Firewall
Event Category: Log
Event ID: 6
Date:  03/01/2006
Time:  1:58:29 PM
User:  N/A
Computer: ISA3
Description:
The Microsoft Firewall failed to log information to ODBC Data Source ISA2004, Table: firewalllog, under User Name [ISA2004].
The ODBC Error description is: [State=01004][Error=0][Microsoft][ODBC SQL Server Driver]Fractional truncation [State=37000][Error=156][Microsoft][ODBC SQL Server Driver][SQL Server]Incorrect syntax near the keyword 'rule'.
[State=37000][Error=8180][Microsoft][ODBC SQL Server Driver][SQL Server]Statement(s) could not be prepared. .
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

This is a Windows 2003 Server with SP1 and ISA 2004 SP1.
The SQL server is a Windows 2003 server w/ SP1 and SQL 2000 w/ sp4.   I also have a seperate ISA 2000 database that is logging fine from 2 other ISA 2000 machines. Any idea's would be helpful. Thanks.

Post #: 1

Featured Links*

RE: SQL logging - 16.Mar.2006 4:49:28 PM

nofear

Posts: 95
Joined: 28.Nov.2005
Status: offline

hi i have the same problem but i guess i found a solution that i dont know how it works :

First enable the system policy for (SQL LOGGING ) and (Netbois logging)
Second :create an access rul that allows traffic ( protocol TCP 1811 ) FROM LOCAL host to your SQL server

all should work now

but any one tell me what is the 1811,i sniff the traffic and i saw the 1811 trafic from my ISA to the SQL being denied so i allowed it and all is working,but what is the 1811 port?

(in reply to ryanrock)

Post #: 2

RE: SQL logging - 17.Mar.2006 8:48:43 PM

networkone

Posts: 52
Joined: 13.Dec.2001
From: Toronto, Ontario, Canada
Status: offline

Gentlemen,

The situation you describe is cause by the ISA 2004 "lockdown" procedure. When you configure logging to SQL as described in the microsoft KB article you illustrate, all works well until the ISA server loses communication to the SQL server. When this happens, for some strange reason, Microsoft has written an applet that forces ISA into a lockdown mode that immediately terminates the firewall service.

if you would like to prevent this, review this article...

http://www.microsoft.com/technet/prodtechnol/isa/2004/plan/disablelockdownonlogfailure.mspx

let me know if this helps your situation

Cheers

jason@myit.ca

(in reply to ryanrock)

Post #: 3