snowname
asked on
ISA always goes down. All webpage can not load.
Running ISA Enterprise version on Windows 2003 server. ISA always goes down, so all ports are closed. Then all webpages can not load. ISA shows that "unable to retrieve data from:webserver".
In system log, it show that server got "half scan attack".
Before ISA goes down, there are always so MSFTPSVC Warning in system log.
Event ID: 110
The server was unable to add the virtual root '/remotetek.com' for the directory 'C:\Webspace\support\remot etek' due to the following error: The system cannot find the file specified. The data is the error code.
Event ID: 110
The server was unable to add the virtual root '/remotetek' for the directory 'C:\Webspace\support\remot etek' due to the following error: The system cannot find the file specified. The data is the error code.
Event ID: 110
The server was unable to add the virtual root '' for the directory 'C:\Webspace\support\eavak yan' due to the following error: The system cannot find the file specified. The data is the error code.
Event ID: 110
The server was unable to add the virtual root '/kdearden' for the directory 'C:\Webspace\nonprofitwebh osting\kde arden' due to the following error: The system cannot find the file specified. The data is the error code.
The server was unable to add the virtual root '/benjiesautosales' for the directory 'C:\Webspace\support\benji esautosale s' due to the following error: The system cannot find the file specified. The data is the error code.
The server was unable to add the virtual root '/atlasliquors' for the directory 'C:\Webspace\support\atlas liquors' due to the following error: The system cannot find the file specified. The data is the error code.
The server was unable to add the virtual root '/ancientnumismatics' for the directory 'C:\Webspace\support\ancie ntnumismat ics' due to the following error: The system cannot find the file specified. The data is the error code.
The server was unable to add the virtual root '/amcomppro' for the directory 'C:\Webspace\support\amcom ppro' due to the following error: The system cannot find the file specified. The data is the error code.
Before ISA goes down, ISA takes a lot of memory.
Before ISA goes down, SQL server also takes a lot of memory.
In services "Microsoft Firewall" is also start. Since ISA is running, do I need Microsoft Firewall? in firewall log there is an error message before ISA went down "Microsoft Firewall logging can not connect to SQLserver.
Right now, the server has 2G memory.
The server is fine before. It start to have problem from last Thursday. I have to reboot the server all the times. By the way, after ISA goes down, I can not restart it any more.
HELP!!!!!!
In system log, it show that server got "half scan attack".
Before ISA goes down, there are always so MSFTPSVC Warning in system log.
Event ID: 110
The server was unable to add the virtual root '/remotetek.com' for the directory 'C:\Webspace\support\remot
Event ID: 110
The server was unable to add the virtual root '/remotetek' for the directory 'C:\Webspace\support\remot
Event ID: 110
The server was unable to add the virtual root '' for the directory 'C:\Webspace\support\eavak
Event ID: 110
The server was unable to add the virtual root '/kdearden' for the directory 'C:\Webspace\nonprofitwebh
The server was unable to add the virtual root '/benjiesautosales' for the directory 'C:\Webspace\support\benji
The server was unable to add the virtual root '/atlasliquors' for the directory 'C:\Webspace\support\atlas
The server was unable to add the virtual root '/ancientnumismatics' for the directory 'C:\Webspace\support\ancie
The server was unable to add the virtual root '/amcomppro' for the directory 'C:\Webspace\support\amcom
Before ISA goes down, ISA takes a lot of memory.
Before ISA goes down, SQL server also takes a lot of memory.
In services "Microsoft Firewall" is also start. Since ISA is running, do I need Microsoft Firewall? in firewall log there is an error message before ISA went down "Microsoft Firewall logging can not connect to SQLserver.
Right now, the server has 2G memory.
The server is fine before. It start to have problem from last Thursday. I have to reboot the server all the times. By the way, after ISA goes down, I can not restart it any more.
HELP!!!!!!
This is on the same server as your SPAM problem correct?
ASKER
Yes.
Open the task mananger - processes - which service is taking the memory? sqlservr.exe?
look at this link - it explains how to manually set the max memory the sql service can take.
http://www.mcse.ms/message1598572.html
Becareful with the half-scan attack as this can be misleading.
Open the gui - select configuration - general and look in the ips section. Turn off the half-scan option as vpn's and fragmented packets can fall foul of this
keith
look at this link - it explains how to manually set the max memory the sql service can take.
http://www.mcse.ms/message1598572.html
Becareful with the half-scan attack as this can be misleading.
Open the gui - select configuration - general and look in the ips section. Turn off the half-scan option as vpn's and fragmented packets can fall foul of this
keith
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
OK.
ASKER
Thanks grahamnonweiler. You are great. The server is much faster now.