Microsoft KB Archive/916152

= The Firewall service stops responding and Event IDs 14079, 1000, and 14057 are logged in the Application event log in ISA Server 2004 =

Article ID: 916152

Article Last Modified on 12/4/2007

-

APPLIES TO


 * Microsoft Internet Security and Acceleration Server 2004 Enterprise Edition
 * Microsoft Internet Security and Acceleration Server 2004 Standard Edition

-





SYMPTOMS
The Microsoft Firewall service on a Microsoft Internet Security and Acceleration (ISA) Server 2004-based computer may stop responding. Additionally, you may find events that resemble the following in the Application event log:

Event Type: Error

Event Source: Microsoft ISA Server Control

Event Category: None

Event ID: 14079

Date:

Time:

User: N/A

Computer:

Description:

Due to an unexpected error, the service fwsrv stopped responding to all requests. Stop the service or the corresponding process if it does not respond, and then start it again. Check for related error messages.

For more information, see Help and Support Center at http://support.microsoft.com.

Event Type: Error

Event Source: Microsoft ISA Server

Event Category: None

Event ID: 1000

Description:

Faulting application %1, version %2, faulting module %3, version %4, fault address 0x%5.

For more information, see Help and Support Center at http://support.microsoft.com.

Note In the previous event,  is a placeholder that represents the value of the parameter name.

Event Type: Error

Event Source: Microsoft Firewall

Event Category: None

Event ID: 14057

Date:

Time:

User: N/A

Computer:

Description:

The Firewall service stopped because an application filter module C:\Program Files\Microsoft ISA Server\w3filter.dll generated an exception code C0000005 in address  when function CompleteAsyncIO was called. To resolve this error, remove recently installed application filters and restart the service.

For more information, see Help and Support Center at http://support.microsoft.com.

Note In the previous event,  is a placeholder that represents the address.



CAUSE
This problem occurs if the following conditions are true:
 * The client tries to access the ISA Server to cache responses to client requests.
 * The size of the file that the client requests is larger than 64 kilobytes (KB).
 * The client tries to access the same file and the ISA Server sends an &quot;If-Modified-Since&quot; request to the Web server.
 * The Web server responds with an HTTP status code &quot;304 Not Modified&quot; message to the file request.
 * The ISA Server sends the requested file from the cache, and then tries to delete the cached file.

Under these conditions, the Web proxy service may stop responding.



RESOLUTION
To resolve this problem, install the hotfix package that is described in the following article in the Microsoft Knowledge Base:

916106 Update for HTTP issues in Internet Security and Acceleration Server 2004 Service Pack 2

Keywords: kbbug kbqfe kbprb KB916152

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.