Chris's BlogISA Server

ISA 2006 Remote SQL Logging “the data area passed to a system call is too small..”

Chris — Wed, 05 Aug 2009 02:26:04 +0000

I recently came across a very interesting problem while configuring ISA 2006 logging to a remote SQL server. If you have ever done this, you’ll no doubt know that its not a very complicated thing to do –in fact, Richard Hicks has a great guide on his blog, here. It really surprised me when I was not able to get it working, I’ve done it many times before and I have never had any problems.

I checked connectivity to my SQL server using telnet and the "Test” button when performing the configuration, everything seemed fine, but no data was appearing in the database

On the SQL server, a temp table was being created, no rows inserted and the stored proc to copy the rows from the temp table to the permanent one never got called. The session appeared to wait with "async_network_io"

After speaking to Microsoft and performing a ISA trace, it appeared that there is some buffer issue (insufficient buffer) when ISA is trying to insert the log record to the SQL server. It looked like the problem happened before writing to SQL. This also explained why there was no row inserted into the temp table, and the SP to move the record from temp table to permanent one had never been called.

It turns out that the string format call which generates an EXEC SP statement to insert log records only has a buffer of 100 characters and the combination of my server name and table name exceeded this. Shortening the table name fixed the problem.

Here is no comments yet by the time your rss reader get this, Do you want to be the first commentor? Hurry up

ISA 2006 Disable Lockdown on log failure

Chris — Wed, 29 Jul 2009 22:53:49 +0000

In Microsoft ISA Server, alerts can be configured to shut down the Microsoft Firewall service when situations that raise specific events occur. Whenever the Firewall service shuts down, ISA Server goes into lockdown mode, in which only specific types of traffic are allowed. ISA Server can leave lockdown mode only when the Firewall service is restarted. By default, the built-in Log failure alert shuts down the Firewall service. This alert is triggered by the Log failure event, which is raised when a logging failure occurs. You can prevent logging failures from causing ISA Server to go into lockdown by disabling the action of the Log failure alert that shuts down the Firewall service.

Microsoft have documented this on Microsoft Technet, although this solution is documented for ISA 2004, it seems to work just fine for ISA 2006. The only problem I encountered is that the script on Technet seems to have be “text wrapped” so it comes up with syntax errors.

***WARNING***

I am not in any way suggesting that this script should be run on your ISA servers. Lockdown mode is not a bug and was included in the product by design, there are many reasons why it is a good thing so my advice is that you consider all options very carefully before running this script. ALWAYS backup your configuration first!!

I have corrected the syntax errors, DisableLockdownOnLogFailure.vbs can be downloaded here

By the time your rss reader get this post here is 2 comments ,Welcome you come to leave your opinion !

ISA 2006 – High MSDE memory usage

Chris — Sun, 23 Nov 2008 23:42:59 +0000

I came across this issues on a ISA 2006 proxy server the other day. Basically, if you are logging to a MSDE database you may experience high memory usage by SQL server because the amount of physical memory that is allocated for SQL Server is not limited by default.

It is possible to limit the amount of physical memory that is allocated for SQL Server. Recommended values are:

System Memory – Setting

1 GB – 386 MB

2 GB – 512 MB

3 GB – 764 MB

4 GB – 1024 MB

For detailed information on how to set these limits, see the following Microsoft KB article

Here is no comments yet by the time your rss reader get this, Do you want to be the first commentor? Hurry up