Unfortunately, that's probably going to happen. This kind of "multiple management" of traffic often leads to unresolved finger-pointing. The only way I've seen it successfully resolved is when someone can debug the machine and point to a particular chunk of code. How are your debugging skills? Jim Harrison MCP(NT4, W2K), A+, Network+, PCG http://isaserver.org/Jim_Harrison/ http://isatools.org Read the help / books / articles! ----- Original Message ----- From: "John Tolmachoff (Lists)" <johnlist@xxxxxxxxxxxxxxxxxxx> To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx> Sent: Saturday, September 18, 2004 11:37 Subject: [isalist] Re: Proxy service failed. http://www.ISAserver.org Thanks Jim. I can just picture it now. GFI blames Burstek. Burstek blames GFI. John Tolmachoff Engineer/Consultant/Owner eServices For You > -----Original Message----- > From: Jim Harrison [mailto:jim@xxxxxxxxxxxx] > Sent: Saturday, September 18, 2004 11:02 AM > To: [ISAserver.org Discussion List] > Subject: [isalist] Re: Proxy service failed. > > http://www.ISAserver.org > > I didn't say that this would solve the issue, just that it's the best method for > narrowing it down. > If you disable the filter and you don't see the problem recur, then it's time to get GFI > folks involved. > The fact that it doesn't happen until several days have passed indicates that it's either > a time-based bug or that your recent > change exposed a bug in a previously-unexercised code path in the filter. > > I can't answer as to why resolutions never show from the complaining party (not that > unusual, frankly), but I know for a fact that > several issues in 3rd-party filters have crossed my desk and in only one case was ISA > code at fault. > > Jim Harrison > MCP(NT4, W2K), A+, Network+, PCG > http://isaserver.org/Jim_Harrison/ > http://isatools.org > Read the help / books / articles! > > ----- Original Message ----- > From: "John Tolmachoff (Lists)" <johnlist@xxxxxxxxxxxxxxxxxxx> > To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx> > Sent: Saturday, September 18, 2004 10:17 > Subject: [isalist] Re: Proxy service failed. > > > http://www.ISAserver.org > > Well, while I might agree with you, nothing has changed on Download Security > over the last 10 days. The last time I changed it was to add a registry > entry so that excel files would not be incorrectly scanned as html files. > > What bothers me is that the old posts I have seen on this point a finger at > the 3rd party app, but there is never a closing post saying this or this > fixed it. They are left hanging. > > I guess to test, I would need to restart the server say 2 more times and see > if the error occurs again, and then disable Download Security and then > restart a couple of times to see if it occurs. > > One thing I did note, if I manually restart and as I have now configured it > to restart on 1st & 2nd fail, it then starts fine and runs. > > John Tolmachoff > Engineer/Consultant/Owner > eServices For You > > > -----Original Message----- > > From: Jim Harrison [mailto:jim@xxxxxxxxxxxx] > > Sent: Saturday, September 18, 2004 9:59 AM > > To: [ISAserver.org Discussion List] > > Subject: [isalist] Re: Proxy service failed. > > > > http://www.ISAserver.org > > > > Hi John, > > > > The "1000" event told you which component caused the fault: "dsecisa.dll". > > I got a $ that says this is "Download SECurity". > > Try disabling it and see if this reoccurs. > > > > Jim Harrison > > MCP(NT4, W2K), A+, Network+, PCG > > http://isaserver.org/Jim_Harrison/ > > http://isatools.org > > Read the help / books / articles! > > > > ----- Original Message ----- > > From: "John Tolmachoff (Lists)" <johnlist@xxxxxxxxxxxxxxxxxxx> > > To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx> > > Sent: Saturday, September 18, 2004 01:08 > > Subject: [isalist] Proxy service failed. > > > > > > http://www.ISAserver.org > > > > Today (well it was Friday) the web proxy service failed at 3:30 PM this is > > the first time this has done this. At 11:30, I restarted the service and > > then checked everything out. I restarted the server and the error occurred > > again. However, I had set the recovery options on the service to restart > on > > 1 and 2 fail, and it is now running. > > > > GFI Download security version 2.2 is installed as well as Burstek Web > Filter > > version 5.30.04 and Log analyzer. > > > > Nothing has changed on the server in about 10 days. > > > > Below are the event logs. I did some searching and the only thing I found > > are some posts related to moving GFI Download security to a higher > priority > > (From May of 2004) and possibly pointing at Web Sense. > > > > Any one have any ideas on what to look at? > > > > Application logs: > > > > ______________________________________________________ > > Event Type: Error > > Event Source: Application Error > > Event Category: (100) > > Event ID: 1000 > > Date: 9/17/2004 > > Time: 3:33:17 PM > > User: N/A > > Computer: SRV6 > > Description: > > Faulting application w3proxy.exe, version 3.0.1200.365, faulting module > > dsecisa.dll, version 1.0.0.12, fault address 0x00012c46. > > > > For more information, see Help and Support Center at > > http://go.microsoft.com/fwlink/events.asp. > > Data: > > 0000: 41 70 70 6c 69 63 61 74 Applicat > > 0008: 69 6f 6e 20 46 61 69 6c ion Fail > > 0010: 75 72 65 20 20 77 33 70 ure w3p > > 0018: 72 6f 78 79 2e 65 78 65 roxy.exe > > 0020: 20 33 2e 30 2e 31 32 30 3.0.120 > > 0028: 30 2e 33 36 35 20 69 6e 0.365 in > > 0030: 20 64 73 65 63 69 73 61 dsecisa > > 0038: 2e 64 6c 6c 20 31 2e 30 .dll 1.0 > > 0040: 2e 30 2e 31 32 20 61 74 .0.12 at > > 0048: 20 6f 66 66 73 65 74 20 offset > > 0050: 30 30 30 31 32 63 34 36 00012c46 > > _______________________________________________________ > > Event Type: Error > > Event Source: Microsoft ISA Server Control > > Event Category: None > > Event ID: 14079 > > Date: 9/17/2004 > > Time: 3:35:17 PM > > User: N/A > > Computer: SRV6 > > Description: > > Due to an unexpected error, the service w3proxy stopped responding to all > > requests. This occurred 1 time(s) in the past 0:07 hours. Try to stop the > > service or kill the corresponding process if it does not respond, and > start > > it again. Check the Event Viewer for related error messages. > > > > For more information, see Help and Support Center at > > http://go.microsoft.com/fwlink/events.asp. > > _____________________________________________________ > > Event Type: Information > > Event Source: Microsoft Web Proxy > > Event Category: None > > Event ID: 14186 > > Date: 9/18/2004 > > Time: 12:33:29 AM > > User: N/A > > Computer: SRV6 > > Description: > > The Web Proxy Service was started successfully. > > > > For more information, see Help and Support Center at > > http://go.microsoft.com/fwlink/events.asp. > > __________________________________________________ > > Event Type: Information > > Event Source: Application Error > > Event Category: (100) > > Event ID: 1004 > > Date: 9/18/2004 > > Time: 12:37:46 AM > > User: N/A > > Computer: SRV6 > > Description: > > Reporting queued error: faulting application w3proxy.exe, version > > 3.0.1200.365, faulting module dsecisa.dll, version 1.0.0.12, fault address > > 0x00012c46. > > > > For more information, see Help and Support Center at > > http://go.microsoft.com/fwlink/events.asp. > > Data: > > 0000: 41 70 70 6c 69 63 61 74 Applicat > > 0008: 69 6f 6e 20 46 61 69 6c ion Fail > > 0010: 75 72 65 20 20 77 33 70 ure w3p > > 0018: 72 6f 78 79 2e 65 78 65 roxy.exe > > 0020: 20 33 2e 30 2e 31 32 30 3.0.120 > > 0028: 30 2e 33 36 35 20 69 6e 0.365 in > > 0030: 20 64 73 65 63 69 73 61 dsecisa > > 0038: 2e 64 6c 6c 20 31 2e 30 .dll 1.0 > > 0040: 2e 30 2e 31 32 20 61 74 .0.12 at > > 0048: 20 6f 66 66 73 65 74 20 offset > > 0050: 30 30 30 31 32 63 34 36 00012c46 > > ___________________________________________________ > > Event Type: Error > > Event Source: Application Error > > Event Category: None > > Event ID: 1001 > > Date: 9/18/2004 > > Time: 12:39:24 AM > > User: N/A > > Computer: SRV6 > > Description: > > Fault bucket 118664497. > > > > For more information, see Help and Support Center at > > http://go.microsoft.com/fwlink/events.asp. > > Data: > > 0000: 42 75 63 6b 65 74 3a 20 Bucket: > > 0008: 31 31 38 36 36 34 34 39 11866449 > > 0010: 37 0d 0a 7.. > > > > >From the System log: > > > > Event Type: Information > > Event Source: Disk > > Event Category: None > > Event ID: 119 > > Date: 9/17/2004 > > Time: 3:32:02 PM > > User: N/A > > Computer: SRV6 > > Description: > > The driver for device \Device\Harddisk0\DR0 delayed non-paging Io requests > > for 30 ms to recover from a low memory condition. > > > > For more information, see Help and Support Center at > > http://go.microsoft.com/fwlink/events.asp. > > Data: > > 0000: 04 00 00 00 02 00 52 00 ......R. > > 0008: 00 00 00 00 77 00 04 40 ....w..@ > > 0010: 00 00 00 00 00 00 00 00 ........ > > 0018: 00 00 00 00 00 00 00 00 ........ > > 0020: 00 00 00 00 00 00 00 00 ........ > > _______________________________________________ > > > > Event Type: Information > > Event Source: Disk > > Event Category: None > > Event ID: 119 > > Date: 9/17/2004 > > Time: 3:32:02 PM > > User: N/A > > Computer: SRV6 > > Description: > > The driver for device \Device\Harddisk1\DR1 delayed non-paging Io requests > > for 30 ms to recover from a low memory condition. > > > > For more information, see Help and Support Center at > > http://go.microsoft.com/fwlink/events.asp. > > Data: > > 0000: 04 00 00 00 02 00 52 00 ......R. > > 0008: 00 00 00 00 77 00 04 40 ....w..@ > > 0010: 00 00 00 00 00 00 00 00 ........ > > 0018: 00 00 00 00 00 00 00 00 ........ > > 0020: 00 00 00 00 00 00 00 00 ........ > > ___________________________________________________ > > > > Event Type: Error > > Event Source: Service Control Manager > > Event Category: None > > Event ID: 7034 > > Date: 9/17/2004 > > Time: 3:33:23 PM > > User: N/A > > Computer: SRV6 > > Description: > > The Microsoft Web Proxy service terminated unexpectedly. It has done this > 1 > > time(s). > > > > For more information, see Help and Support Center at > > http://go.microsoft.com/fwlink/events.asp. > > > > John Tolmachoff > > Engineer/Consultant/Owner > > eServices For You > > > > > > > > > > ------------------------------------------------------ > > List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist > > ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp > > ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ > > ------------------------------------------------------ > > Other Internet Software Marketing Sites: > > World of Windows Networking: http://www.windowsnetworking.com > > Leading Network Software Directory: http://www.serverfiles.com > > No.1 Exchange Server Resource Site: http://www.msexchange.org > > Windows Security Resource Site: http://www.windowsecurity.com/ > > Network Security Library: http://www.secinf.net/ > > Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com > > ------------------------------------------------------ > > You are currently subscribed to this ISAserver.org Discussion List as: > jim@xxxxxxxxxxxx > > To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist > > Report abuse to listadmin@xxxxxxxxxxxxx > > > > > > ------------------------------------------------------ > > List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist > > ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp > > ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ > > ------------------------------------------------------ > > Other Internet Software Marketing Sites: > > World of Windows Networking: http://www.windowsnetworking.com > > Leading Network Software Directory: http://www.serverfiles.com > > No.1 Exchange Server Resource Site: http://www.msexchange.org > > Windows Security Resource Site: http://www.windowsecurity.com/ > > Network Security Library: http://www.secinf.net/ > > Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com > > ------------------------------------------------------ > > You are currently subscribed to this ISAserver.org Discussion List as: > > johnlist@xxxxxxxxxxxxxxxxxxx > > To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist > > Report abuse to listadmin@xxxxxxxxxxxxx > > > ------------------------------------------------------ > List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist > ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp > ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ > ------------------------------------------------------ > Other Internet Software Marketing Sites: > World of Windows Networking: http://www.windowsnetworking.com > Leading Network Software Directory: http://www.serverfiles.com > No.1 Exchange Server Resource Site: http://www.msexchange.org > Windows Security Resource Site: http://www.windowsecurity.com/ > Network Security Library: http://www.secinf.net/ > Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com > ------------------------------------------------------ > You are currently subscribed to this ISAserver.org Discussion List as: jim@xxxxxxxxxxxx > To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist > Report abuse to listadmin@xxxxxxxxxxxxx > > > ------------------------------------------------------ > List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist > ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp > ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ > ------------------------------------------------------ > Other Internet Software Marketing Sites: > World of Windows Networking: http://www.windowsnetworking.com > Leading Network Software Directory: http://www.serverfiles.com > No.1 Exchange Server Resource Site: http://www.msexchange.org > Windows Security Resource Site: http://www.windowsecurity.com/ > Network Security Library: http://www.secinf.net/ > Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com > ------------------------------------------------------ > You are currently subscribed to this ISAserver.org Discussion List as: > johnlist@xxxxxxxxxxxxxxxxxxx > To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist > Report abuse to listadmin@xxxxxxxxxxxxx ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: World of Windows Networking: http://www.windowsnetworking.com Leading Network Software Directory: http://www.serverfiles.com No.1 Exchange Server Resource Site: http://www.msexchange.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: jim@xxxxxxxxxxxx To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist Report abuse to listadmin@xxxxxxxxxxxxx