[Last Call] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 2223
  • Last Modified:

ISA server report failure

ISA Server 2000 on Small Business Server 2000. I created a daily report job which worked nicely until late last week, when the reports simply stopped appearing. The report job itself has a status of "Failure", but I can't find any other information anywhere. How do I go about troubleshooting this?

Thanks
anseris
0
anseris
Asked:
anseris
  • 7
  • 5
  • 3
  • +1
2 Solutions
 
Julian_CCommented:
Hi there,

Not much to go on here so. Is there anything in the eventlog? ISA uses a named account to produce these reports. Is the account still OK, has it expired, been locked out etc etc. Look for a clue in the event log message.

Cheers
Julian
0
 
anserisAuthor Commented:
I can't find anything in the event log from the ISA server. I have looked for logging settings in ISA management but can't find anything for report generating.
0
 
Julian_CCommented:
OK, if you look in The ISA managment in Monitoring Configuration\Logs and make sure it's enabled (right click). Then in Monitoring Configuration\Reports Jobs, find your report and right click it and check the credentials. The user should be valid user.

Cheers
Julian
0
A Cyber Security RX to Protect Your Organization

Join us on December 13th for a webinar to learn how medical providers can defend against malware with a cyber security "Rx" that supports a healthy technology adoption plan for every healthcare organization.

 
anserisAuthor Commented:
Found a problem with the application log - but will take that to the appropriate forum in due course.

The username is definitely valid, and it's the same username used back when the report was being generated correctly. So the event in the log still doesn't look terribly helpful. Details:

Event Type:      Error
Event Source:      Microsoft ISA report generator
Event Category:      None
Event ID:      12026
Date:            8/26/2004
Time:            8:56:07 AM
User:            N/A
Computer:      CVMSRV1
Description:
The action to create the scheduled report, "Report Job", with the specified credentials, failed. The error code in the Data area of the event properties indicates the cause.  
Data:
0000: 0d 00 00 00               ....    
0
 
Julian_CCommented:
Just to humour me for a minute. Change the user to an Administrator and run the report again. I'm not saying that this is how it needs to stay but I am trying to eliminate possibilities.

Cheers
Julian
0
 
Julian_CCommented:
Also, the other error you are getting in the event log isn't something to do with bsing unable to talk to the domain controller is it?
0
 
BembiCEOCommented:
Have you installed the latest service packs ?!? :-)
What Julian is saying is correct, the user account, the reports are using, must have permissions on ISA. You can take a service account for that or create a new one.

I experienced that behavior after installing SP2. Recreating the reports with a service account works fine.
0
 
anserisAuthor Commented:
Okay, Administrator can't generate the reports either.

We only have one server here, so it's a domain controller running ISA server and everything else.

I will go check the service pack situation, but there certainly weren't any installed since last week when the reports were working.
0
 
Julian_CCommented:
So, what was changed since last week? Are you running windows update automatically? Something has  changed. Any further  clues in the event log?

0
 
JJ2Commented:
Please verify whether the Task Scheduler (MSTask.exe) is started. If this service was stopped, the reports will not be generated.
0
 
Julian_CCommented:
Yes, but not having the schedule service running wouldn't generate the "Credentials Failed" error in the event log I think? That error suggests that it is a least trying to run and failing for security reasons.

Have you tried just creating a new (identical) report using another account BTW?

Cheers
Julian
0
 
BembiCEOCommented:
Note that - as the scheduler runs as a service - the account you are using might have the permissions to run as service and to logon locally, set by the local policies.
0
 
anserisAuthor Commented:
Okay, there's a report sitting on the server this morning - wasn't there at 3pm yesterday which was the last time I checked. It claims it was generated at 1.08pm yesterday, which was when I tried to generate the report from the administrator account, but no report appeared at the time, and there's an error in the event log (same as the one already posted) to prove that I wasn't imagining things.
It contains the data for 25/8.

Changed the report schedule to "immediately" and got the report for 26/8.

It seems that no event is generated for successful reports.

So I have now scheduled the next report for Saturday at 6.00am, let's see how that goes... I HATE intermittent problems.

Things that changed on the server yesterday:
(1) Fixed application log
(2) Changed accounts under which ISA report is generated (now back on original account)
(3) AV update
The problem can't have been just a mistyped password in the account credentials, the reports stopped appearing before I made any changes to the account details.

Re your suggestions:
MSTask.exe is running.
SP2 not yet applied. I had planned to apply it tonight after work but now will wait to see if the report scheduled for tomorrow morning is generated.
The application log wasn't doing its job back when the reports stopped happening. I will go through the system log with a comb but at first glance there's nothing unusual there. Windows Automatic Update isn't running on the server.
0
 
Julian_CCommented:
Well, that's interesting. We shall see tomorrow I guess. The event log generating a failure message when it suceeded is a bit perculiar. What you are saying is that now the report is configured as it was originally? If it fails now then the only thing left is user account unless something else, seemingly unconnected, has be changed on this server and is now back as it should be. But I doubt that...:-)

Cheers
Julian
0
 
BembiCEOCommented:
Keep in mind, that there may be a few reason, why the reports are stopped.
- One main reason is Hard-Disk Space. Make sure, you have allways more tha 100MB of free Disk-Space.
- Second reason may be RAM space. ISA configures the RAM cache size to 50% of total RAM. This may forcing the server beginning with swapping. If your server reaches the total limit (physical + swap file), I often experienced ISA problems like connections are shut down. damaged cache and similar things. So watch your memory usage for a few days, especially virus scanners can increase the amount of used memory extremly.
- If a virus scanner is installed, you should exclude a few files from scanning. In any case, you should exclude the urlcache directory, as the cache file may have several hundred MB of space.
- Also conflicting services may make trouble. If you run backup software, make sure your timing of several services don not overlap more than necessary. With virus scanners and backup software, you may produce heavy load on your server.
0
 
anserisAuthor Commented:
Saturday's report and today's have generated as expected.

So, not sure why the reports stopped, but I think I will close this question and then go have a good look at what monitoring is being done on the server.

Thanks very much for your time and suggestions.

anseris
0

Featured Post

Put Machine Learning to Work--Protect Your Clients

Machine learning means Smarter Cybersecurity™ Solutions.
As technology continues to advance, managing and analyzing massive data sets just can’t be accomplished by humans alone. It requires huge amounts of memory and storage, as well as high-speed processing of the cloud.

  • 7
  • 5
  • 3
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now