The Firewall service stops responding and Event IDs 14079, 1000, and 14057 are logged in the Application event log in ISA Server 2004 (916152)


The information in this article applies to:

  • Microsoft Internet Security and Acceleration Server 2004, Enterprise Edition
  • Microsoft Internet Security and Acceleration Server 2004, Standard Edition

SYMPTOMS

The Microsoft Firewall service on a Microsoft Internet Security and Acceleration (ISA) Server 2004-based computer may stop responding. Additionally, you may find events that resemble the following in the Application event log:

Event Type: Error
Event Source: Microsoft ISA Server Control
Event Category: None
Event ID: 14079
Date: DATE
Time: TIME
User: N/A
Computer: ComputerName
Description:
Due to an unexpected error, the service fwsrv stopped responding to all requests. Stop the service or the corresponding process if it does not respond, and then start it again. Check for related error messages.

For more information, see Help and Support Center at http://support.microsoft.com.

Event Type: Error
Event Source: Microsoft ISA Server
Event Category: None
Event ID: 1000
Description:
Faulting application wspsrv.exe, version VersionNo, stamp StampNo, faulting module w3filter.dll, version VersionNO, stamp StampNo, debug? 0, fault address AddressNo.

For more information, see Help and Support Center at http://support.microsoft.com.

Note In the previous event, xxxxxx is a placeholder that represents the fault address number.

Event Type: Error
Event Source: Microsoft Firewall
Event Category: None
Event ID: 14057
Date: DATE
Time: Time
User: N/A
Computer: ComputerName
Description:
The Firewall service stopped because an application filter module C:\Program Files\Microsoft ISA Server\w3filter.dll generated an exception code C0000005 in address AddressNo when function CompleteAsyncIO was called. To resolve this error, remove recently installed application filters and restart the service.

For more information, see Help and Support Center at http://support.microsoft.com.

Note In the previous event, xxxxxx is a placeholder that represents the address.

CAUSE

This problem occurs if the following conditions are true:
  • The client tries to access the ISA Server to cache responses to client requests.
  • The size of the file that the client requests is larger than 64 kilobytes (KB).
  • The client tries to access the same file and the ISA Server sends an "If-Modified-Since" request to the Web server.
  • The Web server responds with an HTTP status code "304 Not Modified" message to the file request.
  • The ISA Server sends the requested file from the cache, and then tries to delete the cached file.
Under these conditions, the Web proxy service may stop responding.

RESOLUTION

To resolve this problem, install the hotfix package that is described in the following article in the Microsoft Knowledge Base:

916106 Update for HTTP issues in Internet Security and Acceleration Server 2004 Service Pack 2

Modification Type:MajorLast Reviewed:9/20/2006
Keywords:kbBug kbQFE kbprb KB916152 kbAudITPRO
©2004 Microsoft Corporation. All rights reserved.