Welcome to ISAserver.org

Firewall Service shutdown with Event ID 5

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [ISA 2006 General] >> General >> Firewall Service shutdown with Event ID 5

Page: [1] 2 next > >>

Message

<< Older Topic Newer Topic >>

Firewall Service shutdown with Event ID 5 - 1.Mar.2007 2:08:43 PM

ABCPL

Posts: 15
Joined: 21.Nov.2006
Status: offline

Hello all!

I just installed ISA 2006 a few days ago and today, the Microsoft Firewall service choked and I had to restart it manually.

The error messages were:
Source: Microsoft ISA Server Web Proxy
Event ID: 5
Information for the ISA server Web filter log could not be logged to the text file ISALOG_20070301_WEB_000.iis in the path c:\Program Files\Microsoft ISA Server\ISALogs. Error code:

Then there is an informational event stating that the Firewall service was stopped gracefully.

This is a W2K3 server with the latest SP and Hotfixes and nothing else running on it except the defaults that Windows Server 2003 and ISA install. No backups or 3rd party apps or AV. I don't think it's a HD issue, this is a brand new server configured in RAID 1 and there are no disk events and a CHKDSK showed no problems. The server has a moderate traffic on it on average about 160MB of logs per day.

I switched back to MSDE database logging for both logs.
Does anyone have any ideas what could be causing this?

Any help would be appreciated,
Paul

Post #: 1

Featured Links*

RE: Firewall Service shutdown with Event ID 5 - 2.Mar.2007 10:58:22 AM

tshinder

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline

Hi Paul,

I've seen the same thing with MSDE logging. Let me know if it happens again and we'll move it up the food chain.

Thanks!
Tom

_____________________________

Thomas W Shinder, M.D.

(in reply to ABCPL)

Post #: 2

RE: Firewall Service shutdown with Event ID 5 - 7.Mar.2007 10:00:43 AM

imboguss

Posts: 1
Joined: 20.Sep.2002
Status: offline

This has been happening to me 2 or 3 times a day for the last week or two!

No idea why it is happening.

(in reply to ABCPL)

Post #: 3

RE: Firewall Service shutdown with Event ID 5 - 7.Mar.2007 10:47:57 AM

tshinder

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline

It's only happened to me a few times with 2006, but I never saw it with 2004.

Tom

_____________________________

Thomas W Shinder, M.D.

(in reply to imboguss)

Post #: 4

RE: Firewall Service shutdown with Event ID 5 - 7.Mar.2007 5:04:29 PM

ABCPL

Posts: 15
Joined: 21.Nov.2006
Status: offline

Tom,

This happened to me twice, once on a test box and now on the production server.
the other thing that I did was to set the service to restart if it fails because both times, I just had to hit the play button to get everything running again.

I have not seen the error again on the production box but the database loggin sure is a pig for drive space usage.

Thank you,
Paul

(in reply to tshinder)

Post #: 5

RE: Firewall Service shutdown with Event ID 5 - 14.Mar.2007 11:55:41 PM

ibre34

Posts: 28
Joined: 10.Nov.2005
Status: offline

Hi

This happend to me today

It's happend only when I configure the Isa Server log format.

When I configure W3C log format all it's OK

The problem is I need the Isa Server format log for Webtrend analysis

I have 1 array, 2 ISA 2006 Ent boxes, NLB, CARP

I have heavy traffic. More than 1Gb log per day

Any ideas?

(in reply to ABCPL)

Post #: 6

RE: Firewall Service shutdown with Event ID 5 - 19.Mar.2007 10:29:01 AM

tshinder

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline

I've only seen it when using MSDE logging.

Tom

_____________________________

Thomas W Shinder, M.D.

(in reply to ibre34)

Post #: 7

RE: Firewall Service shutdown with Event ID 5 - 19.Mar.2007 1:14:26 PM

ibre34

Posts: 28
Joined: 10.Nov.2005
Status: offline

Well.. I am going to call PSS

I'll let you know

Best regards

(in reply to tshinder)

Post #: 8

RE: Firewall Service shutdown with Event ID 5 - 20.Mar.2007 12:28:16 PM

tshinder

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline

Great!

Let us know what you find out.

Thanks!!!

Tom

_____________________________

Thomas W Shinder, M.D.

(in reply to ibre34)

Post #: 9

RE: Firewall Service shutdown with Event ID 5 - 26.Mar.2007 10:38:43 AM

ibre34

Posts: 28
Joined: 10.Nov.2005
Status: offline

Problem solved

Go to Configure Web Proxy Logging
Press tab Fields
Uncheck field "Referring Server"
Save changes

4 days without problems :)

(in reply to tshinder)

Post #: 10

RE: Firewall Service shutdown with Event ID 5 - 26.Mar.2007 11:33:22 AM

tshinder

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline

Wow! That seems too easy. So that's what PSS had to tell you?

Thanks!
Tom

_____________________________

Thomas W Shinder, M.D.

(in reply to ibre34)

Post #: 11

RE: Firewall Service shutdown with Event ID 5 - 26.Mar.2007 11:52:45 AM

ibre34

Posts: 28
Joined: 10.Nov.2005
Status: offline

Yes, it's easy when you know it :)

It seems there is a problem with the defined lenght for the field. If the data is longer than the defined lenght ISA can not write the log and the the firewall service stops.

(in reply to tshinder)

Post #: 12

RE: Firewall Service shutdown with Event ID 5 - 29.Mar.2007 10:23:21 AM

dan.dent

Posts: 10
Joined: 21.Sep.2004
From: London
Status: offline

Whilst it may not fix the problem, there is a script you can get from the Microsoft website that stops ISA going into lockdown mode and shutting off the firewall service when it can't log.

http://www.microsoft.com/technet/isa/2004/plan/disablelockdownonlogfailure.mspx

(in reply to ibre34)

Post #: 13

RE: Firewall Service shutdown with Event ID 5 - 30.Mar.2007 11:31:45 AM

cbuechler

Posts: 23
Joined: 20.Feb.2006
Status: offline

Having the same problem myself with the firewall service dying with Event ID 5. Using ISA logging format, ISA 2006 on Server 2003 R2 SP2. It's been dying a couple times a day since we moved over from ISA 2004. I just unchecked "Referring server" after finding this, will report back if this does or doesn't seem to fix it.

Thanks to ibre34 for posting this potential solution!

(in reply to dan.dent)

Post #: 14

RE: Firewall Service shutdown with Event ID 5 - 30.Mar.2007 12:21:54 PM

ibre34

Posts: 28
Joined: 10.Nov.2005
Status: offline

I haven't had more problems since I unchecked "referring server"

(in reply to cbuechler)

Post #: 15

RE: Firewall Service shutdown with Event ID 5 - 1.Apr.2007 11:41:25 AM

tshinder

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline

Yay!

Tom

_____________________________

Thomas W Shinder, M.D.

(in reply to ibre34)

Post #: 16

RE: Firewall Service shutdown with Event ID 5 - 4.Apr.2007 1:09:22 PM

cbuechler

Posts: 23
Joined: 20.Feb.2006
Status: offline

Following up, this definitely fixed the problem for me as well.

(in reply to tshinder)

Post #: 17

RE: Firewall Service shutdown with Event ID 5 - 4.Apr.2007 3:14:16 PM

tshinder

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline

That's great news!
Thanks!
Tom

_____________________________

Thomas W Shinder, M.D.

(in reply to cbuechler)

Post #: 18

RE: Firewall Service shutdown with Event ID 5 - 10.Apr.2007 8:42:53 AM

unstable

Posts: 2
Joined: 10.Apr.2007
Status: offline

I have almost a smiliar problem. The only difference that it is FWS log causing error. And there is no Referring Server field in it, so no easy solution for me. And what even worse, now Firewall Service refuses to restart manually. I tried to disable logging and restart FWS, but it kept coming up with an error in the event log that says something about CreateSharedMemory error during performance counters initialization (ID 11004).

< Message edited by unstable -- 10.Apr.2007 8:44:00 AM >

(in reply to ABCPL)

Post #: 19

RE: Firewall Service shutdown with Event ID 5 - 11.Apr.2007 12:35:50 PM

tshinder

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline

Hi Unstable,

Are there any services running on the ISA Firewall other than the ISA Firewall software?

Thanks!
Tom

_____________________________

Thomas W Shinder, M.D.

(in reply to unstable)

Post #: 20