FIX: ISA Reports May Span Unexpected Date Range or Show Incomplete Data (331064)


The information in this article applies to:

  • Microsoft Internet Security and Acceleration Server 2000
  • Microsoft Internet Security and Acceleration Server 2000 SP1
This article was previously published under Q331064
IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows Registry

SYMPTOMS

Reports created on an ISA Server computer may span an unexpected date range or may show blank or incomplete data under certain conditions.

This hotfix covers the following scenarios:

Scenario 1: ISA shows empty tables on the Traffic & Utilization report

When you create a report on a system that is running a non US-English SYSTEM locale, parts of the ISA 'Summary' and 'Traffic & Utilization' report may show tables that are initialized to all zeros for the first 12 days of a month. The report areas affected are:
  • Summary report:
    • Traffic - Traffic by date
  • Traffic & Utilization report:
    • Traffic - Traffic by date
    • Connections - Peak simultaneous connections by date
    • Processing Time - Processing time by date
The symptoms may also be seen if either the user credentials that are used to generate reports for an ISA enterprise array or (on a standard edition) the user running the Report Generator (Repgen.exe) process is configured with a non US-English locale.

The Report Generator process may create the summary files if a report is created for a period that the ISA Server computer does not have summary files for. The ISA Server computer may not have the summary files because the files have been deleted or the Dailysum.exe process did not complete successfully. The Report Generator process then determines if log files are available for this period. If log files are available, the Report Generator parses the log files and creates summary files that cover the selected period. This process runs in the security context of either the user configured for the report or (on a standard edition) under NT AUTHORITY\SYSTEM.

Scenario 2: ISA creates a report that includes the whole date range initialized to all zeros

When ISA creates a report that includes the whole month, ISA may generate a report with tables that are initialized to all zeros. The report may also include the whole date range instead of the dates that it has summary files for. This may occur when only daily summary files are available and no other log files or monthly summary files are available.

Scenario 3: Custom period only contains current day

If an administrator creates a report with a date range that only contains the current day, the report that is created may include data from the previous and current month.

Scenario 4: ISA incorrectly calculates the wrong date range

If the custom period contains the whole month, the report created may include data for the previous month and the month specified. This may occur if the previous month had fewer than 31 days.

Scenario 5 ISA misinterprets UTF8 characters in user names:

The ISA Server report may not show full or correct user names when non US-English codepages are used. For example, this can occur when a user logon name contains Cyrillic characters.

CAUSE

Scenario 1

If an ISA server is configured with a non US-English SYSTEM locale, ISA may interpret the date incorrectly and reverse the month part and the day part when it is creating daily summary files. This may occur with locales that have the day part before the month part (for example, day/month/year or year/day/month). When a report is created that includes the first 12 days of a month, ISA may not find the data those days because the day part and the month part have been reversed in the summary files. After you apply the fix, new summary files are created with the correct date conversion.

Note Old daily and monthly summary files may still contain tables with incorrect date columns.

Scenario 2

When you use a date range that includes the whole month, ISA may not calculate the date range because data is available in the monthly summary file. However, if the monthly summary file is not available, the tables may be left in their initialized state of zero. This is true even if daily summary files are available for the period. In this case the report may be empty. After you apply the fix, ISA correctly calculates the number of days and only includes data for the date range that it has daily summary files for.

Scenario 3

The date range code incorrectly assumes that the length of the month is 31 days. If the current month has fewer than 31 days, an incorrect calculation may result, and data from the previous month may be included.

Scenario 4

When you use a custom date range that includes the whole month, ISA may incorrectly calculate the length of the month and include data from the previous month. ISA incorrectly assumes that the length of the month is 31 days and calculates the period incorrectly.

Scenario 5

A problem with the UTF8 support may cause ISA to incorrectly interpret UTF8 characters in the Web Proxy log. When this occurs, Unicode characters are interpreted as two ANSI characters and Unicode characters greater than 255 are truncated.

WORKAROUND

Scenario 1

Change the default SYSTEM locale on the ISA Server computer to US-English.

RESOLUTION

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk. A supported hotfix is now available from Microsoft, but it is only intended to correct the problem that is described in this article. Only apply it to systems that are experiencing this specific problem. This hotfix may receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next ISA Server service pack that contains this hotfix.

To resolve this problem immediately, contact Microsoft Product Support Services to obtain the fix. For a complete list of Microsoft Product Support Services phone numbers and information about support costs, visit the following Microsoft Web site:

http://support.microsoft.com/contactus/?ws=support

Note In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question.
You must install ISA Server Service Pack 1 (SP1) before you install the following hotfix. For additional information about how to obtain the latest ISA Server service pack, click the following article number to view the article in the Microsoft Knowledge Base:

313139 How to Obtain the Latest Internet Security and Acceleration Server 2000 Service Pack

The English version of this fix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel. 
   Date         Time   Version       Size     File name
   -----------------------------------------------------
   05-Feb-2003  13:28                    501  Os.map
   05-Feb-2003  13:59  3.0.1200.182  792,848  Sumgen.dll
This fix also applies to the French, German, Spanish, and Japanese versions of ISA Server.

Scenario 5

To enable support for UTF8 characters in the Web proxy log, follow these steps after you install the fix:
  1. Start Registry Editor.
  2. Locate and then click the following registry key: HKEY_LOCAL_MACHINE\Software\Microsoft\Fpc\Reports
  3. Create a new DWORD value named UTF8LogsSupportEnabled. Give this new value a data value of 1.
You do not have to restart the service because the registry value only affects the way the daily summary generator reads the Web proxy logs.

To revert to the original configuration and disable support for UFT8 characters, either remove the UTF8LogsSupportEnabled registry value, or change its data value to 0 (zero).

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.

MORE INFORMATION

By design, the default number of daily summaries saved is 35. This means that an administrator can obtain correct daily reports only for the last 36 days. If the custom date range goes farther back than this configured value, ISA uses the monthly summary files and the granularity is in whole months. ISA does not use a mix of monthly and daily summaries, so the end date may be the last day of the previous month.

The same is true for the monthly summaries. By design, the default number of saved monthly summary files is 13. If the custom date range goes farther back than this value, ISA may change the granularity to yearly summaries, so the end date may be the last day of the previous year.

You can change the default number of summaries saved to increase the detail level of the report by using the ISA Microsoft Management Console (MMC):
  1. In the ISA MMC, expand Servers and Arrays.
  2. Expand the server name, and then expand Monitoring Configuration.
  3. Right-click Report Jobs, and then click Properties.
  4. Click the Log Summaries tab.
  5. Under Number of summaries saved, change the Daily summaries and Monthly summaries values to fit your requirements.
This hotfix also adds support for ISA reporting to correctly recognize Windows 2003 Server. Before you install this fix, Windows 2003 Server is not recognized and appears in the reports as UNKNOWN.
Modification Type:MinorLast Reviewed:10/11/2005
Keywords:kbHotfixServer kbQFE kbISAServ2000preSP2fix kbISAServ2000SP2fix kbbug kbfix KB331064 kbAudDeveloper
©2004 Microsoft Corporation. All rights reserved.