Twice today the firewall service on our ISA Server has stopped unexpectedly. The relevant error messages in the event log read:
The Firewall service stopped because an application filter module C:\Program Files\Microsoft ISA Server\DSECISA.dll generated an exception code C0000005 in address 1FA33869 when function CompleteAsyncIO was called. To resolve this error, remove recently installed application filters and restart the service.
Faulting application wspsrv.exe, version 4.0.2165.594, stamp 43cd50a5, faulting module dsecisa.dll, version 220.127.116.11, stamp 42317b8c, debug? 0, fault address 0x00003869.
Due to an unexpected error, the service fwsrv stopped responding to all requests. Stop the service or the corresponding process if it does not respond, and then start it again. Check the Windows event Viewer for related error messages.
Has anyone any ideas what may be going on here? I have not installed any third party software recently. GFI Download Security has been installed for over a year now and hasn't been giving any problems.
I know it is a bit late, but did you collect any more info on this problem? I have the exact same error which has only surfaced after I installed SurfControl SP1 two weeks ago. I cannot prove it, but it seems to happen when the wspsrv.exe process (Microsoft Firewall) starts chewing up memory (> 1 GB virtual), although it should probably use the memory if it is available and release it if needs be (other applications, etc). I also half suspect that some error condition user connection might be causing the problem.
Same problem, we've been working with SurfControl for weeks and have applied multiple patches but the problem remains. Both scoutsvc and wspsrv using more memory than expected. I've already limited sql to 1GB max. Wspsrv grows to over 2GB and scoutsvc grown over 1GB (servers have 4GB). I have cashing enabled but have dropped to disk cash to 1GB on each of the 2 servers in the array. I originally had this set pretty high but learned it shouldn't be that high from posts in this forum, so I lowered it. Percent free memory settings remain at default. CARP also enabled. Seams like it might have something to do with cashing or CARP but I haven't tried completly disabling those yet.
The error I receive is the same as mentioned in the first post except it's SurfControl that's crashing the Firewall service. I think this happens because scoutsvc process priority is set to high by default while others are set to normal. In this case, I suspect the high priority process will always be to blame when other processes crash because of no more memory. It seams like ISA isn't releasing memory as it should. It just keeps growing until a crash or until the service is manually restarted. Any ideas...anyone?
Our users were giving me grief over this problem, so I have added in a scheduled SurfControl job to stop and start the Microsoft Firewall service each night. This keeps the memory usage of wspsrv.exe down to a low level. I know this is a cludgy fix, but it has made ISA/SurfControl run very smoothly. I have not had a problem for several weeks now.
Yeah, that's basically what I've been doing to get through this mess. Problem is I have to schedule an outage every time since we're a 24/7 operation. Whenever the Firewall service is restarted, it kicks current sessions out.
I'm still working with SurfControl, still applying patches but still no resolution. I'm starting to think it's a ISA issue rather than SurfControl. The ISA service grows even after I restart the scout service. I think it's because the scout service runs at a higher priority that it's to blame when the services finally run out of memory and crash.
I am experiencing the same issue using the Symantec Web Security as our content filter. The firewall service and the sqlservr service consumes RAM until it stops. If I restart both servers it just continues to build.