The Firewall service stops responding and Event IDs 14079, 1000, and 14057 are logged in the Application event log in ISA Server 2004

SYMPTOMS
The Microsoft Firewall service on a Microsoft Internet Security and Acceleration (ISA) Server 2004-based computer may stop responding. Additionally, you may find events that resemble the following in the Application event log:
Event Type: Error
Event Source: Microsoft ISA Server Control
Event Category: None
Event ID: 14079
Date: DATE
Time: TIME
User: N/A
Computer: ComputerName
Description:
Due to an unexpected error, the service fwsrv stopped responding to all requests. Stop the service or the corresponding process if it does not respond, and then start it again. Check for related error messages.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Microsoft ISA Server
Event Category: None
Event ID: 1000
Description:
Faulting application wspsrv.exe, version VersionNo, stamp StampNo, faulting module w3filter.dll, version VersionNO, stamp StampNo, debug? 0, fault address AddressNo.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Note: In the previous event, xxxxxx is a placeholder that represents the fault address number.

Event Type: Error
Event Source: Microsoft Firewall
Event Category: None
Event ID: 14057
Date: DATE
Time: Time
User: N/A
Computer: ComputerName
Description:
The Firewall service stopped because an application filter module C:\Program Files\Microsoft ISA Server\w3filter.dll generated an exception code C0000005 in address AddressNo when function CompleteAsyncIO was called. To resolve this error, remove recently installed application filters and restart the service.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Note In the previous event, xxxxxx is a placeholder that represents the address.

CAUSE
This problem occurs if the following conditions are true:

  • The client tries to access the ISA Server to cache responses to client requests.
  • The size of the file that the client requests is larger than 64 kilobytes (KB).
  • The client tries to access the same file and the ISA Server sends an “If-Modified-Since” request to the Web server.
  • The Web server responds with an HTTP status code “304 Not Modified” message to the file request.
  • The ISA Server sends the requested file from the cache, and then tries to delete the cached file.

Under these conditions, the Web proxy service may stop responding.

For more information and a solution, check out: http://support.microsoft.com/default.aspx?scid=kb;en-us;916152&sd=rss&spid=2108#top

HTH,

Tom

Thomas W Shinder, M.D.

Site: www.isaserver.org

Blog: http://blogs.isaserver.org/shinder/

Book: http://tinyurl.com/3xqb7

MVP — ISA Firewalls

Leave a Comment

Your email address will not be published.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Scroll to Top