Re: Firewall Service dies like clockwork

  • From: "Jim Harrison" <jim@xxxxxxxxxxxx>
  • To: "[ Discussion List]" <isalist@xxxxxxxxxxxxx>
  • Date: Mon, 25 Nov 2002 21:16:45 -0800

Take another look at the perf logs; I'll bet WebTrends is sucking the life out 
of your ISA while it creates all those reports for you.

 Jim Harrison
 MCP(NT4, W2K), A+, Network+, PCG
 Read the help / books / articles!

  ----- Original Message ----- 
  From: Phill Hardstaff 
  To: [ Discussion List] 
  Sent: Monday, November 25, 2002 8:57 PM
  Subject: [isalist] Firewall Service dies like clockwork

  I posted something about 3 months back about how my firewall service stopped 
working at 0200h every Sunday morning and would not come back up until 0430h 
with a reboot or restart the Firewall service. Anyway, after months of pulling 
my hair out I finally nailed it, and looking back over some posts on the list 
about problems with the firewall service I believe others are probably having 
this problem as well.

  What happens : 0200h Sunday morning, firewall service dies, web proxy still 
runs OK, can still access web site by IP, published servers stop working etc.

  Last Friday I ran a Webtrends report on my web server, which is behind the 
firewall, this is also my DNS server, this was during the day, within 10 
minutes I had these same symptoms that I outlined above, I stopped and 
restarted the firewall, I rebooted it but it would just die straight away. I 
had hadn't made the link with Webtrends yet, but I shutdown the web server and 
while it was off found I could stop and start the firewall service and IT 
WORKED. I bought the web server back up and had a look at Webtrends and found I 
had all my reports set to run at 0200h Sunday morning (they run sequentially), 
boy was I happy. I disabled all the Webtrends reports and shut down the 
scheduler. By this time I had to leave work to catch a plane, I checked on 
Sunday morning and for the first time in 3-4 months the firewall service didn't 
stop at 0200h on Sunday morning.

  Why ? Webtrends does DNS lookups while running to resolve IP's from the log 
files, you can turn this off but I have had it running like this for about 3 
years and never had any problems with my last firewall (Guardian), it seems 
that a big flood of DNS lookups kills the firewall service ? because this is 
all that is happening. It just seems to loose the plot :)

  Any feedback appreciated, I would like to run my reports again.


  Phill Hardstaff 
  MCSA, CCNA, A+, Network+, Inet+, Server+, CIW Assoc. 
  Senior Support Engineer 
  Secretariat of the Pacific Community 
  B.P. D5 
  Noumea Cedex - 98848 
  New Caledonia 
  Phone +687-260141 
  Mobile +687 838091 
  Fax +687-263818 
  Email  phillh@xxxxxxx 
  SPC Web Page 
  Personal Web Page 
  Personal Email Phill@xxxxxxxxxxxxx 
  Personal Fax +1 (603) 299-5640 

  List Archives:
  ISA Server Newsletter:
  ISA Server FAQ:
  Exchange Server Resource Site:
  Windows Security Resource Site:
  Windows 2000/NT Fax Solutions:
  You are currently subscribed to this Discussion List as: 
  To unsubscribe send a blank email to $subst('Email.Unsub') 

Other related posts: