Appendix C

Event Messages

Microsoft Internet Security and Acceleration (ISA) Server uses Event Viewer to record events that occur during its operation. You can use Event Viewer to monitor and troubleshoot events.

This section provides information about ISA Server events, including:

ID number. This is the number that identifies the event type. The event number helps technical support representatives track events in the system.

Event message. This is a description of the event that also appears on the property page for the event.

Explanation. This is a description of the possible cause of the event.

User action. This is a description of the actions you can take to solve or prevent the problem.

There are four severity levels for individual event messages:

Success

Informational

Warning

Error

Use Event Viewer to view the severity level or to view more information regarding individual messages. Successful events do not appear in Event Viewer.

In the following sections, event messages are grouped by category.

Alert Event Messages

These messages refer to events related to alerts in ISA Server.

Event ID: 14033

Event Message

Alert service did not start. Alerts are limited to event reporting. There might be a problem in the Microsoft ISA Server Control Service. Restart the service. The Firewall and Web Proxy services are dependent on this service, so you also need to restart them.

Event ID: 14040

Event Message

Mail Alert service stopped responding because Mapi.dll cannot be located.

Event ID: 14045

Event Message

Mail alert for %1 failed.

Event ID: 14050

Event Message

Mail alert %1 stopped because of a configuration error (%2).

Event ID: 14051

Event Message

Mail alert %1 (%2) stopped because it could not log on or connect to the server. The server may be down or incorrectly specified.

Event ID: 14052

Event Message

Mail alert %1 stopped because the mail server refused to accept the message.

Event ID: 14053

Event Message

Mail alert %1 stopped because the sender name is not valid.

Event ID: 14054

Event Message

Mail alert %1 stopped because the recipient name is not valid.

Event ID: 14064

Event Message

Unknown event %1 signaled the alert service. The reported event does not appear in storage. If you recently installed an application filter, it is probably the source of the error. Remove any application filters that have been installed recently. If this does not solve the problem, reinstall ISA Server.

Event ID: 14065

Event Message

Alert service: One or more of the actions associated with alert %1 has failed. The failure is linked to configuration settings. The mail server may be down, or the specified command may not exist. Check the Event Viewer for related errors and fix them accordingly.

Event ID: 14069

Event Message

The alert service found more then one alert with the same event condition, server name, and additional key. The duplicated alert '%1' is ignored. For more information about this event, see ISA Server Help.

Explanation

The alert duplication is the result of one or more configuration settings that are inconsistent or missing in the registry or Active Directory, depending on ISA Server configuration. This could be the result of an error in the configuration, an incomplete administration operation, or other internal errors. The actions in this duplicate alert are specified in the initial alert and are ignored by the service.

User Action

Delete the erroneous alert with ISA Management or a script. To locate the alert, use the name of the alert as it appears in the message.

Event ID: 14072

Event Message

The alert service failed to logon as user %2 to run the command %3 specified for the alert '%1'. The error code in the Data area of the event properties indicates the cause of the failure. For more information about this event, see ISA Server Help.

Explanation

Incorrect credentials can be caused by a misspelled user name, password, or domain name. It is also possible that the Windows 2000 password has changed and the password that is stored in ISA Server is now incorrect or that the domain name changed.

User Action

Verify that all the credentials for this alert are set correctly.

Event ID: 14144

Event Message

The alert service failed to initialize because system call %1 failed. Some information in the response may have already expired in the cache. If an error code is shown in the Data area of the event properties, it indicates the cause of the failure.

Event ID: 14180

Event Message

Alert Service: failed to log event to system log. The following message '%1' could not be logged.

Bandwidth Event Messages

These messages refer to events related to the bandwidth control in ISA Server.

Event ID: 13002

Event Message

Bandwidth control completed successfully.

Event ID: 13103

Event Message

Initialization of bandwidth control failed. The ISA Server that uses the bandwidth controller failed to initialize the client dynamic-link library (DLL). Look at previous event entries to find the reason for the failure.

Event ID: 13104

Event Message

The call to %1 failed. The failure is probably due to insufficient memory. Close some applications and try again. If that does not work, verify that Active Directory is working. For more information about managing memory resources, see Windows 2000 Help.

Event ID: 13105

Event Message

Insufficient memory for %1. The bandwidth control did not have sufficient memory resources. Close some applications and try again. For more information about managing memory resources, see Windows 2000 Help.

Event ID: 13106

Event Message

Cannot match IP to an interface. Flow control for the specified IP address did not take effect. If message was reported during network configuration changes it can be ignored. If you continue to receive this message, you may need to restart ISA services.

Cache Event Messages

These messages refer to events connected to ISA Server cache.

Event ID: 13107

Event Message

The Scheduled Content Download Service has stopped the job %1. %2 pages (objects) visited.

Event ID: 13108

Event Message

The Scheduled Content Download Service found an unauthorized URL and called unauthorized page %2 while executing the job %1.

Event ID: 13109

Event Message

The Scheduled Content Download Service was unable to connect to the Web Proxy Service while executing the job %1. Check that the Web Proxy Service is running using ISA Management. If not, start the service.

Event ID: 14094

Event Message

The Microsoft Scheduled Cache Content Download service cannot start because the ISA Server was installed in Firewall mode. Usually the Scheduled cache content download service is disabled if ISA Server is not installed in Cache or Integrated mode. It is possible that during the first boot after the Cache component was uninstalled, the service was started, and shortly after stopped. To use the service, reinstall ISA Server in Integrated or Cache mode.

Event ID: 14111

Event Message

ISA Server Cache could not start because it was configured incorrectly. Use ISA Management or manually edit the registry to correct the error, and then restart the service. For more information about this event, see ISA Server Help.

Explanation

The cache could not start because of incorrect settings in the cache configuration or conflicts with other configuration settings.

User Action

Stop the Web Proxy Service. In ISA Management, correct cache settings. To do this, in the ISA Management console tree, click Servers And Arrays, click Name, click Cache Configuration, click the HTTP tab, and then select the Restore Defaults check box. Restart the Web Proxy Service. If cache initialization still fails, run Setup and click Reinstall.

Event ID: 14137

Event Message

Some of this information may be out of date because of network problems. An attempt to respond to this request from a remote location was unsuccessful. The response is an expired version of the object found in the cache.

Event ID: 14138

Event Message

Some of this information has not been updated in the past 24 hours.

Event ID: 14140

Event Message

Some of this information may be out of date.

Event ID: 14150

Event Message

The ISA Server cache could not initialize the URL cache on disk. The ISA Server cache files are corrupted.

Event ID: 14151

Event Message

The ISA Server cache could not initialize the URL cache on disk. The ISA Server cache disk is full.

Event ID: 14164

Event Message

Cache drives failed to initialize properly. Caching is disabled. Identify the specific reason for failure from previous event logs. If previous events indicate that the error belongs to a specific drive, then check the drive configuration and then stop and restart the Web Proxy service to enable caching.

Event ID: 14165

Event Message

There is inconsistency in some cache files. While initializing cache, some cache files were detected as being from previous cache configurations. For more information about this event, see ISA Server Help.

Explanation

When changes are made to cache configurations some cache data may remain from old configurations and this can cause inconsistencies in cache data.

User Action

Identify warning events regarding data inconsistencies. To avoid inconsistent data retrieval, consider deleting the cache files that were added recently to the configuration. To apply changes, restart the Web Proxy service.

Event ID: 14166

Event Message

Cache is intentionally disconnected from the rest of the network. Information is now being served from the cache and there is no connection to the Internet at the present time.

Event ID: 14167

Event Message

Recovery of data cache file %1 was completed. If the operation did not complete successfully the error code in the Data area of the Event Viewer indicates the cause of the failure. All cache data is now available. Recovery operation result is: %2%0.

Event ID: 14168

Event Message

Some errors were encountered during the restoration of specific data cache files. For more information about this event, see ISA Server Help.

Explanation

Restoration of cache data file failed, only partial cache data may only be available. If an error code appears in the Data area of the event properties, it will indicate the cause of the failure. If the error code indicates that data is corrupt, then consider deleting the cache file. If error code does not indicate file corruption, stop and then restart the Web Proxy service to retry restoration of the cache file.

User Action

Identify warning events regarding data inconsistencies. To avoid inconsistent data retrieval, consider deleting the cache files that were recently added to the configuration. To apply changes, restart the Web Proxy service.

Event ID: 14169

Event Message

While restoring cache data, %1 objects with conflicting information were detected. These objects were ignored, and were not restored. This may occur when there is conflict between cache data from previous and present cache configurations. You may consider deleting the cache files that were added to the current configuration, in order to avoid inconsistent data retrieval.

Event ID: 14170

Event Message

Restoration of cache data completed. Cache performance will now be at optimal level.

Event ID: 14171

Event Message

Cache data was restored successfully from all data cache files.

Event ID: 14172

Event Message

Cache failed to initialize properly. Caching will be disabled. The error code in the Data area of the event properties indicates the cause of the failure. (internal code %2). Identify the specific reason for failure from previous relevant event logs. Fix the problem and restart the Web Proxy service to enable caching.

Event ID: 14173

Event Message

Path name too long for disk cache %1. Specify a shorter path name.

Event ID: 14174

Event Message

Invalid size specified for disk cache %1. Specify a valid disk cache size and restart the Web Proxy service.

Event ID: 14175

Event Message

Invalid volume specified for disk cache %1. The volume used as cache drive is invalid. The volume must be a NTFS volume with supported sector sizes. Specify a valid volume as a cache drive. You may need to change your hardware if the required sector size is not supported. Restart the Web Proxy service.

Event ID: 14176

Event Message

Disk cache %1 failed to initialize and is disabled. Identify the reason for cache failure by examining previous recorded events, or the error code. Once the problem has been fixed, restart the Web Proxy service to enable the cache. The error code in the Data area of the event properties indicates the cause of the failure (internal code: %2).

Event ID: 14184

Event Message

The Schedule Cache Content Download Service was stopped gracefully.

Event ID: 14185

Event Message

The Scheduled Cache Content Download Service was started successfully.

Common Service Event Messages

These messages refer to events common to ISA Server services.

Event ID: 11000

Event Message

%1 failed to start. The failure occurred during %5 because the configuration property %4 of the key %3 could not be accessed. Use the source location %6 to report the failure. The error code in the Data area of the event properties indicates the cause of the failure. For more information about this event, see ISA Server Help. The error description is: %2.

Explanation

The service failed to start because the data in the storage is corrupt, due to incorrect configuration of either the registry or Active Directory.

User Action

If a backup exists, in ISA Management click Servers And Arrays, then right-click Name, and choose Restore. This restores the configuration, except for server-specific configuration information, such as cache content. If this does not solve the problem, uninstall ISA Server from the Control Panel. When you uninstall, you lose all the configuration parameters and you have to reinstall ISA Server. Reinstalling ISA Server without uninstalling the previous copy does not resolve this problem.

Event ID: 11001

Event Message

%1 failed. The failure occurred during %5 because the configuration property %4 of the key %3 could not be accessed. Use the source location %6 to report the failure. The error code in the Data area of the event properties indicates the cause of the failure. For more information about this event, see ISA Server Help. The error description is: %2.

Explanation

The service failed to start because the data in the storage is corrupt, due to incorrect configuration of either the registry or Active Directory.

User Action

If a backup exists, in ISA Management click Servers And Arrays, then right-click Name, and choose Restore. This will restore the configuration, except for server-specific configuration information, such as cache content. If this does not solve the problem, uninstall ISA Server from the Control Panel. You will lose all the configuration parameters and will have to reinstall. Reinstalling a new copy of ISA Server without uninstalling the previous copy will not solve the problem.

Event ID: 11002

Event Message

%1 failed to start. The failure occurred during %5 because the configuration property %4 of key %3 is not valid. Use the source location %6 to report the failure. The error code in the Data area of the event properties indicates the cause of the failure. For more information about this event, see ISA Server Help. The error description is: %2.

Explanation

Service failed to start because the data in the storage is corrupt, due to incorrect configuration of either the registry or Active Directory.

User Action

If a backup exists, in ISA Management click Servers And Arrays, then right-click Name, and choose Restore. This will restore the configuration, except for server-specific configuration information, such as cache content. If this does not solve the problem, uninstall ISA Server from the Control Panel. You will lose all the configuration parameters and will have to reinstall. Reinstalling a new copy of ISA Server without uninstalling the previous copy will not solve the problem.

Event ID: 11003

Event Message

%1 failed. The failure occurred during %5 because the configuration property %4 of key %3 is not valid. Use the source location %6 to report the failure. For more information about this event, see ISA Server Help. The error code in the Data area of the event properties indicates the cause of the failure. For more information about this event, see ISA Server Help. The error description is: %2.

Explanation

Service failed to start because the data in the storage is corrupt, due to incorrect configuration of either the registry or Active Directory.

User Action

If a backup exists, in ISA Management click Servers And Arrays, then right-click Name, and choose Restore. This will restore the configuration, except for server-specific configuration information, such as cache content. If this does not solve the problem, uninstall ISA Server from the Control Panel. You will lose all the configuration parameters and will have to reinstall. Reinstalling a new copy of ISA Server without uninstalling the previous copy will not solve the problem.

Event ID: 11004

Event Message

%1 failed to start. The failure occurred during %4 because the system call %3 failed. Use the source location %5 to report the failure. The error code in the Data area of the event properties indicates the cause of the failure. For more information about this event, see ISA Server Help. The error description is: %2.

Explanation

The failure is due to a shortage of resources, probably memory.

User Action

Close other applications that are running. Use the Task Manager to check programs and processes that are using large amounts of system resources. Make sure that Active Directory is working. For more information about managing memory resources, see Windows 2000 Help.

Event ID: 11005

Event Message

%1 failed to start. The failure occurred during %4 because the system call %3 failed. Use the source location %5 to report the failure. The error code in the Data area of the event properties indicates the cause of the failure. For more information about this event, see ISA Server Help. The error description is: %2

Explanation

The failure is due to a shortage of resources, probably memory.

User Action

Close other applications that are running. Use the Task Manager to check programs and processes that are using large amounts of system resources. Make sure that Active Directory is working. For more information about managing memory resources, see Windows 2000 Help.

Event ID: 11006

Event Message

%1 failed to start. A shortage of available memory caused the service to fail during %2. Use the source location %3 to report the failure. For more information about this event, see ISA Server Help.

Explanation

Either the service or some processes are utilizing excessive memory resources.

User Action

Close other programs that are running. Use the Task Manager to check programs and processes that are using large amounts of system resources. For more information about managing memory resources, see Windows 2000 Help.

Event ID: 11007

Event Message

A shortage of available memory caused the %1 to fail during %2. Use the source location %3 to report the failure. For more information about this event, see ISA Server Help.

Explanation

Either the service or some processes are using excessive memory.

User Action

Close other programs that are running. Use the Task Manager to check programs and processes that are using large amounts of system resources. For more advice on managing memory resources, see Windows 2000 Help.

Event ID: 11008

Event Message

%1 failed to start. The service failed to register for storage notification on key during %3. Use the source location %4 to report the failure. The error code in the Data area of the event properties indicates the cause of the failure. For more information about this event, see ISA Server Help. The error description is: %2.

Explanation

The failure is probably due to insufficient memory or a problem accessing the storage.

User Action

Close other programs that are running. Use the Task Manager to check programs and processes that are using large amounts of system resources. For more information about managing memory resources, see Windows 2000 Help.

Event ID: 14048

Event Message

Failed to stop the %1 during %2. Use the source location %3 to report the failure. The error code in the Data area of the event properties indicates the cause of the failure. The computer should be restarted.

Event ID: 14077

Event Message

Failed to start the %1 during %2. Use the source location %3 to report the failure. The error code in the Data area of the event properties indicates the cause of the failure. For more information about this event, see ISA Server Help.

Explanation

Service failed to start.

User Action

Restart the service by doing one of the following:

In the ISA Management console tree, click Servers And Arrays, Name, Monitoring Configuration, click Services and then right-click the service and choose Start).

Click Start, point to Programs, point to Administrative Tools, and then click Services.

Look at the Event Viewer for errors regarding the failed service.

Event ID: 14079

Event Message

Due to an unexpected error, the service %1 stopped responding to all requests. This occurred %2 time(s) in the past %3 hours. Try to stop the service or kill the corresponding process if it does not respond, and start it again. Check the Event Viewer for related error messages.

Dial-up Connection Events

These messages refer to events related to dial-up connections in Microsoft Internet Security and Acceleration (ISA) Server.

Event ID: 14066

Event Message

Failed to read the dial-up entry configuration. The error code in the Data area of the event properties indicates the cause of the failure. For more information about this event, see ISA Server Help.

Explanation

This event is logged when the specified dial-up configuration or the Firewall service configuration cannot be recognized.

User Action

Check the configuration for dial-up entries in ISA Management and the Firewall service. To view the dial-up entries, in the ISA Management console tree, click Servers And Arrays, click Name, click Policy Elements, and then click Dial-up entries. To view the dial-up entries for the Firewall service, click Start, point to Programs, point to Administrative Tools, and then click Services.

Event ID: 14067

Event Message

Failed to load Rasapi32.dll. The system configuration is incorrect. Check the system configuration for errors. Manually dial an entry to verify that the dial-out works and then restart the failed service. The error code in the Data area of the event properties indicates the cause of the failure.

Event ID: 14136

Event Message

ISA Server dial-out connection failed. The administrator should manually dial the specified phonebook entry to determine if the number can be reached.

Event ID: 14142

Event Message

A dial-out to the Internet failed. The error code shown in the Data area of the event properties is specific to the Routing and Remote Access service (RRAS). For more information about this event, see ISA Server Help.

Explanation

This log entry or event is generated by the dial-up entry component of ISA Server when a dial-up attempt fails. The problem could be related to authentication.

User Action

The ISA Server administrator should verify that the specified phonebook entry in the dial-up entry configuration can be dialed manually. To do this, in the ISA Management console tree, click Servers And Arrays, click Name, click Policy Elements, and then click Dial-Up Entries. In addition, check authentication settings.

Firewall Service Event Messages

These messages refer to events connected with the ISA Server Firewall service.

Event ID: 14001

Event Message

Firewall Service failed to initialize. The internal error code in the Data area of the event properties indicates the cause of the failure. Previous event log entries might help determine the proper action.

Event ID: 14002

Event Message

The Firewall service cannot initialize WinSock. The error code in the Data area of the event properties indicates the cause of the failure. For more information about this event, see ISA Server Help.

Explanation

The Firewall service cannot start. The system is probably out of memory, or the registry might be corrupt.

User Action

Check the Firewall service configuration. To do this, click Start, point to Programs, point to Administrative Tools, and then click Component Services. Try to stop and restart the service. If this does not work, restart the computer.

Event ID: 14003

Event Message

Firewall service started.

Event ID: 14004

Event Message

The Firewall service cannot start due to a shortage of available memory. The error code in the Data area of the event properties indicates the cause of the failure. For more information about this event, see ISA Server Help.

Explanation

Either an application is using too much memory or the page file size is too small.

User Action

Close other programs that are running. Use the Task Manager to check programs and processes that are using large amounts of system resources. For more information about managing memory resources, see Windows 2000 Help.

Event ID: 14006

Event Message

The Firewall service cannot start the performance counters. Restart the Firewall service. The error code in the Data area of the event properties indicates the cause of the failure.

Event ID: 14007

Event Message

A shortage of available memory caused the Firewall service to fail. The Event Viewer Data window displays the number of active connections. For more information about this event, see ISA Server Help.

Explanation

The ISA Server computer cannot support additional connections for the server.

User Action

Check the number of current connections and reduce that number to an acceptable level. Close other programs that are running. Use the Task Manager to check programs and processes using large amounts of system resources. For more information about managing memory resources, see Windows 2000 Help.

Event ID: 14010

Event Message

The Firewall service did not start due to corrupt data in the registry or Active Directory, depending on the ISA Server configuration. The error code in the Data area of the event properties indicates the cause of the failure. For more information about this event, see ISA Server Help.

Explanation

The Firewall service did not start due to corrupted data in the registry or in the Active Directory configuration.

User Action

Wait a few minutes and then restart the service. If this does not work and a backup exists, in ISA Management click Servers And Arrays, then right-click Name, and choose Restore. This restores the configuration, except for server-specific configuration information, such as cache content. If this does not solve the problem, uninstall ISA Server from Control Panel. When you uninstall, you lose all the configuration parameters and you have to reinstall ISA Server. Reinstalling ISA Server without uninstalling the previous copy does not resolve this problem.

Event ID: 14011

Event Message

The Firewall service failed to bind its socket to %1, port %2. This could be caused by another service that is already using the same port or by the network interface that is not functional. The error code in the Data area of the event properties indicates the cause of the failure. For more information about this event, see ISA Server Help.

Explanation

Either the requested service port is already in use or there is a problem with the network interface.

User Action

Click Start, click Run and then type netstat -a to display statistics for the current TCP/IP connections. Check for port conflicts or network problems. Close the other application that is using the requested port. For more information about the Netstat command, see Windows 2000 Help.

Event ID: 14012

Event Message

Client from %1 attempted to access ISA Server using control protocol version %2. The server supports version %3. The version of the client software is incompatible with the server version. If the client software is older than the server software, upgrade the client software. If the server software is older, either upgrade the server or direct the client to a different server that uses the newer software.

Event ID: 14013

Event Message

The Firewall service requires Windows 2000 Server with Service Pack 1 or later.

Event ID: 14014

Event Message

The Firewall service requires Windows 2000 Server with Service Pack 1 or later.

Event ID: 14015

Event Message

The Firewall service failed to load a security dynamic-link library (DLL). The required DLL is missing or cannot be found. Make sure that the Security.dll is located in the Windows 2000 system directory (typically, %systemroot%\System32 directory), and then restart the Firewall service.

Event ID: 14016

Event Message

The Firewall service failed to determine the network addresses because either there are improper network connections or there is insufficient memory. Check network connections and restart the service. If this problem occurs again, close some applications, stop the service, and then restart the service.

Event ID: 14017

Event Message

Incorrect network configuration. The server address is not internal and is not in the Local Address Table (LAT). For more information about this event, see ISA Server Help.

Explanation

An Internet Protocol (IP) address configured for the internal network adapter for the server needs to be included within the Local Address Table (LAT) for the server.

User Action

To configure the Local Address Table (LAT), open ISA Management, click Network configuration and then click Local Address Table (LAT). To modify an existing LAT entry, in the ISA Management console tree, click Servers And Arrays, click Name, click Network Configuration, and then click the relevant LAT entry.

Event ID: 14021

Event Message

The Firewall service failed to initialize because the system call %1 failed. If an error code appears in the Data area of the event properties, it indicates the cause of the failure. For more information about this event, see ISA Server Help.

Explanation

The failure is probably due to insufficient memory or a problem accessing the storage.

User Action

Close other programs that are running. Use the Task Manager to check programs and processes that are using large amounts of system resources. Verify that Active Directory is working. For more information about managing memory resources, see Windows 2000 Help.

Event ID: 14028

Event Message

The Firewall service did not initialize the network dial-up entry. Try an alternative manual dial-up entry. If successful, retry the dial-up entry. If the problem still exists, restart the Firewall service. If this does not solve the problem, restart Windows 2000.

Event ID: 14029

Event Message

The Firewall service failed to create a socket. If an error code appears in the Data area of the event properties, it indicates the source of the failure.

Event ID: 14030

Event Message

The Firewall service failed to associate a control socket with a completion port.

Event ID: 14031

Event Message

The Firewall service failed to initialize control or refresh sockets.

Event ID: 14034

Event Message

The Firewall service did not listen on all Transmission Control Protocol (TCP) sockets. The reason for the failure of the service can be determined by examining previous event log entries.

Event ID: 14035

Event Message

The Firewall service failed to listen on the Transmission Control Protocol (TCP) socket bound to %1. The error code in the Data area of the event properties indicates the cause of the failure.

Event ID: 14036

Event Message

The IP address (or DNS name) %1, from configuration file %2, cannot be used to connect to the ISA Server. Use ISA Management to configure the IP address or DNS name to which Firewall clients should connect.

Event ID: 14048

Event Message

Failed to stop the %1 during %2. Use the source location %3 to report the failure. The error code in the Data area of the event properties indicates the cause of the failure. The computer should be restarted.

Event ID: 14055

Event Message

The Firewall service encountered an illegal operation (runtime error R6025), in a pure virtual function. To resolve this error, remove recently installed application filters and restart the service.

Event ID: 14056

Event Message

The application filter (%2, CLSID=%3) performed an illegal operation inside the Firewall service process at method %1. The Firewall service terminated. To resolve this error, remove recently installed application filters and restart the service. If this does not resolve the problem, contact the component vendor.

Event ID: 14057

Event Message

The Firewall service stopped because an application filter module %1 generated an exception code %3 in address %2 when function %4 was called. To resolve this error, remove recently installed application filters and restart the service.

Event ID: 14058

Event Message

The Firewall service cannot connect to another proxy server. Authentication was rejected. Check the credentials for the account that is used for proxy-to-proxy authentication.

Event ID: 14059

Event Message

The Firewall service cannot connect to another proxy server. Authentication failed. A chained proxy server or array member requires proxy-to-proxy authentication. Authentication failed because the credentials that were supplied were incorrect. Check authentication credentials and try again.

Event ID: 14060

Event Message

Cannot load an application filter %1 (%4). %2 failed with code 0x%3. To attempt to activate this application filter again, stop and restart the Firewall service.

Event ID: 14061

Event Message

The Firewall service detected that the upstream proxy server '%1' is not available. If the upstream proxy server %1 becomes available, you may proceed as usual. If it does not become available, check the status of the upstream proxy server.

Event ID: 14062

Event Message

The Firewall service detected that the upstream proxy '%1' is now available.

Event ID: 14063

Event Message

The Firewall service failed to initialize because of a corrupted registry. Error Code %1, Key='%2' Value='%3'. For more information about this event, see ISA Server Help.

Explanation

The Firewall Service failed to initialize because of a corrupted registry.

User Action

If a backup exists, in ISA Management click Servers And Arrays, then right-click Name, and choose Restore. This restores the configuration, except for server-specific configuration information, such as cache content. If this does not solve the problem, uninstall ISA Server from Control Panel. When you uninstall, you lose all the configuration parameters and you have to reinstall ISA Server. Reinstalling ISA Server without uninstalling the previous copy does not resolve this problem.

Event ID: 14071

Event Message

The Firewall service did not start because the application filter component %1 did not start on time. Reinstall the application filter. Contact the application filter vendor.

Event ID: 14093

Event Message

The Microsoft Firewall Service cannot start because the ISA Server was installed in Cache mode. Usually the Firewall service is disabled if ISA Server is not installed in Integrated or Firewall mode. It is possible that during the first boot after the Firewall component was uninstalled, the service was started, and shortly after stopped. To use the service, reinstall ISA Server in Integrated or Firewall mode.

Event ID: 14152

Event Message

A User Datagram Protocol (UDP) packet was dropped because it was larger than the maximum UDP packet allowed by the Firewall service.

Event ID: 14182

Event Message

The Firewall Service was stopped gracefully.

Winsock Error Code Messages

Event ID: 10000

Event Message

Name entered is too long. The name entered is either incorrect or has too many characters. Check that the name entered is a valid name. Type the name again and check that no added characters were included.

Event ID: 10001

Event Message

System is not ready.

Event ID: 10002

Event Message

Current version is not supported. For more information about this event, see ISA Server Help.

Explanation

The application is using a later version of Windows Sockets that is not supported.

User Action

Check to see if you have the WinSock dynamic-link library (DLL) that supports the version of the WinSock specification required by the application. If so, check if there is an older DLL in a folder in the path ahead of the folder containing the newer DLL. If not, obtain a later version of Windows Sockets.

Event ID: 10003

Event Message

Service cannot send after socket shutdown. For more information about this event, see ISA Server Help.

Explanation

The operation cannot be completed because the connection for this application has been closed.

User Action

Restart the application or place a new connection before retrying the operation.

Event ID: 10004

Event Message

An interrupted system call was received. For more information about this event, see ISA Server Help.

Explanation

The current connection was interrupted, and the socket operation did not complete as expected. The problem might be caused by the current application, or caused by a temporary problem or condition on the network.

User Action

Check the network connection for the computer or try reconnecting. If the problem continues, contact your network administrator.

Event ID: 10005

Event Message

Host was not found. For more information about this event, see ISA Server Help.

Explanation

The name you have used is not an official hostname or alias. Most WinSock implementations use domain name system (DNS) protocol for hostname to address resolution, although a few use Network Information System (NIS). Assuming you have a name server configured instead of or as well as a host table, a hostname resolution request causes a WinSock DLL to send an address query to the configured DNS server. If you have more than one server configured, the hostname query fails only after the WinSock DLL has queried all servers.

User Action

Check that you have a name server and/or host table configured. If you have a name server, use Ping to check that the server host is available. Check that DNS/NIS is running by trying to resolve another hostname you know should work. If you have using a host table exclusively, add the destination hostname and address to the table.

Event ID: 10006

Event Message

Try again. For more information about this event, see ISA Server Help.

Explanation

The server was temporarily unable to process the current request.

User Action

Reenter the request or renew the connection to the server (now or at a later time).

Event ID: 10007

Event Message

Nonrecoverable error encountered. For more information about this event, see ISA Server Help.

Explanation

The Firewall service encountered a fatal error. The name server encountered an error. Most WinSock implementations use domain name system (DNS) protocol for hostname to address resolution, although a few use Network Information System (NIS). Assuming you have a name server configured instead of or as well as a host table, a hostname resolution request causes a WinSock DLL to send an address query to the configured DNS server. If you have more than one server configured, the hostname query fails only after the WinSock DLL has queried all servers.

User Action

Try restarting the Firewall application on the client and initiating a new connection. You can also check that you have a name server and/or host table configured. If you have a name server, use Ping to check that the server host is available. Check that DNS/NIS is running by trying to resolve another hostname you know should work. If you have using a host table exclusively, add the destination hostname and address to the table.

Event ID: 10008

Event Message

No data record is available. For more information about this event, see ISA Server Help.

Explanation

For host resolution, the requested name is valid, but does not have an Internet IP address at the name server. For protocol or service resolution, the name or number was not found in the respective database. Most WinSock implementations use domain name system (DNS) protocol for hostname to address resolution, although a few use Network Information System (NIS).

User Action

Check that you have a name server(s) and/or host table configured. If you have a name server, use Ping to check that the server hosts are available. Check that the name resolution server application is running by trying to resolve another hostname you know should work. If you are using a host table exclusively, add the destination hostname and address to the table.

Event ID: 10009

Event Message

Bad file number encountered. For more infor-mation about this event, see ISA Server Help.

Explanation

The specified file number is not a valid file handle value or it does not refer to an open file. An attempt might have been made to write to a file or device opened for read-only access. Or, the socket input parameter is not a valid socket handle: either it never was valid; or it is a file handle (not a socket handle); or, if it was a socket handle, it has been closed.

User Action

If this message was displayed when you tried to open or write to a file, check the permissions on the file or directory that you were trying to open. Otherwise, no user action is required.

Event ID: 10010

Event Message

Operation would block. For more information about this event, see ISA Server Help.

Explanation

The socket is marked as nonblocking (that is, nonblocking operation mode), and the requested operation is not complete at this time. This is a temporary condition. Later calls to the same routine might complete normally.

User Action

Try the operation again later.

Event ID: 10011

Event Message

Operation is in progress. For more information about this event, see ISA Server Help.

Explanation

A blocking operation is outstanding. Only a single blocking operation can be outstanding per task (or thread). Any other function call, to this or any other socket, will fail with this error.

User Action

Handle this as a non-fatal error.

Event ID: 10012

Event Message

Operation is already in progress. For more information about this event, see ISA Server Help.

Explanation

The asynchronous operation you attempted to cancel has already been canceled.

User Action

None.

Event ID: 10013

Event Message

Bad network address encountered. For more information about this event, see ISA Server Help.

Explanation

The system detected an invalid address used as an argument of a call. This error can occur if the length of the buffer is too small. This error can also occur when an application passes an invalid pointer value.

User Action

For developers, check the return value from a memory allocation to be sure it succeeded. Always be sure to allocate enough space.

Event ID: 10014

Event Message

Destination address required. For more information about this event, see ISA Server Help.

Explanation

A required address was omitted from an operation on a socket. In order to connect to or send to a destination address, the address must be provided.

User Action

If a destination hostname was entered the application might have had a problem resolving the name. Check that you have a name server(s) and/or host table configured. If you are using a name server, use Ping to check that the server host(s) are available. Check that the name resolution server application is running by trying to resolve another hostname you know should work. If you are using a host table exclusively, add the destination hostname and address to the table.

Event ID: 10015

Event Message

Message is too long. For more information about this event, see ISA Server Help.

Explanation

A message sent on a socket was larger than the internal message buffer or some other network limit. Since the buffering requirements for sending datagrams are less than for receiving datagrams, it is conceivable that you can send a datagram larger than you can receive.

User Action

None.

Event ID: 10016

Event Message

Protocol family not supported. For more information about this event, see ISA Server Help.

Explanation

The protocol family has not been configured on the system or no implementation for it exists.

User Action

If you are using a third-party Transmission Control Protocol/Internet Protocol (TCP/IP), verify that it is compatible with Wsock32.dll. If you are using Microsoft TCP/IP, remove and reinstall TCP/IP. Or use another protocol that is compatible with Wsock32.dll.

Event ID: 10017

Event Message

Directory is not empty. For more information about this event, see ISA Server Help.

Explanation

The directory cannot be removed. It still contains other files or subdirectories.

User Action

Move or delete the other files or subdirectories and try the operation again.

Event ID: 10018

Event Message

EPROCLIM returned. A software error occurred. Too many processes are running simultaneously. Quit and restart the current application.

Event ID: 10019

Event Message

EUSERS returned. For more information about this event, see ISA Server Help.

Explanation

Inbound and outbound packets that include a Fully Qualified Domain Name longer than 255 characters cannot be processed by Windows 2000 Server. Such packets usually remain in the queue until the queue is flushed. Also, directory paths and file names cannot exceed 255 characters.

User Action

Verify that domain names do not exceed 255 characters. For example, if you are running Gopher, the domain name for e-mail addresses should be less than 255 characters. Also, verify that all directory paths and file names are less than 255 characters.

Event ID: 10020

Event Message

Disk quota exceeded. The operation required additional disk space that is not authorized by the server. Cancel the current disk operation and change file share permissions to allow more space for the current user.

Event ID: 10021

Event Message

ESTALE returned. An unexplained service error occurred in the current environment. Quit the application and restart it.

Event ID: 10022

Event Message

Invalid argument. For more information about this event, see ISA Server Help.

Explanation

An application passed an invalid input parameter in a function call. The error refers to content as well as a value (for example, it might occur when a pointer to a structure is invalid or when a value in a structure field is invalid). In some instances, it also refers to the current state of the socket input parameter.

User Action

Contact the vendor of the application that issued this message. A software patch might be available.

Event ID: 10023

Event Message

Too many open files. For more information about this event, see ISA Server Help.

Explanation

The network system has run out of socket handles. You might have too many WinSock applications running simultaneously, but this is unlikely because most network systems have many socket handles available. This message can also occur if an application opens and closes sockets often without closing them properly (that is, leaving them open as "orphans").

User Action

To recover the orphaned sockets, close and restart the application. You might have to quit all WinSock applications to force the WinSock DLL to unload.

Event ID: 10024

Event Message

Too many levels of symbolic links. A software error occurred. Contact the supplier of the current application.

Event ID: 10025

Event Message

The object is remote.

Event ID: 10026

Event Message

Socket operation was attempted on non-socket. For more information about this event, see ISA Server Help.

Explanation

The socket input parameter is not a valid socket handle. Either it was never valid; or it is a file handle (not a socket handle). If it is a socket handle, it has been closed.

User Action

For developers, use socket state in an application or handle this error as a non-fatal error.

Event ID: 10027

Event Message

Bad or unassigned address. For more information about this event, see ISA Server Help.

Explanation

The network address used for the remote server is invalid for the current network. An attempt was made to create a socket with a remote socket name (protocol, port and address).

User Action

Before retrying, verify that the address is typed correctly and that you can reach the remote network address from the local network.

Event ID: 10028

Event Message

Address is already in use. For more information about this event, see ISA Server Help.

Explanation

The requested address cannot be obtained because it is in use elsewhere on the network. Only one usage of each address is permitted. The "address" refers to the local "socket name," which is comprised of the following three elements: protocol, port-number, and IP address.

User Action

Verify that network address settings for the client are correct for the local network. Do not run two server applications of the same type on the same computer. For instance, this error occurs if you try to run two applications that connect to one FTP server. Check that the network address setting for the client is correct on the local machine and assign a different fixed network address to the client. Contact your network administrator to resolve problems of address duplication.

Event ID: 10029

Event Message

Address family is not supported by protocol family. For more information about this event, see ISA Server Help.

Explanation

An address incompatible with the requested protocol was used. For example, you might not be able to use NS addresses with ARPA Internet protocols.

User Action

Check that the address is in the correct format and has been typed correctly before retrying the operation. If the problem continues, contact the network administrator.

Event ID: 10030

Event Message

Socket type is not supported. For more information about this event, see ISA Server Help.

Explanation

The support for the socket type has not been configured on the system or no implementation for it exists.

User Action

Check that the correct transport protocol (for example, Transmission Control Protocol (TCP), User Datagram Protocol (UDP)) is selected for use with the current application and with the Firewall service. For developers, handle the request as a non-fatal error (if possible), since some WinSock calls can legally fail the request.

Event ID: 10031

Event Message

Protocol is not supported. For more information about this event, see ISA Server Help.

Explanation

The protocol selected for use with the current application is not supported for the Firewall service or has not been defined for this service. An incompatible protocol has been selected for establishing the connection.

User Action

Check that the protocol is defined for use with the Firewall service. Try again, using a different protocol. If you are using a third-party Transmission Control Protocol/Internet Protocol (TCP/IP), verify that it is compatible with Wsock32.dll. If you are using Microsoft TCP/IP, remove and reinstall TCP/IP. Or use another protocol that is compatible with Wsock32.dll. For developers, if you are trying to use an optional feature, handle the request as a non-fatal error (if possible), since some WinSock calls can legally fail the request.

Event ID: 10032

Event Message

No buffer space is supported. The WinSock implementation was unable to allocate additional memory to accommodate the function request. For more information about this event, see ISA Server Help.

Explanation

This error indicates a shortage of resources on your system. It can occur when you try to run too many applications simultaneously on your computer. An operation on a socket or pipe was not performed because the system lacked sufficient buffer space to buffer connection throughput or a queue was full. WinSock was unable to allocate additional memory to accommodate the function request. If this error tends to occur when you run certain applications, it might indicate that the applications do not properly return system resources (for example, memory). It might also indicate that you are not closing the applications correctly.

User Action

Close unnecessary applications. If you continue to get this message, close Windows 2000 and restart your computer. Also, verify that buffer space is adjusted for the server. For the Firewall service, check the server registry entries for User Datagram Protocol (UDP) or Transmission Control Protocol (TCP) buffer size and consider increasing these values.

Event ID: 10033

Event Message

Connection timed out. For more information about this event, see ISA Server Help.

Explanation

A connection cannot be placed between the client and the remote server within the preset time allowed for a response. (The time-out period is dependent on the communication protocol.) No connection was opened.

User Action

Verify that the remote server and the client are present on the network and configured properly. If the current client or application supports adjusted time-out values, you can also adjust the connection time-out interval. Check that the destination address is a valid IP address. If you used a hostname, check that it resolved to the correct address. If the hostname resolution uses a local host table, it is possible you resolved to an obsolete address. Try to ping the hostname. If a router is configured, check that the router is up and running (check by pinging it, and then ping an address on the other side of it). Use the Tracert command at the command prompt to determine the path to the destination address and to check that all the routers are functioning. Check your subnet mask. If you don't have the correct subnet mask, your network system might treat a local address as a remote address (so it forwards addresses on the local subnet to the router, rather than broadcasting an ARP request locally), or vice versa.

Event ID: 10034

Event Message

Socket is already connected. For more information about this event, see ISA Server Help.

Explanation

A connect request was made on an already connected socket.

User Action

Contact the vendor of the application. They might have a software patch to fix the problem.

Event ID: 10035

Event Message

Socket is not connected. For more information about this event, see ISA Server Help.

Explanation

A request to send or receive data was disallowed because the socket is not connected and (when sending on a datagram socket) no address was supplied. An application attempted an input/output network function call before establishing an association with a remote socket (i.e. before calling connect() or accept().)

User Action

Open a connection to the remote source using the current application. If you were previously connected, try reconnecting. Ping the remote host you were connected to. If it does not respond, it might be off-line or there might be a network problem along the way. If it does respond, then this problem might have been a transient one (so you can reconnect now), or the server application you were connected to might have terminated (so you might not be able to connect again). In addition, ping a local host to verify that your local network is still functioning. For a serial connection, ping your local router address. If you are on a serial connection, your local router is the IP address of the host you initially logged on to using SLIP or PPP. In addition, ping a host on the same subnet as the host you were connected to (if you know of one). This will verify that the destination network is functioning. Use the Tracert command at the command prompt to determine the path to the host you were connected to. This will not reveal too much unless you know the router addresses at the remote end, but it might help to identify if the problem is somewhere along the way.

Event ID: 10036

Event Message

Unsupported protocol option used. For more information about this event, see ISA Server Help.

Explanation

The application selected an unsupported protocol for this operation. Check the protocol settings.

User Action

For developers, check the parameters. Are you using an optional level or socket option that might not be supported on all WinSock implementations? If so, treat this as a non-fatal error and ignore it, if possible.

Event ID: 10037

Event Message

Connection reset by peer. For more information about this event, see ISA Server Help.

Explanation

A connection was forcibly closed by a peer. This normally results from a loss of the connection on the remote socket due to a time-out or a reboot. This error is also possible on a datagram socket. For instance, this error could result if your application sends a UDP datagram to a host, which rejects it by responding with an ICMP Port Unreachable.

User Action

You can attempt to reestablish the connection. Report the problem to your network administrator or check the connection logs for other servers on the network for more information. In addition you can ping the remote host you were connected to. If it does not respond, it might be off-line or there might be a network problem along the way. If it does respond, then this problem might have been a transient one (so you can reconnect now), or the server application you were connected to might have terminated (so you might not be able to connect again). You can also ping a local host to verify that your local network is still functioning. For a serial connection, ping your local router address. If you are on a serial connection, your local router is the IP address of the host you initially logged on to using SLIP or PPP. In addition, ping a host on the same subnet as the host you were connected to (if you know of one). This will verify that the destination network is functioning. Use the Tracert command at the command prompt to determine the path to the host you were connected to. This will not reveal too much unless you know the router addresses at the remote end, but it might help to identify if the problem is somewhere along the way.

Event ID: 10038

Event Message

Software caused connection to abort. For more information about this event, see ISA Server Help.

Explanation

This error can occur when the local network system aborts a connection, such as when WinSock closes an established connection after data retransmission fails (receiver never acknowledges data sent on a datastream socket).

User Action

Exit the application, restart and try to reconnect. You can also check the following:

Ping the remote host you were connected to. If it does not respond, it might be off-line or there might be a network problem along the way. If it does respond, then this problem might have been a transient one (so you can reconnect now), or the server application you were connected to might have terminated (so you might not be able to connect again).

Ping a local host to verify that your local network is still functioning (if on a serial connection, see next step)

Ping your local router address. If you are on a serial connection, your local router is the IP address of the host you initially logged on to using SLIP or PPP.

Ping a host on the same subnet as the host you were connected to (if you know of one). This will verify that the destination network is functioning.

Use the Tracert command at the command prompt to determine the path to the host you were connected to. This won't reveal too much unless you know the router addresses at the remote end, but it might help to identify if the problem is somewhere along the way.


Event ID: 10039

Event Message

Network is down. For more information about this event, see ISA Server Help.

Explanation

There are problems maintaining a connection to the local network. The current connection has failed because a socket operation encountered an unavailable network.

User Action

Check the client network connection or reconnect the client to the network. You can also check your WinSock, protocol stack, network driver, and network adapter configuration. If this message appears when you try to connect from other clients, check for problems in network cabling or termination, and verify that network hardware or software is not offline. Note that this error occurs rarely since a WinSock implementation cannot reliably detect hardware problems.

Event ID: 10040

Event Message

Network was reset. For more information about this event, see ISA Server Help.

Explanation

The host you were connected to crashed and rebooted or the network temporarily went down.

User Action

Check the following:

Ping the remote host you were connected to. If it does not respond, it might be off-line or there might be a network problem along the way. If it does respond, then this problem might have been a transient one (so you can reconnect now), or the server application you were connected to might have terminated (so you might not be able to connect again).

Ping a local host to verify that your local network is still functioning (if on a serial connection, see next step).

Ping your local router address. If you are on a serial connection, your local router is the IP address of the host you initially logged on to using SLIP or PPP.

Ping a host on the same subnet as the host you were onnected to (if you know of one). This will verify that the destination network is functioning.

Use the Tracert command at the command prompt to determine the path to the host you were connected to. This won't reveal too much unless you know the router addresses at the remote end, but it might help to identify if the problem is somewhere along the way.


Event ID: 10041

Event Message

Connection refused. For more information about this event, see ISA Server Help.

Explanation

No connection could be made because the target computer actively refused it. This usually results from trying to connect to a service that is inactive on the foreign host. You might have gone to the wrong host, or the server application you are trying to contact might not be running. In TCP, an attempt to connect (TCP SYN packet) caused the destination host to respond by returning a reset (TCP RST packet). If an application sends a UDP packet to a host that has no socket listening, the host may send by a ICMP Port Unreachable packet.

User Action

Check the destination address you are using. If you used a hostname, verify that it was resolved to the correct address. If your hostname resolution uses a local host table, it is possible the name was resolved to an obsolete address. It is also possible that the local services file has an incorrect port number (although this is unlikely). You can run netstat -a at the command line to check port configuration. You can verify that the remote computer is rejecting your connection attempt by checking the network statistics locally and to verify that you are receiving TCP resets or ICMP Port Unreachable packets each time you attempt to connect.

Event ID: 10042

Event Message

Host is down. For more information about this event, see ISA Server Help.

Explanation

The socket operation failed because the destination host was down.

User Action

Contact your network administrator to confirm the status of the remote host. Check the following:

Ping the remote host you were connected to. If it does not respond, it might be off-line or there might be a network problem along the way. If it does respond, then this problem might have been a transient one (so you can reconnect now), or the server application you were connected to might have terminated (so you might not be able to connect again).

Ping a local host to verify that your local network is still functioning (if on a serial connection, see next step).

Ping your local router address. If you are on a serial connection, your local router is the IP address of the host you initially logged on to using SLIP or PPP.

Ping a host on the same subnet as the host you were connected to (if you know of one). This will verify that the destination network is functioning.

Use the Tracert command at the command prompt to determine the path to the host you were connected to. This won't reveal too much unless you know the router addresses at the remote end, but it might help to identify if the problem is somewhere along the way.


Event ID: 10043

Event Message

Host is unreachable. For more information about this event, see ISA Server Help.

Explanation

The remote host cannot be reached at this time or has been shut down. A socket operation was attempted on an unreachable target host. The ICMP message means that the router cannot forward the IP datagram to the target host, possibly because it did not get a response to the ARP request (which might mean the destination host is down).

User Action

Try to ping the destination host, to see if you get the same results, which is likely. Check the destination address. Check whether you have a router configured in your network system (your WinSock implementation). Use the Tracert command at the command prompt to try to determine where the failure occurs along the route between your host and the destination host. You can also contact your network administrator to confirm the status of the remote host.

Event ID: 10044

Event Message

Protocol is the wrong type for socket. For more information about this event, see ISA Server Help.

Explanation

The application requires a socket call that is not supported by the current protocol settings for the client application. For example, you cannot use the ARPA Internet UDP protocol with the SOCK_STREAM socket type. This error occurs if you specifically reference a protocol that is not part of the Internet address family you are also referencing. An incompatible protocol has been selected for the socket. The device driver for the protocol stack might not be compatible with Wsock32.dll.

User Action

Check the current configuration for the protocol type in use for the remote connection and check the Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) configuration for the Firewall service. Also, if you are using a third-party Transmission Control Protocol/Internet Protocol (TCP/IP), verify that it is compatible with Wsock32.dll. If you are using Microsoft TCP/IP, remove and reinstall TCP/IP.

Event ID: 10045

Event Message

Operation is not supported on socket. For more information about this event, see ISA Server Help.

Explanation

The attempted operation was not supported for the type of object referenced. Usually this occurs when a file descriptor refers to a file or socket that cannot support this operation, for example, trying to accept a connection on a datagram socket. Or the device driver for the protocol stack might not be compatible with Wsock32.dll.

User Action

You can contact your network administrator to confirm the status of the remote host. If you are using a third-party Transmission Control Protocol/Internet Protocol (TCP/IP), verify that it is compatible with Wsock32.dll. If you are using Microsoft TCP/IP, remove and reinstall TCP/IP. Or use another protocol that is compatible with Wsock32.dll.

Event ID: 10046

Event Message

Internet Control Message Protocol (ICMP) network is unreachable. For more information about this event, see ISA Server Help.

Explanation

The local network system might generate this error if there is no default route configured. Typically though, WinSock generates this error when it receives a "host unreachable" Internet Control Message Protocol (ICMP) message from a router. Note: This error might also result if you are trying to send a multicast packet and the default gateway does not support multicast (check your interface configuration).

User Action

Investigate routers on local or remote networks to see that they are active and properly configured. Contact your network administrator to confirm the status of the remote host. Try to ping the destination host, to see if you get the same results, which is likely. Check the destination address. Check whether you have a router configured in your network system (your WinSock implementation). Use the Tracert command at the command prompt to try to determine where the failure occurs along the route between your host and the destination host.

Event ID: 10047

Event Message

Too many references used. The requested operation contained additional information that cannot be processed correctly through the remote connection. Retry the request, or contact the supplier for the current application.

Event ID: 10048

Event Message

Not owner. You do not have permission or ownership rights to access this remote shared resource. Ask the network administrator to check permissions.

Event ID: 10049

Event Message

No such file or directory exists. The requested file operation cannot be completed because the file or directory does not exist on the remote server. Check file or directory settings.

Event ID: 10050

Event Message

No such process exists. The requested operation is not recognized by the remote server. The operation might be the result of errors in data or invalid user input. Try the operation again.

Event ID: 10051

Event Message

System call interrupted. For more information about this event, see ISA Server Help.

Explanation

The current connection was interrupted, and the socket operation did not complete as expected. The problem might be with the current application, or a temporary problem or condition on the network.

User Action

Check the network connection for the computer or try to reconnect. If the problem continues, contact the network administrator to confirm the status of the remote host. For developers, be prepared to handle this error on any functions that reference blocking sockets, or any calls to blocking functions, if you allow the user to cancel a blocking call. You can handle it as a fatal error or non-fatal error, depending on the application and the context.

Event ID: 10052

Event Message

Input/Output (I/O) Error encountered. The problem might be caused by instability in the local system environment. Quit the application and restart the computer. Try the operation again.

Event ID: 10053

Event Message

No such device or address exists. For more information about this event, see ISA Server Help.

Explanation

The device or address cannot be located on the network.

User Action

Verify that the device name and address were entered correctly and that the device is operational. Verify that the address can reply to test utilities (for example, Ping) and is active on the network.

Event ID: 10054

Event Message

Argument list too long. The requested operation contained additional information or parameters that cannot be processed correctly through the current connection. Retry the request.

Event ID: 10055

Event Message

Executed format error. A software error has occurred. Retry the operation.

Event ID: 10056

Event Message

Bad file number encountered. For more information about this event, see ISA Server Help.

Explanation

The specified file number might not be a valid file handle value or it does not refer to an open file. An attempt might have been made to write to a file or device opened for read-only access. Or, the socket input parameter is not a valid socket handle: either it never was valid or it is a file handle (that is, not a socket handle). If it is a socket handle, it has been closed.

User Action

If this message was displayed when you tried to open or write to a file, check the permissions on the file or directory that you were trying to open. Otherwise, no user action is required.

Event ID: 10057

Event Message

No children exist for parent object.

Event ID: 10058

Event Message

Operation would block one in progress. For more information about this event, see ISA Server Help.

Explanation

The requested operation would prevent an operation already in progress from completing. WinSock only allows a single blocking operation to be outstanding per task (or thread). It means that there is a blocking operation outstanding. It is also possible that WinSock might return this error after an application calls connect() a second time on a non-blocking socket while the connection is pending.

User Action

Wait for the system to complete the processing of the current operation, or cancel the current operation before retrying. If this does not work, then contact the vendor of the application that issued this message. They might have a software patch to fix this problem. For developers, handle this as a non-fatal error. Any application that uses a blocking socket or calls any blocking functions must handle this error.

Event ID: 10059

Event Message

Not enough memory is available. For more information about this event, see ISA Server Help.

Explanation

There is a shortage of memory resources.

User Action

Close other applications that are not in use before retrying. In Task Manager, identify applications that are consuming memory resources. For more information about managing memory resources, see Windows 2000 Help.

Event ID: 10060

Event Message

Permission denied. The remote server refused access to the requested resource. Contact the administrator for the remote server and report the problem.

Event ID: 10061

Event Message

Bad address encountered. For more information about this event, see ISA Server Help.

Event ID: 10062

Event Message

Mount device or directory is busy. The remote server drive is unavailable or is out of space. Wait and retry the requested operation.

Event ID: 10063

Event Message

File already exists. The attempt to create or save a file on the remote server cannot be completed because a file of the same name already exists. Save the new file under a different name, or rename the old file.

Event ID: 10064

Event Message

A cross-device link exists. A device on the remote server system that is required for this operation cannot be accessed for the current connection. Confirm that the device is available and is not already in use by other connected sessions.

Event ID: 10065

Event Message

No such device exists. The device or address entered cannot be located on the network. Make sure that the device name or address has been entered correctly and that the device is operational and configured properly on the client computer.

Event ID: 10066

Event Message

Is not a directory. A file object has been selected for the current operation where a directory was expected. Select a directory to complete this operation, or cancel the operation.

Event ID: 10067

Event Message

Is a directory. A directory object has been selected for the current operation where a file was expected. Select a file to complete this operation, or cancel the operation.

Event ID: 10068

Event Message

Invalid argument used. For more information about this event, see ISA Server Help.

Explanation

The requested operation contained additional information or parameters that cannot be processed correctly through the current connection. An application passed an invalid input parameter in a function call. The error refers to content as well as a value (e.g. it might occur when a pointer to a structure is invalid or when a value in a structure field is invalid). In some instances, it also refers to the current state of the socket input parameter.

User Action

Retry the request. If this does not solve the problem then contact the vendor of the application that issued this message. The vendor might have a software patch to fix this problem.

Event ID: 10069

Event Message

File table has overflowed. For more information about this event, see ISA Server Help.

Explanation

The current operation has exceeded available disk capacity or other resources on the system.

User Action

Clear the message and verify that sufficient disk space and resources are available on the local system before retrying.

Event ID: 10070

Event Message

Too many files are open. For more information about this event, see ISA Server Help.

Explanation

The system defines the number of file descriptors that any process can open at one time. That number has been reached and no more files can be opened. You might have too many WinSock applications running simultaneously, but this is unlikely because most network systems have many socket handles available. This message can also occur if an application opens and closes sockets often without closing them properly (that is, leaving them open as "orphans").

User Action

To recover the orphaned sockets, close and restart the application. You might have to quit all WinSock applications to force the WinSock DLL to unload.

Event ID: 10071

Event Message

Is not a typewriter. The current configuration does not support the attempted method of input. Check application instructions or contact the supplier of the application and report the problem.

Event ID: 10072

Event Message

File is too large. A disk restriction did not permit the file operation to be completed. A disk quota might be set for the destination folder, or there is a lack of available space on the targeted drive. Verify that sufficient space is available on the drive and that the folder does not have disk space restrictions.

Event ID: 10073

Event Message

No space is left on device. There is a lack of available space on the destination drive. The file copy operation cannot be completed, possibly because a disk quota has been set for the destination folder path. Make sure that the amount of disk space is sufficient on the destination drive and the folder does not have disk-space restrictions.

Event ID: 10074

Event Message

Illegal seek performed. There is an error in shared file permissions or possible errors in the file table. Verify that permissions are set. If the problem continues, verify the integrity of the disk by using appropriate utilities for the disk operating system that is in use.

Event ID: 10075

Event Message

Read-only file system in use. For more information about this event, see ISA Server Help.

Explanation

The file system that is selected for a file copy or transfer operation does not allow write modification. Permissions might be in effect to prohibit write access, or the drive media might be of a type that does not permit write access.

User Action

Verify that the drive is using a media type that supports write access, and that write permissions are assigned and in effect.

Event ID: 10076

Event Message

Too many links used. You have reached the maximum number of links that can be opened. Close other connections or applications and retry the operation. If the problem continues, report it to the application supplier.

Event ID: 10077

Event Message

Pipe has broken. The current operation was suspended because the data or connection is experiencing a failing network connection or errors on the network. Reconnect to the remote source. If the problem continues, check for further errors on the network or excessive traffic on the network segment.

Event ID: 10078

Event Message

Math argument used. The input for the current operation was of an invalid type or unexpected for the current application, possibly because of an error in the data or software-based restrictions. Enter the data again. If the problem continues, report the problem to the application supplier.

Event ID: 10079

Event Message

Result is too large. The output for the current operation was invalid for the system or application, possibly because of an error in the data or because of software-based restrictions. Enter the data again. If the problem continues, report the problem to the application supplier.

Event ID: 10080

Event Message

A resource deadlock would occur. The requested operation cannot be completed because sufficient resources do not exist or are not available on the local system. Close other applications to free resources or restart the system. If the problem continues, check your computer configuration.

Event ID: 10081

Event Message

No message of desired type exists. A message cannot be located, or the current application does not support messages of this type. Verify that the message exists at the expected source location. If a message exists, report the problem to the application supplier or see the application's documentation.

Event ID: 10082

Event Message

Identifier removed. For more information about this event, see ISA Server Help.

Explanation

Some identifying information for the connecting socket is missing or was parsed in communications transfer or operation. The cause might be a software problem or an intermediate device used to service the connection.

User Action

Retry the operation. If the problem continues, contact the application supplier to report the problem and obtain an updated file or workaround. Also, when troubleshooting the network, check for invalid packet errors. If unusual numbers of errors are occurring, interference on cabling or data lines could be causing the problem.

Event ID: 10083

Event Message

Channel number is out of range. A port or protocol error has occurred in the application or network environment. Check that all service ports are defined correctly for the application and the Firewall service. If the problem continues, contact the application supplier to report the problem and obtain an updated file or workaround.

Event ID: 10084

Event Message

Level 2 is not synchronized. There is a data line problem for the currently connected operation, possibly because of noise or interference on the line. Check for performance problems or further errors on the line. For further assistance in resolving the problem, report the line problem to your appropriate service provider.

Event ID: 10085

Event Message

Level 3 halted. The network has been stopped. The current connection probably failed. Check the client network connection or have the client reconnect to the network. If the message is repeated for other clients, check for problems in network cabling or termination. Or, check that network hardware or software has not been stopped.

Event ID: 10086

Event Message

Level 3 reset. The network has been reset, probably because an intermediate network host servicing the current connection (for example, a router) was reset. The current connection has failed. Reestablish the remote connection. If the problem continues, check for errors or excess traffic on the network.

Event ID: 10087

Event Message

Link number is out of range. The number specified for linking is invalid. The link is broken. Attempt to re-create the link by using the options within the application. If the problem continues, contact the application supplier to report the problem and obtain an updated file or workaround.

Event ID: 10088

Event Message

Protocol driver is not attached. There is no driver for a supported protocol bound to the network adapter on the local computer. Check the network configuration for the local computer. Verify that a supported network protocol for the Firewall service is bound to the network adapter.

Event ID: 10089

Event Message

No CSI structure is available. A required, specialized component is missing. The operation cannot be completed within the active application. For further assistance in resolving the problem, contact the application supplier to report the problem and obtain an updated file or workaround.

Event ID: 10090

Event Message

Level 2 halted. A problem has occurred at the data-link level, or the link connection has been cleared. Check for errors logged for data link or data communications hardware devices. For further assistance in resolving the problem, report the line to the appropriate service provider.

Event ID: 10091

Event Message

An invalid exchange was made. There is an error in the data, or an exchange between the remote server and the client has been attempted that is not allowed within the software. Reenter the data and retry the operation. If the problem continues, contact the supplier of the current application to report the problem and obtain a fix or workaround.

Event ID: 10092

Event Message

Invalid request descriptor used. There is an error in the data, or an exchange between the remote server and the client has been attempted that is not allowed within the software. Reenter the data and retry the operation. If the problem continues, contact the supplier of the current application to report the problem and obtain a fix or workaround for the problem.

Event ID: 10093

Event Message

Exchange is full. There is an error in the data, or an exchange between the remote server and the client has been attempted that cannot be completed. The system might be too busy to process the request at this time. Retry the operation later. If the problem continues, contact the application supplier to report the problem and obtain an updated file or workaround.

Event ID: 10094

Event Message

No anode exists. There is an error in the data or an exchange between the remote server and the client has been attempted that is not allowed within the software. Reenter the data and retry the operation. If the problem continues, contact the application supplier to report the problem and obtain an updated file or workaround.

Event ID: 10095

Event Message

Invalid request code used. For more information about this event, see ISA Server Help.

Explanation

The requested operation is not recognized or supported by protocol services that are in use between the remote server and the client.

User Action

Confirm that the protocol and port types are correctly configured for the Firewall service and for use with the current application. Specifically, verify that any port types (that is, User Datagram Protocol (UDP) or Transmission Control Protocol (TCP)), port initial direction (that is, inbound or outbound), and port numbers in use for the connection. If the problem cannot be traced to port settings or if the problem continues, report the problem to the application supplier.

Event ID: 10096

Event Message

Invalid slot used. A configuration error in hardware settings has been applied by the current operation. Review the settings used for hardware device access or communication within the application to ensure that the settings are correct.

Event ID: 10097

Event Message

Bad font file format used. A font file is of incorrect format or is outdated. To report the problem and obtain an updated file or workaround, contact the application supplier to report the problem and obtain an updated file or workaround.

Event ID: 10098

Event Message

Device is not a stream. There is an error in the data, or an exchange between the remote server and the client has been attempted that is not allowed within the software. Reenter the data and try the operation again. If the problem continues, contact the application supplier to report the problem and obtain an updated file or workaround.

Event ID: 10099

Event Message

No data was found. No data was received to complete the current operation. Enter the data again and retry the operation. If the problem continues, verify that the connection to the network is still active.

Event ID: 10100

Event Message

Timer has expired.

Event ID: 10101

Event Message

System is out of streams resources. Insufficient streams buffers are available, or a buffer overrun has occurred. Increase the buffer count for streaming protocol (that is, Transmission Control Protocol (TCP)) or modify the connection rate.

Event ID: 10102

Event Message

Machine is not on network. The local computer is not connected to the network. Connection to the network must be made before the request can be processed.

Event ID: 10103

Event Message

Package is not installed. The requested application feature is not currently installed. Reinstall the application or upgrade to install the missing application feature. For more information, see the application documentation.

Event ID: 10104

Event Message

The object is remote. For more information about this event, see ISA Server Help.

Explanation

The selected object cannot be used for the current operation because it is not locally sourced. The attempt to operate on the remote object was not completed.

User Action


Check that the WinSock DLL (WinSock.dll or Wsock32.dll) is in the current path.

Check that the WinSock DLL file is from the same vendor as your underlying protocol stack. (WinSock DLL files must be supplied by the vendor who provided your underlying protocol stack).

You cannot use more than one WinSock implementation simultaneously. If you have more than one WinSock DLL file on your system, be sure the first one in the path is appropriate for the network subsystem currently loaded.

Check your WinSock implementation documentation to be sure all necessary components are currently installed and configured correctly.


Event ID: 10105

Event Message

The link has been severed. The current connection has been broken. Quit the application and check for other related communications hardware and software failures on the local computer. Restart the application and try to connect again. If the problem continues, check for other failures on the network or verify that the remote server has not been shut down or removed from the network.

Event ID: 10106

Event Message

Advertise error occurred. For more information about this event, see ISA Server Help.

Explanation

A network shared resource cannot advertise service on the local network. Possibly, network or routing problems, or packet filtering is being applied.

User Action

Verify that the network is online. Also, verify that any required routing advertising protocols, such as Routing Information Protocol (RIP) or Service Advertising Protocol (SAP), are implemented properly on the network and that the current application requires these routing services. Use other utilities to verify that the shared resource can be accessed or browsed from the network.

Event ID: 10107

Event Message

Server mount error occurred. The server is advertising on the network, but a resource on the server is not mounted or is otherwise unavailable. Check for hardware failure on the remote server or to verify that the requested server resource is mounted.

Event ID: 10108

Event Message

Communication error in sending. An error occurred in sending information between the remote server and the local client. Retry the requested communication. If the problem continues, check for network errors. If there are no significant errors on the network, contact the application supplier to report the problem.

Event ID: 10109

Event Message

Protocol error encountered. A protocol error has occurred in the application or network environment. Check that all service ports are defined correctly for the application and the Firewall service. If the problem continues, contact the application supplier.

Event ID: 10110

Event Message

Multihop attempted. For more information about this event, see ISA Server Help.

Explanation

The remote connection attempted to cross an excessive number of intermediate routes between devices. If the connection has multiple routers available for forwarding, this might indicate a problem in other network forwarding devices, such as routers or bridges on the network.

User Action

Check that the maximum number of hops allowed for the protocol service with this connection is sufficient. Also, use network monitoring tools to check statistics on bridges or routers to see if excessive hop counts have been obtained.

Event ID: 10111

Event Message

Inode is remote. Input for the current operation cannot be obtained from a remote source. Contact the supplier of the current application to obtain and report the problem.

Event ID: 10112

Event Message

Cross mount point achieved.

Event ID: 10113

Event Message

Trying to read unreadable message. The message input has errors or is of an incorrect type to be processed by this operation. Check the message data for errors or report the problem to the supplier of the current application.

Event ID: 10114

Event Message

Log name used is not unique. For more information about this event, see ISA Server Help.

Explanation

The service is attempting to name a log by using a file name that is already in use at the service logging path.

User Action

Rename or delete the previous log file or select a different name for the new log file.

Event ID: 10115

Event Message

Remote address changed. The network address for the remote server has been changed to a different address. Reconnect to the remote server, or contact the administrator for the remote server to obtain more information about this problem.

Event ID: 10116

Event Message

Can't access a needed shared library. Software components installed or called by the current application are missing or corrupted. Or, there might be disk errors. Reinstall the current application and retry the current operation. If the problem continues, contact the application supplier to obtain an update, fix, or workaround.

Event ID: 10117

Event Message

Accessing a corrupted shared library. There might be disk errors on the remote drive. In some cases, the file system might be of an unrecognized or unsupported type for the current application or platform. Check that the remote disk drive is not corrupted, and review the installation requirements for the current application.

Event ID: 10118

Event Message

Library section in code file corrupted. Software components installed or called by the current application are missing or corrupted, or there might be disk errors. Reinstall the current application and check the system for disk errors by using disk utilities appropriate for the current disk operating system. If the problem continues, contact the application supplier to obtain an update, fix, or workaround.

Event ID: 10119

Event Message

Attempting to link in too many libraries. For more information about this event, see ISA Server Help.

Explanation

The current operation is attempting to link to libraries that are not permitted by the system or application.

User Action

Check that the current platform meets the application manufacturer's requirements for installation and that any special additional software and configuration changes have been implemented. If the problem continues, contact the application supplier to obtain an update, fix, or workaround for the problem.

Event ID: 10120

Event Message

Attempting to execute a shared library. An incorrect file type was specified for execution on the system, possibly because a required shared library is missing. Reinstall the current application to restore missing libraries or components. If the problem continues, contact the application supplier to obtain an update, fix, or workaround.

Event ID: 10121

Event Message

Socket operation attempted on non-socket.

Event ID: 10122

Event Message

Cannot assign requested address. For more information about this event, see ISA Server Help.

Explanation

A request for a server-provided address was not honored. The address might already be in use elsewhere on the network, or there might not be addresses left to assign for the local subnetwork. This error normally results from an attempt to create a socket with an address found on another computer. The "address" it refers to is the remote socket name (protocol, port, and address).

User Action

Check the network address configuration to verify that the client is configured for dynamic addressing or assign a different address for the client. For networks using DHCP dynamic addressing for clients, check that there are addresses available to assign in the available address pool.

Event ID: 10123

Event Message

Address is already in use. For more information about this event, see ISA Server Help.

Explanation

The requested address cannot be obtained because it is in use elsewhere on the network. Only one usage of each address is permitted. The "address" refers to the local "socket name," which is comprised of the following three elements: protocol, port number, and IP address.

User Action

Check that network address settings for the client are correct for the local network. Assign a different fixed network address to the client. Contact your network administrator for further assistance in resolving address duplication on the local network. Do not run two server applications of the same type on the same computer. For instance, this error occurs if you try to run two applications that connect to one FTP server.

Event ID: 10124

Event Message

Address family is not supported by protocol family. For more information about this event, see ISA Server Help.

Explanation

The network address provided is not correct or is not supported for the local network. An address incompatible with the requested protocol was used. For example, you might not be able to use NS addresses with ARPA Internet protocols.

User Action

Make sure that the address is of the correct format and has been typed correctly before retrying the operation. If the problem continues, report the problem to your network administrator or to your technical support team.

Event ID: 10125

Event Message

Socket type is not supported. For more information about this event, see ISA Server Help.

Explanation

The support for the socket type has not been configured on the system or no implementation for it exists. You can expect this error if a WinSock implementation does not support socket type SOCK_RAW, for example, within the Internet address family (AF_INET).

User Action

For developers, handle the request as a non-fatal error (if possible), since some WinSock calls can legally fail the request.

Event ID: 10126

Event Message

Protocol is not supported. For more information about this event, see ISA Server Help.

Explanation

The protocol selected for use with the current application is not supported for the Firewall service, or has not been defined for the service. The support for the socket type has not been configured for the system, or no implementation of it exists.

User Action

Check that the protocol used for the current application has been added, or defined correctly for use with the Firewall service.

Event ID: 10127

Event Message

No buffer space is available. There is no buffer space available to maintain the current streamed connection. Allocate space for streams buffers on the server. For more information about setting Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) buffer size for clients by using the registry on the server, see Windows 2000 Help.

Event ID: 10128

Event Message

Connection timed out. For more information about this event, see ISA Server Help.

Explanation

A connect or send request failed because the connected party did not properly respond after a period of time. (The time-out period is dependent on the communication protocol.)

User Action

Check that the destination address is a valid IP address. If you used a hostname, check that it resolved to the correct address. If the hostname resolution uses a local host table, it is possible you resolved to an obsolete address. Try to ping the hostname. Is a router configured? Check that the router is up and running (check by pinging it, and then ping an address on the other side of it). Use the Tracert command at the command prompt to determine the path to the destination address and to check that all the routers are functioning. Check your subnet mask. If you do not have the correct subnet mask, your network system might treat a local address as a remote address (so it forwards addresses on the local subnet to the router, rather than broadcasting an ARP request locally), or vice versa.

Event ID: 10129

Event Message

Socket is already connected. For more information about this event, see ISA Server Help.

Explanation

The current operation is unnecessary. A connect request was made on an already connected socket.

User Action

Contact the vendor of the application. They might have a software patch to fix the problem. For developers, make your application more portable with datagram sockets that do not use connect() and sendto() on the same datagram socket in an application, and always "disconnect" before calling connect() more than once. With datastream sockets, do not call connect() more than once (use select() or WSAAsyncSelect() to detect connection completion).

Event ID: 10130

Event Message

Socket is not connected. For more information about this event, see ISA Server Help.

Explanation

The current operation cannot be completed because the remote connection has been lost or was not made. A request to send or receive data was disallowed because the socket is not connected and (when sending on a datagram socket) no address was supplied. An application attempted an input/output network function call before establishing an association with a remote socket (i.e. before calling connect() or accept()).

User Action

Check the following:

Ping the remote host you were connected to. If it doesn't respond, it might be off-line or there might be a network problem along the way. If it does respond, then this problem might have been a transient one (so you can reconnect now), or the server application you were connected to might have terminated (so you might not be able to connect again).

Ping a local host to verify that your local network is still functioning (if on a serial connection, see next step).

Ping your local router address. If you are on a serial connection, your local router is the IP address of the host you initially logged on to using SLIP or PPP.

Ping a host on the same subnet as the host you were connected to (if you know of one). This will verify that the destination network is functioning.

Use the Tracert command at the command prompt to determine the path to the host you were connected to. This will not reveal too much unless you know the router addresses at the remote end, but it might help to identify if the problem is somewhere along the way.


Event ID: 10131

Event Message

Bad protocol option used. For more information about this event, see ISA Server Help.

Explanation

The application has selected an unsupported protocol for use with this operation.

User Action

Check your application for protocol settings, or review the documentation included with the application on how to review or change the current settings. If the problem continues, contact the supplier of the current application. For developers, check the parameters. Are you using an optional level or socket option that might not be supported on all WinSock implementations? If so, treat this as a non-fatal error and ignore it, if possible.

Event ID: 10132

Event Message

Connection reset by peer. For more information about this event, see ISA Server Help.

Explanation

The current connection has been closed by another peer user or peer server process. This normally results from a lost connection on the remote socket due to a time-out or a reboot.

User Action

You can attempt to reestablish the connection. Check the following:

Ping the remote host you were connected to. If it does not respond, it might be off-line or there might be a network problem along the way. If it does respond, then this problem might have been a transient one (so you can reconnect now), or the server application you were connected to might have terminated (so you might not be able to connect again).

Ping a local host to verify that your local network is still functioning (if on a serial connection, see next step).

Ping your local router address. If you are on a serial connection, your local router is the IP address of the host you initially logged on to using SLIP or PPP.

Ping a host on the same subnet as the host you were connected to (if you know of one). This will verify that the destination network is functioning.

Use the Tracert command at the command prompt to determine the path to the host you were connected to. This will not reveal too much unless you know the router addresses at the remote end, but it might help to identify if the problem is somewhere along the way. Report the problem to your network administrator, or check the connection logs for other servers on the network for more information.


Event ID: 10133

Event Message

Software caused connection to abort. For more information about this event, see ISA Server Help.

Explanation

Another application process has caused the current connection to fail. This error can occur when the local network system aborts a connection, such as when WinSock closes an established connection after data retransmission fails (receiver never acknowledges data sent on a datastream socket).

User Action

Check the following:

Ping the remote host you were connected to. If it does not respond, it might be off-line or there might be a network problem along the way. If it does respond, then this problem might have been a transient one (so you can reconnect now), or the server application you were connected to might have terminated (so you might not be able to connect again).

Ping a local host to verify that your local network is still functioning (if on a serial connection, see next step).

Ping your local router address. If you are on a serial connection, your local router is the IP address of the host you initially logged on to using SLIP or PPP.

Ping a host on the same subnet as the host you were connected to (if you know of one). This will verify that the destination network is functioning.

Use the Tracert command at the command prompt to determine the path to the host you were connected to. This will not reveal too much unless you know the router addresses at the remote end, but it might help to identify if the problem is somewhere along the way. Exit and restart the application, then reconnect. If the problem continues, report it to the supplier of the current application.


Event ID: 10134

Event Message

Network is down. For more information about this event, see ISA Server Help.

Explanation

There are problems maintaining a connection to the local network. The current connection has failed. A socket operation encountered an unavailable network.

User Action

Check the client network connection or have the client reconnect to the network. If the message is repeated for other clients, check for problems in network cabling or termination, or that network hardware or software has not been taken offline. Check your WinSock, protocol stack, network driver, and network adapter configuration. Note that this error occurs rarely since a WinSock implementation cannot reliably detect hardware problems.

Event ID: 10135

Event Message

Connection refused. For more information about this event, see ISA Server Help.

Explanation

No connection could be made because the target computer actively refused it. This usually results from trying to connect to a service that is inactive on the foreign host. You might have gone to the wrong host, or the server application you are trying to contact might not be running.

User Action

Check the destination address you are using. If you used a hostname, verify that it was resolved to the correct address. If your hostname resolution uses a local host table, it is possible the name was resolved to an obsolete address. It is also possible that the local services file has an incorrect port number (although this is unlikely). You can verify that the remote computer is rejecting your connection attempt by checking the network statistics locally. If your network system has a WinSock utility such as ping or nbtstat that shows network statistics, use this to verify that you are receiving TCP resets or ICMP Port Unreachable packets each time you attempt to connect. Try again later. If connection is still refused, contact your network administrator.

Event ID: 10136

Event Message

Host is unreachable. For more information about this event, see ISA Server Help.

Explanation

The remote host cannot be reached at this time or has been shut down. A socket operation was attempted to an unreachable target host. The ICMP message means that the router cannot forward the IP datagram to the target host, possibly because it did not get a response to the ARP request (which might mean the destination host is down).

User Action

Try again later.

Event ID: 10137

Event Message

Protocol is wrong type for socket. For more information about this event, see ISA Server Help.

Explanation

The application requires a socket call that is not supported by the current protocol settings for the client application. A protocol was specified that does not support the semantics of the socket type requested. For example, you cannot use the ARPA Internet UDP protocol with the SOCK_STREAM socket type. This error occurs if you specifically reference a protocol that is not part of the Internet address family you are also referencing.

User Action

Check the current application settings for the protocol type in use for the remote connection. Also check to see if TCP or UDP protocol support is used for the application and configure accordingly. If you are using a third-party Transmission Control Protocol/Internet Protocol (TCP/IP), verify that it is compatible with Wsock32.dll. If you are using Microsoft TCP/IP, remove and reinstall TCP/IP.

Event ID: 10138

Event Message

Operation not supported on socket. For more information about this event, see ISA Server Help.

Explanation

The current operation is not supported for Windows Sockets with the current application. Usually this occurs when a file descriptor refers to a file or socket that cannot support this operation, for example, trying to accept a connection on a datagram socket. Or the device driver for the protocol stack might not be compatible with Wsock32.dll.

User Action

Check your application settings or contact the supplier for the current application and report the problem. If you are using a third-party Transmission Control Protocol/Internet Protocol (TCP/IP), verify that it is compatible with Wsock32.dll. If you are using Microsoft TCP/IP, remove and reinstall TCP/IP. Or use another protocol that is compatible with Wsock32.dll. For developers, if you close a socket inadvertently in one part of an application without keeping another part notified, use socket state in an application and/or handle this error gracefully as a non-fatal error.

Event ID: 10139

Event Message

IP Subnet table is full. The address table for routing hosts on the network indicates that all addresses on this subnetwork are in use. Rebuild routing tables for affected hosts, or assign the host to a new subnetwork with available address space.

Event ID: 10140

Event Message

Subnet module not linked. A required software component is missing or is not configured. Check network configuration settings for the client and try to reinstall the application. If the problem continues, report the problem to the application supplier.

Event ID: 10141

Event Message

Unknown input/output (I/O) control call used. A software error occurred. Report the problem to the application supplier.

Event ID: 10142

Event Message

Failure in streams buffer allocation. There is insufficient buffer space available to maintain the currently streamed connection. Increase the allocated space for streams buffers on the server. For more information about setting Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) buffer size for clients by using the registry on the server, see Windows 2000 Help.

Event ID: 10143

Event Message

Internet Control Message Protocol (ICMP) protocol is unreachable. The remote server is not responding. You might be unable to reach the remote server because hardware has failed or because a nonexistent address was specified. Verify that the address entered for the connection is correct and retry the operation. If the problem reoccurs, contact the network administrator for the remote server.

Event ID: 10144

Event Message

Internet Control Message Protocol (ICMP) port is unreachable. The remote server port is not responding. You might be unable to reach the remote server because hardware has failed or because a nonexistent address was specified. Verify that the address entered for the connection is correct and retry the operation. If the problem reoccurs, contact the network administrator for the remote server.

Event ID: 10145

Event Message

Internet Control Message Protocol (ICMP) network is unreachable. A routing failure has occurred. The local network system might generate this error if there is no default route configured. Typically, WinSock generates this error when it receives a "host unreachable" Internet Control Message Protocol (ICMP) message from a router. Investigate routers on local or remote networks to see that they are active and properly configured. Contact your network administrator to confirm the status of the remote host.

Event ID: 10146

Event Message

Invalid Ethernet packet in use. For more infor-mation about this event, see ISA Server Help.

Explanation

A routing failure has occurred. The local network system might generate this error if there is no default route configured. Typically, though, WinSock generates this error when it receives a "host unreachable" ICMP message from the router. The ICMP message means that a router cannot forward the IP datagram, possibly because it did not get a response to the ARP request (which might mean the destination host is down). Note: This error might also result if you are trying to send a multicast packet and the default gateway does not support multicast (check your interface configuration).

User Action

Check the client network configuration to confirm that the selected frame type matches the frame type used by servers on the local network. If the problem continues, review the local router configuration for packet-length settings, or use a packet analysis tool to further investigate packet framing that is currently in effect on the network. You can also try to ping the destination host, to see if you get the same results (chances are, you will). Check the destination address. Check whether you have a router configured in your network system (your WinSock implementation). Use the Tracert command at the command prompt to try to determine where the failure occurs along the route between your host and the destination host. Investigate routers on local or remote networks to see that they are active and properly configured.

Event ID: 10147

Event Message

An error in type registration occurred. A software error occurred. Report the problem to the application supplier.

Event ID: 10148

Event Message

Sockets library is not initialized. For more information about this event, see ISA Server Help.

Explanation

Linked libraries for Windows Sockets are not initialized properly for client configuration. The Hypertext Transfer Protocol (HTTP) failed to initialize the sockets library. This problem occurs if there is some incorrect TCP/IP configuration.

User Action


Check the bindings, and verify that TCP/IP is bound at the top of the protocol stack. If you continue to receive this message, reinstall TCP/IP.

Check that the WinSock DLL (WinSock.dll or Wsock32.dll) is in the current path.

Check that the WinSock DLL file is from the same vendor as your underlying protocol stack. (WinSock DLL files must be supplied by the vendor who provided your underlying protocol stack.)

You cannot use more than one WinSock implementation simultaneously. If you have more than one WinSock DLL file on your system, be sure the first one in the path is appropriate for the network subsystem currently loaded.

Check your WinSock implementation documentation to be sure all necessary components are currently installed and configured correctly.


Event ID: 10149

Event Message

Unknown error number encountered. A software error occurred. Report the problem to the application supplier.

Intrusion Detection Event Messages

These messages refer to events connected to intrusion detection in Microsoft Internet Security and Acceleration (ISA) Server.

Event ID: 15001

Event Message

ISA Server detected a windows out-of-band attack. For more information about this event, see ISA Server Help.

Explanation

A windows out-of-band denial-of-service attack was attempted against a computer protected by ISA Server. If successful, this attack crashes the computer.

User Action

If logging for dropped packets has been set you can view details of this attack in the packet filter log in the ISALogs folder, which is located under the ISA Server installation folder. You can use this log to monitor any further intruder activity. Steps against intruder activity might include setting up a packet filter or policy rules to inhibit traffic from the source of the intrusion.

Event ID: 15002

Event Message

ISA Server detected an Internet Protocol (IP) half scan attack. For more information about this event, see ISA Server Help.

Explanation

An Internet Protocol (IP) half scan attack was attempted against a computer protected by ISA Server. This alert occurs when an unexpected Transmission Control Protocol (TCP) packet with a particular flag (for example, Fin, Ack, All, None) is detected.

User Action

If logging for dropped packets has been set, you can view details of this attack in the packet filter log in the ISALogs folder, which is located under the ISA Server installation folder. You can use this log to monitor intruder activity. Steps against intruder activity include setting up a packet filter or policy rules to inhibit traffic from the source of the intrusion.

Event ID: 15003

Event Message

ISA Server detected a land attack. For more information about this event, see ISA Server Help.

Explanation

A land attack was attempted against a computer protected by ISA Server. This alert occurs when a Transmission Control Protocol (TCP) SYN packet or User Datagram Protocol (UDP) packet is sent with a spoofed source Internet Protocol (IP) address and port number that is identical to that of the destination IP address and port. The effect of this makes it appear that the host computer has sent a packet to itself. If this attack is successful, then a loop is created and the computer crashes.

User Action

If logging for dropped packets has been set, you can view details of this attack in the packet filter log in the ISALogs folder, which is located under the ISA Server installation folder. You can use this log to monitor intruder activity. Steps against intruder activity include setting up a packet filter or policy rules to inhibit traffic from the source of the intrusion.

Event ID: 15004

Event Message

ISA Server detected a well-known port scan attack. A well-known port is any port in the range of 0-1023. For more information about this event, see ISA Server Help.

Explanation

A well-known port scan attack was attempted against a computer protected by ISA Server. This alert occurs when an attempt is made to scan well-known ports on a computer to detect services running on these ports.

User Action

If logging for dropped packets has been set, you can view details of this attack in the packet filter log in the ISALogs folder, which is located under the ISA Server installation folder. You can use this log to monitor intruder activity. Steps against intruder activity include setting up a packet filter or policy rules to inhibit traffic from the source of the intrusion.

Event ID: 15005

Event Message

ISA Server detected an all port scan attack. For more information about this event, see ISA Server Help.

Explanation

An all port scan attack was attempted against a computer protected by ISA Server. This alert occurs when an attempt is made to scan ports on a computer to detect services running on these ports.

User Action

If logging for dropped packets has been set, you can view details of this attack in the packet filter log in the ISALogs folder, which is located under the ISA Server installation folder. You can use this log to monitor intruder activity. Steps against intruder activity include setting up a packet filter or policy rules to inhibit traffic from the source of the intrusion.

Event ID: 15006

Event Message

ISA Server detected a User Datagram Protocol (UDP) bomb attack. For more information about this event, see ISA Server Help.

Explanation

A User Datagram Protocol (UDP) bomb attack was attempted against a computer protected by ISA Server. This alert occurs when there is an attempt to send an illegal UDP packet.

User Action

If logging for dropped packets has been set, you can view details of this attack in the packet filter log in the ISALogs folder, which is located under the ISA Server installation folder. You can use this log to monitor intruder activity. Steps against intruder activity include setting up a packet filter or policy rules to inhibit traffic from the source of the intrusion.

Event ID: 15007

Event Message

ISA Server detected a ping of death attack. For more information about this event, see ISA Server Help.

Explanation

A ping of death attack was attempted against a computer protected by ISA Server. This alert occurs when a large amount of information is appended to an Internet Control Message Protocol (ICMP) echo request (ping) packet. If this attack is successful, the computer crashes.

User Action

If logging for dropped packets has been set, you can view details of this attack in the packet filter log in the ISALogs folder, which is located under the ISA Server installation folder. You can use this log to monitor intruder activity. Steps against intruder activity include setting up a static packet filter to block incoming ICMP packets or enabling the filtering of IP fragments by using ISA Management. To enable filtering, in the ISA Management console tree, click Servers And Arrays, click Name, click Access Policy, click IP Packet Filters properties, and then click the Packet Filters tab.

Event ID: 15101

Event Message

ISA Server detected a windows out-of-band attack from Internet Protocol (IP) address %1. For more information about this event, see ISA Server Help.

Explanation

A windows out-of-band denial-of-service attack was attempted against a computer protected by ISA Server. If successful, this attack crashes the computer.

User Action

If logging for dropped packets has been set, you can view details of this attack in the packet filter log in the ISALogs folder, which is located under the ISA Server installation folder. You can use this log to monitor intruder activity. Steps against intruder activity include setting up a packet filter or policy rules to inhibit traffic from the source of the intrusion.

Event ID: 15102

Event Message

ISA Server detected an Internet Protocol (IP) half-scan attack from IP address %1. For more information about this event, see ISA Server Help.

Explanation

An Internet Protocol (IP) half-scan attack was attempted against a computer protected by ISA Server. This alert occurs when an unexpected Transmission Control Protocol (TCP) packet with a particular flag (for example, Fin, Ack, All, None) is detected.

User Action

If logging for dropped packets has been set, you can view details of this attack in the packet filter log in the ISALogs folder, which is located under the ISA Server installation folder. You can use this log to monitor intruder activity. Steps against intruder activity include setting up a packet filter or policy rules to inhibit traffic from the source of the intrusion.

Event ID: 15103

Event Message

ISA Server detected a land attack on Internet Protocol (IP) address %1. For more information about this event, see ISA Server Help.

Explanation

A land attack was attempted against a computer protected by ISA Server. This alert occurs when a Transmission Control Protocol (TCP) SYN packet or User Datagram Protocol (UDP) packet is sent with a spoofed source Internet Protocol (IP) address and port number that is identical to that of the destination IP address and port. The effect of this makes it appear that the host computer has sent a packet to itself. If this attack is successful, a loop is created and the computer crashes.

User Action

If logging for dropped packets has been set, you can view details of this attack in the packet filter log in the ISALogs folder, which is located under the ISA Server installation folder. You can use this log to monitor intruder activity. Steps against intruder activity include setting up a packet filter or policy rules to inhibit traffic from the source of the intrusion.

Event ID: 15104

Event Message

ISA Server detected a well-known port scan attack from Internet Protocol (IP) address %1. A well-known port is any port in the range of 0-1023. For more information about this event, see ISA Server Help.

Explanation

A well-known port scan attack was attempted against a computer protected by ISA Server. This alert occurs when an attempt is made to scan ports on this computer to detect the services running on these ports.

User Action

If logging for dropped packets has been set, you can view details of this attack in the packet filter log in the ISALogs folder, which is located under the ISA Server installation folder. You can use this log to monitor intruder activity. Steps against intruder activity include setting up a packet filter or policy rules to inhibit traffic from the source of the intrusion.

Event ID: 15105

Event Message

ISA Server detected an all port scan attack from Internet Protocol (IP) address %1. For more information about this event, see ISA Server Help.

Explanation

An all port scan attack was attempted against a computer protected by ISA Server. This alert occurs when an attempt is made to scan ports on this computer to detect the services running on it.

User Action

If logging for dropped packets has been set, you can view details of this attack in the packet filter log in the ISALogs folder, which is located under the ISA Server installation folder. You can use this log to monitor intruder activity. Steps against intruder activity include setting up a packet filter or policy rules to inhibit traffic from the source of the intrusion.

Event ID: 15106

Event Message

ISA Server detected a User Datagram Protocol (UDP) bomb attack from Internet Protocol (IP) address %1. For more information about this event, see ISA Server Help.

Explanation

A User Datagram Protocol (UDP) bomb attack was attempted against a computer protected by ISA Server. This alert occurs when there is an attempt to send an illegal UDP packet.

User Action

If logging for dropped packets has been set, you can view details of this attack in the packet filter log in the ISALogs folder, which is located under the ISA Server installation folder. You can use this log to monitor intruder activity. Steps against intruder activity include setting up a packet filter or policy rules to inhibit traffic from the source of the intrusion.

Event ID: 15107

Event Message

ISA Server detected a ping-of-death attack from Internet Protocol (IP) address %1. For more information about this event, see ISA Server Help.

Explanation

A ping-of-death attack was attempted against a computer protected by ISA Server. This alert occurs when a large amount of information is appended to an Internet Control Message Protocol (ICMP) echo request (ping) packet. If this attack is successful, the computer crashes.

User Action

If logging for dropped packets has been set, you can view details of this attack in the packet filter log in the ISALogs folder, which is located under the ISA Server installation folder. You can use this log to monitor intruder activity. Steps against intruder activity include identifying the source of the intrusion, setting up a static packet filter to block incoming ICMP packets, creating a protocol rule that specifically denies incoming ICMP echo request packets from the Internet, or enabling the filtering of IP fragments by using ISA Management. To enable filtering, in the ISA Management console tree, click Servers And Arrays, click Name, click Access Policy, click IP Packet Filters properties, and then click the Packet Filters tab.

Log Event Messages

These messages refer to events related to logging in Microsoft Internet Security and Acceleration (ISA) Server.

Event ID: 1

Event Message

The %1 was unable to load Odbc32.dll for SQL logging due to the following error: %2. The data is the error code. For more information about this event, see ISA Server Help.

Explanation

Open Database Connectivity (ODBC) allows applications to access data in a DBMS (database management system). Odbc32.dll (dynamic-link library file) is required for this process and it could not be located in the current system path.

User Action

Verify the existence of Odbc32.dll in the Windows system directory. The system directory is typically %systemroot%\system32. If the file does not exist, then reinstall ODBC.

Event ID: 2

Event Message

The %1 was unable to open ODBC Data Source %2, Table: %3, under User Name %4. The ODBC Error is: %5. For more information about this event, see ISA Server Help.

Explanation

Open Database Connectivity (ODBC) allows applications to access data in a database management system (DBMS). It uses a data source to maintain connection information for the database. The ODBC-specified data source could not be opened because it does not exist or because the table and user name information is incorrect.

User Action

Open ISA Management and check the log properties to verify that the ODBC Data Source, Table name, User Name, and Password are correct in the corresponding logging service. To do this, in the ISA Management console tree, click Servers And Arrays, click Name, click Monitoring Configuration, and then click Logs. Check the property sheet where logging is enabled for this service.

Event ID: 3

Event Message

The %1 was unable to create the log file directory %2. For more information about this event, see ISA Server Help.

Explanation

The log file folder specifies where log files should be saved. This information may be missing or incorrect.

User Action

Open ISA Management and check the log properties to verify that the ODBC Data Source, Table name, User Name, and Password are correct in the corresponding logging service. To do this, in the ISA Management console tree, click Servers And Arrays, click Name, click Monitoring Configuration, and then click Logs. Check the property sheet where logging is enabled for this service.

Event ID: 4

Event Message

The %1 failed to log information. The log object was never created, possibly due to wrong configuration. For more information about this event, see ISA Server Help.

Explanation

The server failed to find correct logging information. This information may be missing or incorrect.

User Action

Open ISA Management and check the log properties to verify that the ODBC Data Source, Table name, User Name, and Password are correct in the corresponding logging service. To do this, in the ISA Management console tree, click Servers And Arrays, click Name, click Monitoring Configuration, and then click Logs. Check the property sheet where logging is enabled for this service.

Event ID: 5

Event Message

The %1 failed to log information to file %2 in path %3. The data is the error code. For more information about this event, see ISA Server Help.

Explanation

The server failed to find the correct location for logging information. This information may be missing or incorrect.

User Action

Open ISA Management and check the log properties to verify that file information is correct in the corresponding logging service. To do this, in the ISA Management console tree, click Servers And Arrays, click Name, click Monitoring Configuration, and then click Logs. Check the property sheet where logging is enabled for this service.

Event ID: 6

Event Message

The %1 failed to log information to ODBC Data Source %2, Table: %3, under User Name %4. The ODBC Error is: %5. For more information about this event, see ISA Server Help. The data is the error code.

Explanation

Open Database Connectivity (ODBC) allows applications to access data in a database management system (DBMS). It uses a data source to maintain connection information for the database. Information connected with the data source is either missing or incorrect.

User Action

Open ISA Management and check the log properties to verify that the ODBC Data Source, Table name, User Name, and Password are correct in the corresponding logging service. To do this, in the ISA Management console tree, click Servers And Arrays, click Name, click Monitoring Configuration, and then click Logs. Check the property sheet where logging is enabled for this service.

Event ID: 7

Event Message

The %1 created the log file directory %2 due to logging configuration changes.

Event ID: 14102

Event Message

The server was unable to load Odbc32.dll for SQL logging because of the following error: %1. The specified dynamic-link library (DLL) could not be located in the current system path. Verify the existence of the specified DLL in the Windows system directory. The system directory is typically %systemroot\Winnt\System32%. The error code in the Data area of the event properties indicates the cause of the failure.

Event ID: 14103

Event Message

The server was unable to open Open Database Connectivity (ODBC Data Source %1, Table: %2, under User Name %3. The ODBC Error is: %4. The error code in the Data area of the event properties indicates the cause of the failure. For more information about this event, see ISA Server Help.

Explanation

The Open Database Connectivity (ODBC) data source could not be opened because it does not exist or because the table and user name information is incorrect.

User Action

Open ISA Management and check the log properties to verify that the ODBC Data Source, Table name, User Name, and Password are correct in the corresponding logging service. To do this, in the ISA Management console tree, click Servers And Arrays, click Name, click Monitoring Configuration, and then click Logs.

Event ID: 14104

Event Message

The logging parameters specified are too long. Field: %1; Data Given: %2. The database table used for service logging requires an adjustment. Either the field is not long enough to contain the data or the field type is incorrectly set in the database design. Check configuration of table fields and data types for each field.

Event ID: 14107

Event Message

The server could not log information. The log object was never created. For more information about this event, see ISA Server Help.

Explanation

Information for configuring service logging might be missing or incorrect.

User Action

In ISA Management, verify that logging information is configured correctly for the service. To do this, in the ISA Management console tree, click Servers And Arrays, click Name, click Monitoring Configuration, and then click Logs.

Event ID: 14108

Event Message

The server was unable to find the log file directory %1. The error code in the Data area of the event properties indicates the cause of the failure. For more information about this event, see ISA Server Help.

Explanation

The log file folder is either missing or has been set incorrectly.

User Action

In ISA Management, verify that logging information is configured correctly for the service. To do this, in the ISA Management console tree, click Servers And Arrays, click Name, click Monitoring Configuration, and then click Logs. For a specified log file location, verify that the specified folder location exists. Create the folder again, if necessary.

Event ID: 14047

Event Message

Failed to write to %1 log file in directory %2. There is no space on the disk drive. Delete unnecessary files.

Event ID: 14049

Event Message

%1 was stopped because of a logging failure. For more information about this event, see ISA Server Help.

Explanation

A service stops when an activity log stops responding. If you log to a file on your local file system, it is most likely that a logging failure was caused by insufficient disk space. If you log to a database, the failure is probably related to an error in configuration, insufficient disk space, or connectivity problems.

User Action

If the failure is the result of insufficient disk space, move old files to another media or delete them manually and configure the system to delete old files in the future. To edit logging configuration, in the ISA Management console tree, click Servers And Arrays, click Name, click Monitoring Configuration, and then click Logs. If you log to a database, check the database configuration. To reconfigure disk space, select a shorter period for logging (for example, weekly or daily), click Location and then select the option to compress log files.

Control Service Event Messages

These messages refer to events connected to the ISA Server Control Service.

Event ID: 14022

Event Message

Microsoft ISA Server Control Service failed to initialize because the system call %1 failed. The error occurred during %2. Use the source location %3 to report the failure. If an error code appears in the Data area of the event properties, it indicates the cause of the failure. For more information about this event, see ISA Server Help.

Explanation

The failure is probably due to insufficient memory or a problem accessing the storage.

User Action

Restart the service. If that does not resolve the problem, close other programs that are running. Use the Task Manager to check programs and processes that are using large amounts of system resources. For more information about managing memory resources, see Windows 2000 Help.

Event ID: 14024

Event Message

Microsoft ISA Server Control Service requires Windows 2000 Server with Service Pack 1 or later.

Event ID: 14025

Event Message

Microsoft ISA Server Control Service requires Windows 2000 Server with Service Pack 1 or later.

Event ID: 14026

Event Message

The Microsoft ISA Server Control Service failed to initialize. The internal error code in the Data area of the event properties indicates the cause of the failure. Restart the service.

Event ID: 14027

Event Message

The Microsoft ISA Server Control Service started.

Event ID: 14076

Event Message

Microsoft ISA Server Control Service failed to execute the security editing application. For more information about this event, see ISA Server Help. Error code: %1.

Explanation

The Secedit system application, which is used for security configuration and analysis, might fail due to an incorrect configuration specified in the security template files.

User Action

Use the Securwiz.log file in the ISA Server installation directory to identify the error. The file contains text in UNICODE (use Notepad to edit it). Search for the keywords "Warning" and "Error."

Event ID: 14078

Event Message

Microsoft ISA Server Control Service failed to delete Web Proxy cache file %1 during %2. Use the source location %3 to report the failure. Try to delete the folder manually.

Event ID: 14080

Event Message

Microsoft ISA Server Control Service failed because an application filter component (%2) performed an illegal operation at method %1 GUID=%3. Try removing recently installed application filters and restart the service. Otherwise, contact the component vendor.

Event ID: 14081

Event Message

ISA Server Control Service discovered a missing application filter component (%1) GUID %2. The application filter cannot be found on this server. Check that the specified filter was installed. The error code in the Data area of the event properties indicates the cause of the failure.

Event ID: 14082

Event Message

ISA Server Control Service cannot load the application filter component (%1) GUID %2, because it does not support necessary interfaces. This indicates a version mismatch, and the filter can no longer be used. Check the filter was installed correctly, or contact the component vendor. The error code in the Data area of the event properties indicates the cause of the failure.

Event ID: 14083

Event Message

ISA Server Control Service cannot load the application filter component (%1) GUID %2. Check that the application filter is installed properly. The error code in the Data area of the event properties indicates the cause of the failure.

Event ID: 14084

Event Message

ISA Server Control Service failed to start. All array members must be in the same site (%2). However, this server is in site %1. The server may have been moved to a different site that its containing array. Move the server to an array in its new site.

Event ID: 14085

Event Message

ISA Server Control Service failed to start. All array members must be in the same domain (%2). However, this server is in domain %1. The server was apparently moved to a different domain than its containing array. The server should be added to an array in its new domain.

Event ID: 14181

Event Message

The ISA Server Control Service was stopped gracefully.

Packet Filter Event Messages

These messages refer to events connected to packet filtering in Microsoft Internet Security and Acceleration (ISA) Server.

Event ID: 14038

Event Message

ISA Server packet filter log service cannot allocate memory. The packet filter log component of ISA Server logs this event when it fails to allocate memory where memory resources are low. The packet filter log component cannot operate until the low memory situation is resolved. The ISA Server administrator can stop and restart the ISA Server services to resolve the low memory situation if logging of packet filter data is mandatory.

Event ID: 14039

Event Message

ISA Server packet filter logging component cannot obtain the log contents. Restarting the service might solve the problem.

Event ID: 14043

Event Message

The system-wide packet filter log event cannot be created.

Event ID: 14044

Event Message

The packet filter is dropping Internet Protocol (IP) packets. For more information about this event, see ISA Server Help.

Explanation

The IP packet drop rate of the ISA Server exceeds the specified level. The Internet Protocol (IP) packet drop rate is configured in ISA Management. To configure the drop rate, in the ISA Management console tree, click Servers And Arrays, click Name, click Monitoring Configuration, click Alerts, and then click Dropped Packets Alert Properties.

User Action

An administrator can examine the packet filter logs to detect the nature of the drop rate and take further action.

Event ID: 14046

Event Message

Packet filter protocol violation. For more information about this event, see ISA Server Help.

Explanation

The dropped packet rate of some special kinds of packets (for example, spoofed packets or fragments) exceeds the rate specified in the configuration for dropped packets. To configure the drop rate, in the ISA Management console tree, click Servers And Arrays, click Name, click Monitoring Configuration, click Alerts, and then click Dropped Packets Alert Properties.

User Action

Examine the packet filter logs to detect the nature of the drop rate and take further action.

Event ID: 14086

Event Message

Insecure configuration detected. Internet Protocol (IP) routing is enabled while packet filtering is disabled. All packets will be routed, regardless of access policy. It is recommended that you enable IP routing only when you also enable packet filtering.

Event ID: 14119

Event Message

An external interface could not be found for packet filtering. For more information about this event, see ISA Server Help.

Explanation

This event can occur if the Local Address Table (LAT) includes all the addresses associated with the external interfaces. The event might also occur if another application is controlling the packet filter driver. Since only one application can control the packet filter driver at a time, the Firewall service cannot filter packets.

User Action

Verify that the LAT is configured properly and no other applications are configured to use packet filtering on the external network interfaces of the ISA Server. To do this, in the ISA Management console tree, click Servers And Arrays, click Name, click Network Configuration, and then click Local Address Table.

Event ID: 14120

Event Message

The ISA Server services cannot create a packet filter %1. This event occurs when there is a conflict between the Local Address Table (LAT) configuration and the Windows 2000 routing table. Check the routing table and the LAT to find the source of the conflict.

Event ID: 14121

Event Message

The packet filter dial-out interface cannot be rebound. For more information about this event, see ISA Server Help.

Explanation

This alert is generated when the ISA Server services are not able to bind a network interface with the packet filter driver. ISA Server typically rebinds interfaces and packet filters for the dial-out connections when they are dialed and disconnected. The alert also logs the error code that the underlying layers return.

User Action

This alert should not occur on a properly configured system. Check the configuration, including the LAT table. To do this, in the ISA Management console tree, click Servers And Arrays, click Name, click Network Configuration, and then click Local Address Table. Confirm that configuration of the specified phonebook entry in the dial-up entries configuration is correct. To do this, in the ISA Management console tree, click Servers And Arrays, click Name, click Policy Elements, and then click Dial-Up Entries.

Event ID: 14122

Event Message

A packet filter interface could not be bound. For more information about this event, see ISA Server Help.

Explanation

Packet filtering cannot be enabled on a specific interface. The configuration of the interface might have changed, been enabled or disabled, or a dial-out connection might have been dropped immediately after being connected.

User Action

Restart the Firewall and Web Proxy services. In ISA Management, check the system configuration to make sure it is consistent with packet filtering configuration, including the internal network addresses in the Local Address Table (LAT), or run Ipconfig at the command line to check current TCP/IP configuration values. To check the system configuration, in the ISA Management console tree, click Servers And Arrays, click Name, click Network configuration, and then click Local Address Table.

Event ID: 14123

Event Message

Failed to create the Internet Protocol (IP) packet filter. For more information about this event, see ISA Server Help.

Explanation

A static packet filter could not be created. System configuration might be incorrect, and the service might have attempted to create the filter for an external remote host on an ISA Server internal interface, due to incorrect configuration for default routing. Otherwise, memory resources might be low.

User Action

For system configuration problems, check the Local Address Table (LAT) configuration, run ipconfig/all to check TCP/IP configuration, and run Route -Print to obtain a list of registered, persistent routes. To check the LAT, in the ISA Management console tree, click Servers And Arrays, click Name, click Network Configuration, and then click Local Address Table. For low memory resources, close other applications or stop and restart the services.

Event ID: 14124

Event Message

Filtering disabled as requested.

Server Event Messages

These messages are connected to server and server publishing events in Microsoft Internet Security and Acceleration (ISA) Server.

Event ID: 12260

Event Message

Fatal error occurred when attempting to access '%1' certificate private key. For more information about this event, see ISA Server Help. The error code in the Data area of the event properties indicates the cause of the failure.

Explanation

The server cannot access certificate private key because the certificate and its private key are not installed in the same store.

User Action

Check configuration of certificates.

Event ID: 14087

Event Message

Insecure configuration detected. ISA Server uses its own Network Address Translation (NAT) editor to fully secure your system. However, ISA Server found one or more different NAT editors, which might have been installed by the following drivers: %1. It is recommended that you uninstall the drivers listed. For more information about this event, see ISA Server Help.

Explanation

Non-system Network Address Translation (NAT) editors are considered insecure by default. Such editors enable Internet Protocol (IP) traffic to pass through without applying policies.

User Action

It is not recommended to allow any third party to install NAT editors. Uninstall the driver that installed the insecure NAT editor.

Event ID: 14088

Event Message

Server publishing rule [%1] that maps %2 %3 to %4 for protocol [%5] violates %6 rule [%7]. For more information about this event, see ISA Server Help.

Explanation

There is a conflict between the configuration of the server publishing rule and the configuration of an access policy rule.

User Action

Change the rule configurations to resolve the conflict. To view server publishing rules in ISA Management, click Servers And Arrays, click Name, click Publishing, and then click Server Publishing Rules. To view access policy rules in ISA Management, click Servers And Arrays, click Name, click Access Policy, and then click the appropriate rule.

Event ID: 14089

Event Message

Server publishing rule [%1] failed. Cannot create session for the server %2. Location %3. For more information about this event, see ISA Server Help.

Explanation

The server publishing rule cannot be applied. The Firewall service failed to obtain a session with the server. The internal server address might not be included in the Local Address Table (LAT).

User Action

Check that the internal server address is included in the LAT. To do this, in the ISA Management console tree, click Servers And Arrays, click Name, click Network Configuration, click Local Address Table (LAT) and review the existing LAT entries. If the internal server address in not included, construct a new LAT entry by right-clicking Local Address Table (LAT).

Event ID: 14090

Event Message

Server publishing rule [%1] that maps %2 %3 to %4 for protocol [%5] failed to bind to external interface. The server publishing rule cannot be applied. The Firewall service failed to bind a socket for the server. The error code in the Data area of the event properties indicates the cause of the failure.

Event ID: 14091

Event Message

Server publishing rule [%1] failed. The protocol specified cannot be used for publishing. Location %2. The server publishing rule cannot be applied. The protocol must be inbound. Check with the application filter vendor.

Event ID: 14092

Event Message

Server publishing rule [%1] failed. The protocol specified cannot be used for publishing. Location %2. For more information about this event, see ISA Server Help.

Explanation

The server publishing rule cannot be applied. The protocol definition used for this rule is not inbound and is not valid.

User Action

Define a protocol that has an inbound primary connection for use with server mapping rules. To do this, in the ISA Management console tree, click Servers And Arrays, click Name, click Policy Elements, and then click Protocol Definitions.

Event ID: 14095

Event Message

Failed to initialize server publishing. Location %1. Internal error. Storage might be corrupted.

Event ID: 14096

Event Message

Failed to read server publishing rules. Location %1. Internal error. Storage might be corrupted.

Event ID: 14097

Event Message

Failed to read one or more server publishing rules. Location %1. Internal error. Storage might be corrupted.

Event ID: 14098

Event Message

Failed to read parameters of the publishing rule [%1]. The rule is discarded. Location %2. The storage might be corrupted. Delete this rule and create a new one.

Event ID: 14099

Event Message

Publishing rule [%1] could not be applied to this array member because IP %2 is not available. A server publishing rule can only be applied to one server from the array. All other servers will report this event. Note that an Internet Protocol (IP) address might be temporarily unavailable (for example, dial-up connection is disconnected).

Event ID: 14100

Event Message

The server was unable to log on the Windows 2000 account '%1' due to the following error: %2. The account name that was entered is not an account recognized by Windows 2000. Confirm that you entered the correct user name. The error code in the Data area of the event properties indicates the cause of the failure.

Event ID: 14101

Event Message

The server could not add the virtual root '%1' for the directory '%2' due to the following error: %3. The directory name is not recognized for the server volume that is specified in the virtual root mapping. Check that the directory name entered for drive mapping is correct. The error code in the Data area of the event properties indicates the cause of the failure.

Event ID: 14105

Event Message

ISA Management might not be able to recognize this server, because the server was unable to register on the network. Check for a server name conflict on the Internet. The error code in the Data area of the event properties indicates the cause of the failure.

Event ID: 14143

Event Message

ISA Server is too busy to handle this request. Reenter the request or renew the connection to the server (now or at a later time).

Event ID: 14145

Event Message

ISA Server failed to initialize due to a corrupted registry. Restart the service. If this does not resolve the problem, reinstall the server to replace any missing files. If the condition persists, restore the registry. Error Code %1, Key='%2', Value='%3'.

Event ID: 14146

Event Message

ISA Server failed to load ISAPI Filter DLL %1. The error code shown in the Data area of the event properties indicates the cause of the failure.

Event ID: 14159

Event Message

Failed to read reference to the protocol from the server publishing rule [%1]. Location %2. Storage may be corrupted. Delete this rule and create a new rule.

Event ID: 14160

Event Message

Server publishing rule [%1] that maps %2 %3 to %4 for protocol [%5] is not applied since enterprise policy does not allow publishing. The enterprise policy can be changed to allow publishing.

Event ID: 14161

Event Message

Server publishing rule [%1] that maps %2 %3 to %4 for protocol [%5] was applied successfully. This rule previously failed, but now completed successfully.

Event ID: 14162

Event Message

Server publishing rule [%1] will not be applied since the filter that supports the protocol is not enabled. Enable the filter and then apply the rule.

Event ID: 14163

Event Message

Server publishing rule [%1] that maps %2 %3 to %4 for protocol [%5] failed because the port on the external interface is being used by another application. The Firewall service failed to bind socket for the server on the firewall since another process is using the same port. Check for any other process using the same port and terminate if necessary.

Web Proxy Service Event Messages

These messages refer to events connected to the ISA Server Web Proxy service.

Event ID: 14125

Event Message

The Web Proxy service received %1 requests from the Internet port during the past %2 seconds while Web publishing was disabled. When ISA Server publishing is disabled, this event message displays the number of requests from the Internet during the specified time, in seconds.

Event ID: 14126

Event Message

The Web Proxy service configuration has been modified %1 times during the past %2 seconds.

Event ID: 14127

Event Message

The Web Proxy service could not initialize (error code %1). The internal error code in the Data area of the event properties indicates the cause of the failure.

Event ID: 14128

Event Message

The Web Proxy service is paused.

Event ID: 14129

Event Message

The Web Proxy service was resumed. No further action necessary.

Event ID: 14130

Event Message

The Web Proxy service detected that the upstream proxy '%1' is not available. For more information about this event, see ISA Server Help.

Explanation

The upstream proxy is offline.

User Action

Verify the reason and predicted time frame for the continuation of the problem. If necessary, configure a backup route. To do this, in the ISA Management console tree, click Servers And Arrays, click Name, click Network Configuration, and then click Routing. Open the rule and then click the Action tab. Or, you can route the request to an alternate destination.

Event ID: 14131

Event Message

The Web Proxy service detected that the upstream proxy '%1' is now available. If you were able to work around the upstream proxy server, no further action is necessary. If you changed the configuration of the primary route to the upstream ISA Server, you might want to change it back.

Event ID: 14132

Event Message

The Web Proxy service detected that the array member '%1' is down. Check the array member intra-array address or the network to find out why this array member is not available.

Event ID: 14133

Event Message

The Web Proxy service detected that the array member '%1' is available.

Event ID: 14141

Event Message

ISA Server detected a proxy chain loop. There is a problem with the configuration of the ISA Server routing policy. In ISA Management, check the routing configuration on all chained proxies. To do this, in the ISA Management console tree, click Servers And Arrays, click Name, click Network Configuration, and then click Routing.

Event ID: 14148

Event Message

Web Proxy service failed to bind its socket to %1 port %2. This could be caused by another service that is already using the same port or by a network interface card that is not functional. The error code specified in the Data area of the event properties indicates the cause of the failure. For more information about this event, see ISA Server Help.

Explanation

The requested service port is already in use, or data loss may have resulted from a large number of packet collisions on the local network segment. It is also possible that there is a problem with the network interface card (NIC).

User Action

Check the NIC. Monitor the service that failed for the server and the client, or monitor traffic on your local network.

Event ID: 14149

Event Message

Web Proxy service failed to listen to %1 port %2. The network interface card might not be functional. The error code specified in the Data area of the event properties indicates the cause of the failure. For more information about this event, see ISA Server Help.

Explanation

The Web Proxy service is unable to register itself to listen on the port specified. Some other application might be using the port.

User Action

Use netstat -a to check which ports are in use. Check the port details for each protocol defined for ISA Server. To do this, in the ISA Management console tree, click Servers And Arrays, click Name, click Policy Elements, and then click Protocol Definitions.

Event ID: 14153

Event Message

The Web Proxy service is not listening on the defined IntraArrayAddress although resolving requests within an array is enabled. For more information about this event, see ISA Server Help.

Explanation

If Cache Array Routing Protocol (CARP) is enabled, the Web Proxy service on each ISA Server in the array must listen on its Intra-array address.

User Action

Verify that there is a listener set for the Intra-array address on the server for all the directions on which CARP is enabled.

Event ID: 14154

Event Message

The Scheduled Content Download Service started the job %1.

Event ID: 14155

Event Message

The Scheduled Content Download Service finished the job %1. %2 pages.

Event ID: 14156

Event Message

The Web Proxy Service switched from primary route %1 to backup route %2. The Web Proxy Service is configured to switch to the backup route if there is some problem with the primary route.

Event ID: 14157

Event Message

The Web Proxy Service switched from backup route %1 to primary route %2. Following a problem with the primary route, the Web Proxy service switches to the configured backup route. While using the backup route, the service moves back to the primary route when it is available.

Event ID: 14158

Event Message

The Intra-array address defined on this server is not in the Local Address Table (LAT). For more information about this event, see ISA Server Help.

Explanation

The Intra-array address defined in the storage for this server is not in the Local Address Table (LAT).

User Action

Set an Internet Protocol (IP) that is in the LAT as the value of the Intra-array address property. To do this, in the ISA Management console tree, click Servers And Arrays, click Name, click Computer, click the computer name and then click the Array membership tab.

Event ID: 14177

Event Message

Some certificates cannot be initialized (error code %1). The Web Proxy service could not initialize. Check that all certificates used by the Web Proxy servce are valid. The internal error code in the Data area of the event properties indicates the cause of the failure.

Event ID: 14178

Event Message

The Web Proxy service identified that the address %1 was removed from the interface table and stopped listening on port %2.

Event ID: 14179

Event Message

The Web Proxy Service identified that the address %1 was added to the interface table and start listening on port %2.

Event ID: 14183

Event Message

The Web Proxy Service was stopped gracefully.

HTTP Messages

Event ID: 12150

Event Message

The requested header was not found. Reload the document using the Refresh function of your Web browser.

Event ID: 12151

Event Message

The server does not support the requested protocol level. Verify that the protocol you typed is a supported protocol (such as FTP, Gopher, HTTP) for the Web Proxy service.

Event ID: 12152

Event Message

The server returned an invalid or unrecognized response. The HTTP request cannot be fully or correctly interpreted by the server. The request might have been corrupted by transmission errors. Try reloading the document in your Web browser to correct the problem.

Event ID: 12153

Event Message

The supplied HTTP header is invalid and not recognized by the remote server. Check that your browser is supported.

Event ID: 12154

Event Message

The request for a HTTP header is invalid. A header contained within the Uniform Resource Locator (URL) request is not recognized by the remote server. Check that your browser is supported.

Event ID: 12155

Event Message

The HTTP header already exists. Contact your ISA Server administrator.

Event ID: 12201

Event Message

A chained proxy server or array member requires proxy-to-proxy authentication. Please contact your server administrator.

Event ID: 12202

Event Message

The ISA Server denies the specified Uniform Resource Locator (URL).

Event ID: 12204

Event Message

The specified Secure Sockets Layer (SSL) port is not allowed. ISA Server is not configured to allow SSL requests from this port. Most Web browsers use port 443 for SSL requests. Check the configuration for outgoing Web requests. Contact your ISA Server administrator.

Event ID: 12206

Event Message

The ISA Server detected a proxy chain loop. There is a problem with the configuration of the ISA Server routing policy. Please contact your server administrator.

Event ID: 12209

Event Message

The ISA Server requires authorization to fulfill the request. Access to the Web Proxy service is denied. The configuration for outgoing Web requests should be checked. Contact your ISA Server administrator.

Event ID: 12210

Event Message

An Internet Server API (ISAPI) filter caused an error or terminated with an error.

Event ID: 12211

Event Message

The ISA Server requires a secure channel connection to fulfill the request. ISA Server is configured to respond to outgoing secure (that is, Secure Sockets Layer (SSL)) channel requests. The configuration for outgoing Web requests need to be checked. Contact your ISA Server administrator.

Event ID: 12212

Event Message

The ISA Server requires a high-security connection to fulfill the request. An Secure Sockets Layer (SSL) Web server requires 128-bit encryption, an enhanced security mechanism, for access to published sites. Use a browser that supports this enhanced encryption.

Event ID: 12213

Event Message

The ISA Server requires a client certificate to fulfill the request. An Secure Sockets Layer (SSL) Web server, during the authentication process, requires a client certificate. The configuration for outgoing Web requests should be checked. Contact your ISA Server administrator.

Event ID: 12214

Event Message

An Internet Server API (ISAPI) filter caused an error or terminated with an error.

Event ID: 12221

Event Message

A chained server requires authentication. Contact the server administrator.

Event ID: 12227

Event Message

The dial-out connection failed. The dial-out connection failed with the specified phonebook entry. The administrator should manually dial the specified phonebook entry to confirm that the problem is not the Windows 2000 auto-dial facility.

Event ID: 12228

Event Message

The server is too busy to handle this request. Reenter request or try again later.

Event ID: 12229

Event Message

The server requires authorization to fulfill the request. Access to the Web server is denied. Contact the server administrator.

Event ID: 12230

Event Message

An Internet Server API (ISAPI) filter has finished handling the request. Contact the server administrator.

Event ID: 12231

Event Message

The page must be viewed over a secure (that is, Secure Sockets Layer (SSL)) channel. Contact the server administrator.

Event ID: 12232

Event Message

The page requires 128-bit encryption, an enhanced security mechanism. To view the page contents, use a browser that supports this enhanced encryption.

Event ID: 12233

Event Message

The page requires a client certificate as part of the authentication process. Contact the server administrator.

Event ID: 12234

Event Message

An Internet Server API (ISAPI) filter caused an error or terminated with an error.

HTML Messages

Event ID: 14201

Event Message

HTTP proxy report message.

Event ID: 14202

Event Message

HTTP proxy reports.

Event ID: 14203

Event Message

The ISA Server encountered an error.

Event ID: 14204

Event Message

Server error message.

Event ID: 14205

Event Message

ISA Server: extended error message.

Event ID: 14206

Event Message

Directory is empty.

Event ID: 14207

Event Message

Root directory.

Event ID: 14208

Event Message

Gopher root at %%s.

Event ID: 14209

Event Message

FTP root at %%s.

Event ID: 14210

Event Message

Gopher directory at %%s.

Event ID: 14211

Event Message

FTP directory %%s at %%s.

Event ID: 14212

Event Message

Web Proxy Cache initialization failed due to thread initialization failure.

Gopher Messages

Event ID: 12130

Event Message

A Gopher protocol error occurred. In some cases, protocol errors can occur between a server that supports only standard Gopher and a client that uses Gopher Plus. Verify that the server supports the same version of Gopher protocol used by the client.

Event ID: 12131

Event Message

The Uniform Resource Locator (URL) must be for a file. The URL that was entered describes a directory location and not a file. Type a Gopher URL that contains a file name. Browse through the directory listing to locate the file.

Event ID: 12132

Event Message

An error was detected while parsing the data. There may be a problem with the Gopher server that you are trying to connect to. In some cases, protocol errors can occur between a server that supports only standard Gopher and a client that uses Gopher Plus. Try again later and in addition, verify that the server supports the same version of Gopher protocol that is used by the client.

Event ID: 12133

Event Message

There is no more data. No more data exists beyond the last block of data returned from the server. Stop the request for additional data by canceling the operation in progress.

Event ID: 12134

Event Message

The Uniform Resource Locator (URL) is not valid for the remote Gopher server. Browse through the directory to verify that you used the correct path to locate the requested file.

Event ID: 12135

Event Message

The Uniform Resource Locator (URL) type is incorrect for this operation. A file name or directory name might be applied incorrectly. Verify that the name that specifies the location is a file or directory name and matches the operation.

Event ID: 12136

Event Message

The request must be for a Gopher Plus item. The server and client do not support the same version of Gopher protocols. Modify or upgrade the client to use Gopher Plus.

Event ID: 12137

Event Message

The requested attribute is supported for Gopher Plus servers and was not found on the server. Reconfigure the client to use standard Gopher protocol and resend the request.

Event ID: 12138

Event Message

The Uniform Resource Locator (URL) type is not recognized. An incorrect Gopher type was used, or the Gopher type is not supported. Verify that the name that specifies the location is a file or directory name and is correctly matched for the operation.

FTP Messages

Event ID: 12110

Event Message

There is already an File Transfer Protocol (FTP) request in progress during this session. For more information about this event, see ISA Server Help.

Explanation

You can make only one File Transfer Protocol (FTP) request per session.

User Action

Wait for the current request to finish. You can also disconnect from the FTP server and then reconnect to check for server availability. No further action is required.

Event ID: 12111

Event Message

The File Transfer Protocol (FTP) session was terminated. The connection was closed because of either a possible attempted security violation or a time out on the remote server. Reconnect to the server or check for server availability. No further action is required.

Internet Messages

Event ID: 12001

Event Message

No more Internet handles can be allocated. The Web server does not have enough available resources to support the request for service at this time. Try again later.

Event ID: 12002

Event Message

The operation timed out. The remote server did not respond within the set time allowed. The server might be unavailable at this time. Try again later or contact the server administrator.

Event ID: 12003

Event Message

The server returned extended information. This is typically a string or buffer containing a verbose error message. For more information, review the request output.

Event ID: 12004

Event Message

A software error occurred for a Windows Internet extension application that is required for the current operation.

Event ID: 12005

Event Message

The Uniform Resource Locator (URL) is invalid. The request was not entered correctly. Enter the correct URL and try again.

Event ID: 12006

Event Message

The Uniform Resource Locator (URL) does not use a recognized protocol. Either the protocol is not supported or the request was not typed correctly. Confirm that a valid protocol is in use (for example, HTTP for a Web request).

Event ID: 12007

Event Message

The server name or address could not be resolved. This message might indicate an error in client or server configuration settings for DNS, WINS, or DHCP services that are actively in use. Review the TCP/IP properties for these services.

Event ID: 12008

Event Message

A protocol with the required capabilities was not found. ISA Server does not support the request protocol. Enter the request again. Verify that the protocol is a supported type (for example, HTTP, FTP, or Gopher).

Event ID: 12009

Event Message

The option is invalid. The requested option is not available with your current configuration. Clear the message and select a different option, or check configuration.

Event ID: 12010

Event Message

The length is incorrect for the option type. Reselect the current option and type the data again. Verify that you did not type extra characters and that the value you typed in is within the permitted length.

Event ID: 12011

Event Message

The option value cannot be set. The server does not support this value, or the value was typed incorrectly. Retry the operation. If you still get this message, ask your network administrator to check the status of the remote computer.

Event ID: 12012

Event Message

Windows Internet Extension support has been shut down. Open the required Internet Extension application and reselect the command option.

Event ID: 12013

Event Message

The user name was not allowed. Try a different name, or retry the same name after verifying that it is typed correctly.

Event ID: 12014

Event Message

The password was not allowed. The password might have been changed or typed incorrectly. Try typing the password again. If the problem continues, contact the administrator for the remote server and report the problem.

Event ID: 12015

Event Message

The login request was denied. The logon account might have been disabled or logon information might have changed. Log on again to verify that the information was typed correctly. If the problem continues, report the problem to the administrator of the Internet server you are requesting.

Event ID: 12016

Event Message

The requested operation is invalid. The operation entered in the Uniform Resource Locator (URL) is not allowed or is not recognized by the remote Internet server. Type the URL again or select a different operation.

Event ID: 12017

Event Message

The operation has been cancelled. Try the operation again.

Event ID: 12018

Event Message

The supplied handle is the wrong type for the requested operation.

Event ID: 12019

Event Message

The handle is in the wrong state for the requested operation.

Event ID: 12020

Event Message

The request cannot be made on an ISA Server session.

Event ID: 12021

Event Message

The registry value could not be found.

Event ID: 12022

Event Message

The registry parameter is incorrect.

Event ID: 12023

Event Message

Direct Internet access is not available.

Event ID: 12024

Event Message

No context value was supplied. An asynchronous request could not be made because a zero context value was supplied.

Event ID: 12025

Event Message

No status callback was supplied.

Event ID: 12026

Event Message

There are outstanding requests. The required operation could not be completed because one or more requests are pending.

Event ID: 12027

Event Message

The information format is incorrect.

Event ID: 12028

Event Message

The requested item could not be located.

Event ID: 12029

Event Message

A connection with the server cannot be established.

Event ID: 12030

Event Message

The connection with the server was terminated abnormally.

Event ID: 12031

Event Message

The connection with the server was reset.