Today I’ve done an inplace upgrade for a customers ISA 2004 server up to ISA 2006 – the upgrade itself went well once we removed the Firewall Client Share in ISA 2004. The client uses GFI’s Webmonitor for ISA Server to monitor their users and block certain sites. It works pretty well and gives them control over the users internet access above and beyond that provided by ISA. The client was on v3.0 of this product and following the upgrade I noticed an error message in the event log.
Event Type: Warning
Event Source: Microsoft ISA Server Web Proxy
Event Category: None
Event ID: 21237
Date: 29/08/2007
Time: 8:22:48 AM
User: N/A
Computer: SERVERNAME
Description: Web filter 'GFI WebMonitor3 filter' is not installed on this server. Install the filter and then restart the Firewall service.
I figured that if we removed Webmonitor for ISA v3.0 and installed the later version all should be good. So we removed the old version, downloaded and installed the later version which also went well. However we then found that any HTTP access to the internet was so slow as to timeout. We found that this also related to the http://monitor.isa as well. A dig into the event logs found the following;
Event Type: Warning
Event Source: ASP.NET 2.0.50727.0
Event Category: Web Event
Event ID: 1309
Date: 29/08/2007
Time: 8:49:14 AM
User: N/A
Computer: SERVERNAME
Description:
Event code: 3005
Event message: An unhandled exception has occurred.
Event time: 29/08/2007 8:49:14 AM
Event time (UTC): 28/08/2007 10:49:14 PM
Event ID: 380151aedd694068b8688d3cee0ddb40
Event sequence: 12
Event occurrence: 1
Event detail code: 0
Application information:
Application domain: 877b0161-1-128328149238155063
Trust level: Full
Application Virtual Path: /
Application Path: C:\Program Files\GFI\WebMonitor\Interface\
Machine name: SERVERNAME
Process information:
Process ID: 4144
Process name: WMonWeb.exe
Account name: DOMAIN\ServiceAccount
Exception information:
Exception type: HttpException
Exception message: Session state has created a session id, but cannot save it because the response was already flushed by the application.
Request information:
Request URL: http://localhost:1007/UrlHistory.aspx?ID=1
Request path: /UrlHistory.aspx
User host address: 127.0.0.1
User:
Is authenticated: False
Authentication Type:
Thread account name: DOMAIN\ServiceAccount
Thread information:
Thread ID: 4
Thread account name: DOMAIN\ServiceAccount
Is impersonating: False
Stack trace: at System.Web.SessionState.SessionIDManager.SaveSessionID(HttpContext context, String id, Boolean& redirected, Boolean& cookieAdded)
at System.Web.SessionState.SessionStateModule.CreateSessionId()
at System.Web.SessionState.SessionStateModule.DelayedGetSessionId()
at System.Web.SessionState.SessionStateModule.OnReleaseState(Object source, EventArgs eventArgs)
at System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)
Ok – at this point we just needed to get services running for the user, so we disabled the Web Filter via ISA 2006’s Management Console and things worked fine for us. I then talked to GFI’s Tech Support here in Australia and found that they have in the last 24hours heard about this problem and they are investigating. To resolve the issue for the client at the moment they suggested that we remove v4 and reinstall v3. This worked fine for us and we’ve got our monitoring back again. I’ll post here again with the solution once it becomes available.