The Firewall service stops responding and Event IDs 14079, 1000, and 14057 are logged in the Application event log in ISA Server 2004
SYMPTOMS
The Microsoft Firewall service on a Microsoft Internet Security and Acceleration (ISA) Server 2004-based computer may stop responding. Additionally, you may find events that resemble the following in the Application event log:
Event Type: Error
Event Source: Microsoft ISA Server Control
Event Category: None
Event ID: 14079
Date: DATE
Time: TIME
User: N/A
Computer: ComputerName
Description:
Due to an unexpected error, the service fwsrv stopped responding to all requests. Stop the service or the corresponding process if it does not respond, and then start it again. Check for related error messages.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Microsoft ISA Server
Event Category: None
Event ID: 1000
Description:
Faulting application wspsrv.exe, version VersionNo, stamp StampNo, faulting module w3filter.dll, version VersionNO, stamp StampNo, debug? 0, fault address AddressNo.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Note: In the previous event, xxxxxx is a placeholder that represents the fault address number.
Event Type: Error
Event Source: Microsoft Firewall
Event Category: None
Event ID: 14057
Date: DATE
Time: Time
User: N/A
Computer: ComputerName
Description:
The Firewall service stopped because an application filter module C:\Program Files\Microsoft ISA Server\w3filter.dll generated an exception code C0000005 in address AddressNo when function CompleteAsyncIO was called. To resolve this error, remove recently installed application filters and restart the service.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Note In the previous event, xxxxxx is a placeholder that represents the address.
CAUSE
This problem occurs if the following conditions are true:
- The client tries to access the ISA Server to cache responses to client requests.
- The size of the file that the client requests is larger than 64 kilobytes (KB).
- The client tries to access the same file and the ISA Server sends an "If-Modified-Since" request to the Web server.
- The Web server responds with an HTTP status code "304 Not Modified" message to the file request.
- The ISA Server sends the requested file from the cache, and then tries to delete the cached file.
Under these conditions, the Web proxy service may stop responding.
For more information and a solution, check out: http://support.microsoft.com/default.aspx?scid=kb;...08#top
HTH,
Tom
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://blogs.isaserver.org/shinder/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
Patrick Headley Says:
February 2nd, 2007 at 11:29 pm
I have applied the Hotfix that Microsoft provided and the Firewall Service still stops about once every other day with the error messages described above. The only workaround I’ve come up with so far is to turn off caching. The firewall worked for about 6 months before the problem started.
Another inconsistency in the solution is that the hotfix documentation states that the proxy service stops, not the firewall service.
Patrick.
Ed Says:
March 11th, 2008 at 11:31 am
I’m suddenly having the same problem w/ ISA 2006 Std - firewall crashing about once a day - any fixes for the 2006 version?
Thanks…
Kirill Says:
November 6th, 2008 at 7:49 pm
I’ve the same problem with ISA 2006 Std. Does any fixes for ISA 2006?