Event Messages - Microsoft ISA Server 2000

Event Messages - Microsoft ISA Server 2000

When you are experiencing problems in Windows 2000 in general, the first place to look for answers is the Event Viewer. The Event Viewer in Windows 2000 is vastly improved over the version available in Windows NT. Not only additional event logs are added as you include additional programs, the descriptions and the solutions offered in the event logs can be extremely helpful.

ISA Server records the events in the Event Viewer so that you can troubleshoot the events to solve existing problems, or to monitor the performance of your ISA Server. The events include the following:

Event ID number
This is a number assigned to individual events. The event number is helpful for technical support individuals as they can provide you more information on the events.

Event message
A description of the event.

Explanation
A description of what the possible cause of the event might be.

User action
The appropriate actions that the users should be taking to resolve the issues.

Here are some of the event message IDs and their descriptions for various services related to the ISA Server. The message IDs and the events listed in this document were obtained from Microsoft ISA Server Help file.

Alert Event Messages

Message ID	Description
14033	Alert notification did not start. Alerts are limited to event reporting.
14040	Mail alerting stopped responding because Mapi.dll could not be located.
14045	Mail alert for %1 failed.
14050	Mail alert %1 stopped because of a configuration error (%2).
14051	Mail alert %1 (%2) stopped because it could not log on or connect to the server.
14052	Mail alert %1 stopped because the mail server refused to accept the message.
14053	Mail alert %1 stopped because the sender name is not valid.
14054	Mail alert %1 stopped because the recipient name is not valid.
14064	Unknown event %1 signaled the alert service.
14065	Alert service: One or more of the actions associated with alert %1 has failed.
14069	The alert service found more then one alert with the same event condition.
14072	The alert service failed to logon as user %2 to run the command %3 specified for the alert '%1'.
14144	The alert service failed to initialize because system call %1 failed.
14180	Alert service: failed to log event to system log.

Bandwidth Event Messages

Message ID	Description
13002	Bandwidth control completed successfully.
13103	Initialization of bandwidth control failed.
13104	The call to %1 failed.
13105	Insufficient memory for %1.
13106	Cannot match IP to an interface.

Cache Event Messages

Message ID	Description
13107	The scheduled content download service has stopped the job %1...
13108	The scheduled content download service found an unauthorized URL...
13109	The scheduled content download service was unable to connect to...
14094	The scheduled cache content download service cannot start...
14111	ISA Server cache could not start because it was configured incorrectly...
14137	Some of this information may be out of date because of network problems...
14138	Some of this information has not been updated in the past 24 hours...
14140	Some of this information may be out of date.
14150	The ISA Server cache could not initialize the URL cache on disk. The ISA Server cache files are corrupted.
14151	The ISA Server cache could not initialize the URL cache on disk. The ISA Server cache disk is full.
14164	Cache drives failed to initialize properly...
14165	There is inconsistency in some cache files...
14166	Cache is intentionally disconnected from the rest of the network.
14167	Recovery of data cache file %1 was completed...
14168	Some errors were encountered during the restoration of specific data cache files.
14169	While restoring cache data, %1 objects with conflicting information were found...
14170	Restoration of cache data completed...
14171	Cache data was restored successfully from all data cache files.
14172	Cache failed to initialize correctly. Caching is disabled...
14173	Path name too long for the disk cache %1. Specify a shorter path name...
14174	Invalid size specified for disk cache %1...
14175	Invalid volume specified for disk cache %1.
14176	Disk cache %1 failed to initialize and is disabled.
14184	The scheduled cache content download service was stopped gracefully.
14185	The scheduled cache content download service was started successfully.

Control Service Event Messages

Message ID	Description
14022	Microsoft ISA Server Control Service failed to initialize because the system call %1 failed.
14024	Microsoft ISA Server Control Service requires a Windows 2000 Server. It will not run on previous versions, including Beta versions of Windows 2000.
14025	Microsoft ISA Server Control Service requires a Windows 2000 server.
14026	Microsoft ISA Server Control Service failed to initialize.
14027	Microsoft ISA Server Control service started.
14076	Microsoft ISA Server Control Service failed to execute the security editing application.
14078	Microsoft ISA Server Control Service failed to delete Web Proxy Cache file %1 during %2.
14080	Microsoft ISA Server Control Service failed because an application filter component (%2) performed an illegal operation at method %1 GUID=%3.
14081	ISA Server Control Service discovered a missing application filter component (%1) GUID %2.
14082	ISA Server Control Service cannot load the application filter component (%1) GUID %2, because it does not support necessary interfaces.
14083	ISA Server Control Service cannot load the application filter component (%1) GUID %2.
14084	ISA Server Control Service failed to start. All array members must be in the same site (%2).
14085	ISA Server Control Service failed to start. All array members must be in the same domain (%2).
14181	ISA Server Control Service was stopped gracefully.

Firewall Service Event Messages

Message ID	Description
14001	Firewall service failed to initialize.
14002	Firewall service could not initialize WinSock.
14003	The Firewall service started.
14004	Firewall service was unable to start due to a shortage of available memory.
14006	Firewall service cannot start the performance counters.
14007	A shortage of available memory caused Firewall service to fail.
14010	Firewall Service did not start due to corrupted data in the registry or in the Active Directory configuration.
14011	The Firewall service failed to bind its socket to %1 port %2.
14012	Client from %1 attempted to access ISA Server using control protocol version %2.
14013	Firewall service requires a Windows 2000 server.
14014	The Firewall service requires a Windows 2000 server.
14015	The Firewall service failed to load a security DLL.
14016	The Firewall service failed to determine network addresses.
14017	Incorrect network configuration. None of the server's addresses is internal.
14021	The Firewall service failed to initialize because the system call %1 failed.
14028	The Firewall service did not initialize the network dial-up entry.
14029	The Firewall Service failed to create a socket.
14030	The Firewall service failed to associate a control socket with a completion port.
14031	The Firewall service failed to initialize control or refresh sockets.
14034	The Firewall Service did not listen on all TCP sockets.
14035	The Firewall Service failed to listen on the TCP socket bound to %1.
14036	Firewall clients cannot use address %1 because it is missing from configuration file %2.
14048	Failed to stop the %1 during %2.
14055	The Firewall service performed an illegal operation because an application filter component (%2) failed at method %1 GUID=%3.
14056	The Firewall service stopped because an application filter module %1 generated an exception code %3 in address %2 when function %4 was called.
14057	The Firewall service stopped because an application filter module %1 generated an exception code %3 in address %2 when function %4 was called.
14058	The Firewall service could not connect to another proxy.
14059	The Firewall service could not connect to another proxy. Authentication failed.
14060	Could not load an application filter %1 (%4). %2 failed with code 0x%3.
14061	The Firewall service detected that the upstream ISA server '%1' is not available.
14062	The Firewall service detected that the upstream proxy '%1' is now available.
14063	The Firewall Service failed to initialize because of a corrupted registry.
14071	The Firewall Service failed to start because the application filter component %1 did not start on time.
14093	The Firewall service cannot start because the ISA Server was installed using cache mode.
14152	A User Datagram Protocol (UDP) packet was dropped.
14182	The Firewall service was stopped gracefully.

Winsock Error Code Messages

Message ID	Message Description
10000	Name entered is too long.
10001	System is not ready.
10002	Current version is not supported.
10003	Service cannot send after socket shutdown.
10004	An interrupted system call was received.
10005	Host was not found.
10006	Try again.
10007	Non-recoverable error encountered.
10008	No data record is available.
10009	Bad file number encountered.
10010	Operation would block.
10011	Operation is in progress.
10012	Operation is already in progress.
10013	Bad network address encountered.
10014	Destination address required.
10015	Message is too long.
10016	Protocol family not supported.
10017	Directory is not empty.
10018	EPROCLIM returned.
10019	EUSERS returned.
10020	Disk quota exceeded.
10021	ESTALE returned.
10022	Invalid argument.
10023	Too many open files.
10024	Too many levels of symbolic links.
10025	The object is remote.
10026	Socket operation attempted on non-socket.
10027	Bad or unassigned address.
10028	Address is already in use.
10029	Address family is not supported by protocol family.
10030	Socket type is not supported.
10031	Protocol is not supported.
10032	No buffer space is supported.
10033	Connection timed out.
10034	Socket is already connected.
10035	Socket is not connected.
10036	Bad protocol option used.
10037	Connection reset by peer.
10038	Software caused connection to abort.
10039	Network is down.
10040	Network was reset.
10041	Connection refused.
10042	Host is down.
10043	Host is unreachable.
10044	Protocol is wrong type for socket.
10045	Operation is not supported on socket.
10046	ICMP network is unreachable.
10047	Too many references used.
10048	Not owner.
10049	No such file or directory exists.
10050	No such process exists.
10051	System call interrupted.
10052	I/O Error encountered.
10053	No such device or address exists.
10054	Argument list too long.
10055	Executed format error.
10056	Bad file number encountered.
10057	No children exist for parent object.
10058	Operation would block one in progress.
10059	Not enough memory is available.
10060	Permission denied.
10061	Bad address encountered.
10062	Mount device or directory is busy.
10063	File already exists.
10064	A cross-device link exists.
10065	No such device exists.
10066	Is not a directory.
10067	Is a directory.
10068	Invalid argument used.
10069	File table has overflowed.
10070	Too many files are open.
10071	Is not a typewriter.
10072	File is too large.
10073	No space is left on device.
10074	Illegal seek performed.
10075	Read-only file system in use.
10076	Too many links used.
10077	Pipe has broken.
10078	Math argument used.
10079	Result is too large.
10080	A resource deadlock would occur.
10081	No message of desired type exists
10082	Identifier removed.
10083	Channel number is out of range.
10084	Level 2 is not synchronized.
10085	Level 3 halted.
10086	Level 3 reset.
10087	Link number is out of range.
10088	Protocol driver is not attached.
10089	No CSI structure is available.
10090	Level 2 halted.
10091	An invalid exchange was made.
10092	Invalid request descriptor used.
10093	Exchange is full.
10094	No anode exists.
10095	Invalid request code used.
10096	Invalid slot used.
10097	Bad font file format used.
10098	Device is not a stream.
10099	No data was found.
10100	Timer has expired.
10101	System is out of streams resources.
10102	Machine is not on network.
10103	Package is not installed.
10104	The object is remote.
10105	The link has been severed.
10106	Advertise error occurred.
10107	Server mount error occurred.
10108	Communication error in sending.
10109	Protocol error encountered.
10110	Multihop attempted.
10111	Inode is remote.
10112	Cross mount point achieved.
10113	Trying to read unreadable message.
10114	Log name used is not unique.
10115	Remote address changed.
10116	Can't access a needed shared library.
10117	Accessing a corrupted shared.
10118	Library section in code file corrupted.
10119	Attempting to link in too many libraries.
10120	Attempting to execute a shared library.
10121	Socket operation attempted on non-socket.
10122	Cannot assign requested address.
10123	Address is already in use.
10124	Address family is not supported by protocol family.
10125	Socket type is not supported.
10126	Protocol is not supported.
10127	No buffer space is available.
10128	Connection timed out.
10129	Socket is already connected.
10130	Socket is not connected.
10131	Bad protocol option used.
10132	Connection reset by peer.
10133	Software caused connection to abort.
10134	Network is down.
10135	Connection refused.
10136	Host is unreachable.
10137	Protocol is wrong type for socket.
10138	Operation not supported on socket.
10139	IP Subnet table is full.
10140	Subnet module not linked.
10141	Unknown I/O control call used.
10142	Failure in streams buffer allocation.
10143	ICMP protocol is unreachable.
10144	ICMP port is unreachable.
10145	ICMP network is unreachable.
10146	Invalid Ethernet packet in use.
10147	An error in type registration occurred.
10148	Sockets library is not initialized.
10149	Unknown error number encountered.

Intrusion Detection Event Messages

Message ID	Description
15001	ISA Server detected windows out of band attack.
15002	ISA Server detected IP half scan attack.
15003	ISA Server detected land attack.
15004	ISA Server detected enumerated port scan attack.
15005	ISA Server detected generic port scan attack.
15006	ISA Server detected UDP bomb attack.
15007	ISA Server detected ping of death attack.
15101	ISA Server detected windows out of band attack on IP address %1.
15102	ISA Server detected IP half scan attack on IP address %1.
15103	ISA Server detected land attack on IP address %1.
15104	ISA Server detected enumerated port scan attack on IP address %1.
15105	ISA Server detected generic port scan attack on IP address %1.
15106	ISA Server detected UDP bomb attack on IP address %1.
15107	ISA Server detected ping of death attack on IP address %1.

Log Event Messages

Message ID	Description
1	The server was unable to load Odbc32.dll for SQL logging due to the following error.
2	The server was unable to open ODBC Data Source %1, Table: %2, under User Name %3.
3	The server was unable to create the log file directory %1.
4	The server failed to log information. The log object was never created, possibly due to the wrong configuration %0.
5	The server failed to log information to file %1 in path %2.
6	The server failed to log information to ODBC Data Source %1, Table: %2, under User Name %3.
7	The server created the log file directory %1 due to logging configuration changes.
14102	The server was unable to load Odbc32.dll for SQL logging because of the following error: %1.
14103	The server was unable to open ODBC Data Source %1, Table: %2, under User Name %3. The ODBC Error is: %4.
14104	The logging parameters that are specified are too long.
14107	The server could not log information.
14108	The server was unable to find the log file directory %1.
14047	Failed to write to %1 log file in directory %2.
14049	%1 was stopped because of logging failure.

Packet filter Event Messages

Message ID	Description
14038	ISA Server packet filter log service could not allocate memory.
14039	ISA Server packet filter logging component cannot obtain the log contents.
14043	Could not create the system-wide packet filter log event.
14044	The packet filter is dropping IP packets.
14046	Packet filter protocol violation.
14086	Insecure configuration detected.
14119	An external interface could not be found for packet filtering.
14120	The ISA Server services could not create a packet filter %1.
14121	The packet filter dial-out interface cannot be rebound.
14122	A packet filter interface could not be bound.
14123	Failed to create the IP packet filter.
14124	Filtering disabled as requested.

Server Event Messages

Message ID	Description
12260	Fatal error occurred when attempting to access '%1' certificate private key.
14087	Insecure configuration detected. ISA Server uses its own NAT editor to fully secure your system.
14088	Server publishing rule [%1] that maps %2 %3 to %4 for protocol [%5] violates %6 rule [%7].
14089	Server publishing rule [%1] failed.
14090	Server publishing rule [%1] that maps %2 %3 to %4 for protocol [%5] failed to bind to external interface.
14091	Server publishing rule [%1] failed. The protocol specified can't be used for publishing.
14092	Server publishing rule [%1] failed. The protocol specified can't be used for publishing.
14095	Failed to initialize server publishing. Location %1.
14096	Failed to read server publishing rules. Location %1.
14097	Failed to read one or more server publishing rules. Location %1.
14098	Failed to read parameters of the publishing rule [%1].
14099	Publishing rule [%1] could not be applied to this array member because IP %2 is not available.
14100	The server was unable to log on the Windows 2000 account '%1' due to the following error: %2.
14101	The server could not add the virtual root '%1' for the directory '%2' due to the following error: %3.
14105	ISA Manager may not be able to see this server, because the server was unable to register the information.
14143	ISA Server is too busy to handle this request.
14145	ISA Server failed to initialize because of corrupted registry.
14146	ISA Server failed to load ISAPI Filter DLL %1.
14159	Failed to read reference to the protocol from the server publishing rule [%1].
14160	Server publishing rule [%1] that maps %2 %3 to %4 for protocol [%5] is not applied since enterprise policy does not allow publishing.
14161	Server publishing rule [%1] that maps %2 %3 to %4 for protocol [%5] was applied successfully.
14162	Server publishing rule [%1] will not be applied since the filter that supports the protocol is not enabled.
14163	Server publishing rule [%1] that maps %2 %3 to %4 for protocol [%5] failed because the port on the external interface is being used by another application.

Common Service Event Messages

Message ID	Description
11000	%1 failed to start. The failure occurred during %5 because the configuration property %4 of the key %3 could not be accessed.
11001	%1 failed. The failure occurred during %5 because the configuration property %4 of the key %3 could not be accessed.
11002	%1 failed to start. The failure occurred during %5 because the configuration property %4 of key %3 is not valid.
11003	%1 failed. The failure occurred during %5 because the configuration property %4 of key %3 is not valid.
11004	%1 failed to start. The failure occurred during %4 because the system call %3 failed.
11005	%1 failed. The failure occurred during %4 because the system call %3 failed.
11006	%1 failed to start. A shortage of available memory caused the service to fail during %2.
11007	A shortage of available memory caused the %1 to fail during %2.
11008	%1 failed to start. The service failed to register for storage notification on key during %3.
14048	Failed to stop the %1 during %2.
14077	Failed to start the %1 during %2.
14079	Due to an unexpected error, the service %1 stopped responding to all requests.

Web Proxy Service Event Messages

Message ID	Description
14125	The Web Proxy service received %1 requests from the Internet port during the past %2 seconds while Web publishing was disabled.
14126	The Web Proxy service configuration has been modified %1 times during the past %2 seconds.
14127	The Web Proxy service could not initialize (Error code %1).
14128	The Web Proxy service is paused.
14129	The Web Proxy service was resumed.
14130	The Web Proxy service detected that the upstream proxy '%1' is not available.
14131	The Web Proxy service detected that the upstream proxy '%1' is now available.
14132	The Web Proxy service detected that the array member '%1' is down.
14133	The Web Proxy service detected that the array member '%1' is available.
14141	ISA Server detected a proxy chain loop.
14148	Web Proxy service failed to bind its socket to %1 port %2.
14149	Web Proxy service failed to listen to %1 port %2.
14153	The Web Proxy service is not listening on the defined intra-array address although resolving requests within array is enabled.
14154	The Scheduled Content Download Service started the job %1.
14155	The Scheduled Content Download Service finished the job %1.
14156	The Web Proxy Service switched from primary route %1 to backup route %2.
14157	The Web Proxy Service switched from backup route %1 to primary route %2.
14158	The intra-array address defined on this server is not in the LAT.
14177	Some certificates cannot be initialized (error code %1).
14178	The Web Proxy service identified that the address %1 was removed from the interface table.
14179	The Web Proxy Service identified that the address %1 was added to the interface table.
14183	The Web Proxy Service was stopped gracefully.

HTTP Messages

Message ID	Description
12150	The requested header was not found.
12151	The server does not support the requested protocol level.
12152	The server returned an invalid or unrecognized response.
12153	The supplied HTTP header is invalid.
12154	The request for a HTTP header is invalid.
12155	The HTTP header already exists.
12201	A chained proxy server or array member requires proxy-to-proxy authentication.
12202	The ISA Server denies the specified URL.
12204	SSL port specified is not allowed.
12206	The ISA Server detected a proxy chain loop.
12209	The ISA Server requires authorization to fulfill the request.
12210	An ISAPI filter has finished handling the request.
12211	The ISA Server requires a secure channel connection to fulfill the request.
12212	The ISA Server requires a high-security connection to fulfill the request.
12213	The ISA Server requires a client certificate to fulfill the request.
12214	An ISAPI filter has caused an error or terminated with an error.
12221	A chained server requires authentication.
12227	The dial-out connection failed.
12228	The server is too busy to handle this request.
12229	The server requires authorization to fulfill the request.
12230	An ISAPI filter has finished handling the request.
12231	The page must be viewed over a secure channel.
12232	The page must be viewed with a high-security Web browser.
12233	The page requires a client certificate.
12234	An ISAPI filter has caused an error or terminated with an error.

HTML Messages

Message ID	Description
14201	HTTP Proxy Report Message.
14202	HTTP Proxy reports.
14203	The ISA Server encountered an error.
14204	Server Error Message.
14205	ISA Server: Extended error message.
14206	Directory is empty\r\n.
14207	Root Directory.
14208	Gopher root at %%s.
14209	FTP root at %%s.
14210	Gopher directory at %%s.
14211	FTP directory %%s at %%s.
14212	Web Proxy Cache initialization failed due to thread initialization failure.

Gopher Messages

Message ID	Description
12130	A Gopher protocol error occurred.
12131	The URL must be for a file.
12132	An error was detected while parsing the data.
12133	There is no more data.
12134	The URL is not valid.
12135	The URL type is incorrect for this operation.
12136	The request must be for a Gopher Plus item.
12137	The requested attribute was not found.
12138	The URL type is not recognized.

FTP Messages

Message ID	Description
12110	There is already an FTP request in progress during this session.
12111	The FTP session was terminated.

Internet Messages

Message ID	Description
12001	No more Internet handles can be allocated.
12002	The operation timed out.
12003	The server returned extended information.
12004	An internal error occurred in the Windows Internet extensions.
12005	The URL is invalid.
12006	The URL does not use a recognized protocol.
12007	The server name or address could not be resolved.
12008	A protocol with the required capabilities was not found.
12009	The option is invalid.
12010	The length is incorrect for the option type.
12011	The option value cannot be set.
12012	Windows Internet Extension support has been shut down.
12013	The user name was not allowed.
12014	The password was not allowed.
12015	The login request was denied.
12016	The requested operation is invalid.
12017	The operation has been cancelled.
12018	The supplied handle is the wrong type for the requested operation.
12019	The handle is in the wrong state for the requested operation.
12020	The request cannot be made on an ISA Server session.
12021	The registry value could not be found.
12022	The registry parameter is incorrect.
12023	Direct Internet access is not available.
12024	No context value was supplied.
12025	No status callback was supplied.
12026	There are outstanding requests.
12027	The information format is incorrect.
12028	The requested item could not be located.
12029	A connection with the server could not be established.
12030	The connection with the server was terminated abnormally.
12031	The connection with the server was reset.

(Source: Microsoft ISA Server Help)