Microsoft KB Archive/923324

= Virtual memory allocation for the Microsoft Firewall service increases by as much as 512 MB in ISA Server 2004 and in ISA Server 2006 =

Article ID: 923324

Article Last Modified on 12/4/2007

-

APPLIES TO


 * Microsoft Internet Security and Acceleration Server 2006 Standard Edition
 * Microsoft Internet Security and Acceleration Server 2006 Enterprise Edition
 * Microsoft Internet Security and Acceleration Server 2004 Standard Edition
 * Microsoft Internet Security and Acceleration Server 2004 Enterprise Edition

-



SYMPTOMS
You create many connectivity verifiers that use HTTP requests to verify connectivity in Microsoft Internet Security and Acceleration (ISA) Server 2004 or ISA Server 2006. After you do this, virtual memory allocations for the Microsoft Firewall service may increase by as much as 512 megabytes (MB) over time.

Generally, this behavior does not cause a problem in ISA Server 2004 or ISA Server 2006. The number of firewall worker threads limits this increase in memory usage. However, this behavior can cause a problem on a computer that has lots of physical memory and that has a high memory cache setting for the Web Proxy component. On such a computer, this behavior could cause the failure of new memory allocations in ISA Server 2004 or ISA Server 2006. Therefore, ISA Server 2004 or ISA Server 2006 may be unable to process Web requests.

Note The memory for the Web Proxy cache is controlled by the Percentage of free memory to use for caching setting. For more information about memory that is used for caching in ISA Server 2004, click the following article number to view the article in the Microsoft Knowledge Base:

837577 A clarification of the &quot;Percentage of free memory to use for caching&quot; option in ISA Server 2004



CAUSE
This problem occurs because the HTTP request connectivity verification process runs on the main firewall worker threads. For each new thread on which the connectivity verifier runs, the connectivity verifier initializes some data structures. Because the Microsoft Firewall service can use many threads to handle client computer requests, these HTTP request connectivity verifiers may cause an increase in virtual memory allocations for the Microsoft Firewall service process over time. If the Percentage of free memory to use for caching setting is set to a high value, these memory allocations could cause the Microsoft Firewall service to reach the 2 gigabyte (GB) address space limit for 32-bit operating systems. Therefore, new memory allocations will be unsuccessful.



RESOLUTION
To resolve this problem for ISA Server 2006, install the hotfix package that is mentioned in the following Microsoft Knowledge Base article:

937186 Description of the ISA Server 2006 hotfix package that is dated May 14, 2007

To resolve this problem for ISA Server 2004, install the hotfix package that is mentioned in the following Microsoft Knowledge Base article:

923330 Description of the ISA Server 2004 hotfix package: July 27, 2006

After you install this hotfix, you must run the following script to enable the functionality that this hotfix provides. The script configures the Microsoft Firewall service so that it does not use the main firewall threads for the HTTP request connectivity verifiers. Additionally, this script causes the Microsoft Firewall service to create a new thread for each HTTP request connectivity verifier.

Caution If you use hundreds of HTTP request connectivity verifiers, we recommend that you use the default ISA Server 2004 behavior to manage HTTP request connectivity verifiers. In this situation, we recommend that you follow the steps in the &quot;Workaround&quot; section to manually configure the percentage of RAM that you use for caching.

Enable the functionality that this hotfix provides
Microsoft provides programming examples for illustration only, without warranty either expressed or implied. This includes, but is not limited to, the implied warranties of merchantability or fitness for a particular purpose. This article assumes that you are familiar with the programming language that is being demonstrated and with the tools that are used to create and to debug procedures. Microsoft support engineers can help explain the functionality of a particular procedure, but they will not modify these examples to provide added functionality or construct procedures to meet your specific requirements.

To enable the functionality that this hotfix provides, run the following script:  ' ' Copyright (c) Microsoft Corporation. All rights reserved. ' THIS CODE IS MADE AVAILABLE AS IS, WITHOUT WARRANTY OF ANY KIND. THE ENTIRE ' RISK OF THE USE OR THE RESULTS FROM THE USE OF THIS CODE REMAINS WITH THE ' USER. USE AND REDISTRIBUTION OF THIS CODE, WITH OR WITHOUT MODIFICATION, IS ' HEREBY PERMITTED.   ' This script adds a new VendorParametersSets under the array root. ' Used to add new parameters that are needed for hotfixes or service packs. 

Const SE_VPS_GUID = &quot;{143F5698-103B-12D4-FF34-1F34767DEabc}&quot; Const SE_VPS_VALUE = &quot;EnableThreadPerHttpVerifier&quot;

Sub SetEnableThreadPerHttpVerifier

' Create the root obect. Dim root ' The FPCLib.FPC root object Set root = CreateObject(&quot;FPC.Root&quot;)

'Declare the other objects needed. Dim array      ' An FPCArray object Dim VendorSets ' An FPCVendorParametersSets collection Dim VendorSet  ' An FPCVendorParametersSet object

' Get references to the array object ' and the network rules collection. Set array = root.GetContainingArray Set VendorSets = array.VendorParametersSets

On Error Resume Next Set VendorSet = VendorSets.Item( SE_VPS_GUID )

If Err.Number <> 0 Then Err.Clear

' Add the item Set VendorSet = VendorSets.Add( SE_VPS_GUID ) CheckError WScript.Echo &quot;New VendorSet added... &quot; & VendorSet.Name

Else WScript.Echo &quot;Existing VendorSet found... value- &quot; & VendorSet.Value(SE_VPS_VALUE) End If

if VendorSet.Value(SE_VPS_VALUE) <> true Then

Err.Clear VendorSet.Value(SE_VPS_VALUE) = true

If Err.Number <> 0 Then CheckError Else VendorSets.Save false, true CheckError

If Err.Number = 0 Then WScript.Echo &quot;Done with &quot; & SE_VPS_VALUE & &quot;, saved!&quot; End If       End If    Else WScript.Echo &quot;Done with &quot; & SE_VPS_VALUE & &quot;, no change!&quot; End If

End Sub

Sub CheckError

If Err.Number <> 0 Then WScript.Echo &quot;An error occurred: 0x&quot; & Hex(Err.Number) & &quot; &quot; & Err.Description Err.Clear End If

End Sub

SetEnableThreadPerHttpVerifier

Remove the functionality that this hotfix provides
To restore ISA Server 2004 to its default behavior, run the following script:  ' ' Copyright (c) Microsoft Corporation. All rights reserved. ' THIS CODE IS MADE AVAILABLE AS IS, WITHOUT WARRANTY OF ANY KIND. THE ENTIRE ' RISK OF THE USE OR THE RESULTS FROM THE USE OF THIS CODE REMAINS WITH THE ' USER. USE AND REDISTRIBUTION OF THIS CODE, WITH OR WITHOUT MODIFICATION, IS ' HEREBY PERMITTED.   ' This script removes a VendorParametersSet value. 

Const SE_VPS_GUID = &quot;{143F5698-103B-12D4-FF34-1F34767DEabc}&quot; Const SE_VPS_VALUE = &quot;EnableThreadPerHttpVerifier&quot;

Sub RemoveEnableThreadPerVerifier

' Create the root obect. Dim root ' The FPCLib.FPC root object Set root = CreateObject(&quot;FPC.Root&quot;)

'Declare the other objects needed. Dim array      ' An FPCArray object Dim VendorSets ' An FPCVendorParametersSets collection Dim VendorSet  ' An FPCVendorParametersSet object

' Get references to the array object ' and the network rules collection. Set array = root.GetContainingArray Set VendorSets = array.VendorParametersSets

On Error Resume Next Set VendorSet = VendorSets.Item( SE_VPS_GUID )

If Err.Number <> 0 Then Err.Clear

WScript.Echo &quot;VendorParametersSet does not exist.&quot;

Else Err.Clear

VendorSet.RemoveValue(SE_VPS_VALUE)

If Err.Number <> 0 Then CheckError Else VendorSets.Save false, true CheckError

If Err.Number = 0 Then WScript.Echo &quot;Done removing &quot; & SE_VPS_VALUE & &quot;, saved!&quot; End If       End If    End If

End Sub

Sub CheckError

If Err.Number <> 0 Then WScript.Echo &quot;An error occurred: 0x&quot; & Hex(Err.Number) & &quot; &quot; & Err.Description Err.Clear End If

End Sub

RemoveEnableThreadPerVerifier



WORKAROUND
To work around this problem, decrease the value that appears in the Percentage of free memory to use for caching setting to enable up to 512 MB of virtual memory allocations. The percentage setting for the Web Proxy cache should not exceed 1.2 GB of memory.

To calculate the percentage of RAM to set for caching, use the following formula:

Percentage of RAM for caching = 1.2 GB /  * 100

For example, on a server that has 4 GB of RAM, this formula appears as follows:

Percentage of RAM for caching = 1.2 / 4 * 100

Therefore, in this situation, you should use approximately 30 percent RAM for caching.

To view the Percentage of free memory to use for caching value, follow these steps:
 * 1) Start the ISA Server Management tool.
 * 2) Expand the server name, expand Configuration, right-click Cache, and then click Properties.
 * 3) In the Cache Settings dialog box, click the Advanced tab.
 * 4) Note the value that appears in the Percentage of free memory to use for caching box.



STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the &quot;Applies to&quot; section.

Keywords: kbtshoot kbbug kbfix kbfirewall kbprb KB923324

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.