An ISA Server 2006 computer may stop responding under a heavy load

Article translations Article translations
Article ID: 941296 - View products that this article applies to.
Expand all | Collapse all

SYMPTOMS

A Microsoft Internet Security and Acceleration (ISA) Server 2006 computer may stop responding when ISA Server 2006 is under a heavy load.

CAUSE

This problem may occur if the Microsoft Firewall service (Wspsrv.exe) process in ISA Server 2006 consumes 2 gigabytes (GB) of memory. By default, no more than 2 GB of address space are available for a 32-bit application.

RESOLUTION

To resolve this problem, apply hotfix rollup package 943215 on the ISA Server 2006 computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
943215 Description of the ISA Server 2006 hotfix package: October 7, 2007
This hotfix adds a memory-monitoring mechanism that lets you set a threshold for the memory consumption of ISA Server 2006. When memory consumption reaches a specified value, ISA Server 2006 enters lockdown mode. At the same time, ISA Server 2006 issues a Log Failure alert. You can configure the Log Failure alert to restart the Microsoft Firewall service.

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
322756 How to back up and restore the registry in Windows
To specify the memory consumption threshold, follow these steps:
  1. Click Start, click Run, type regedit in the Open box, and then click OK.
  2. Locate the following registry subkey, and then click it:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RAT\Stingray\Debug\Common
  3. On the Edit menu, point to New, and then click DWORD Value.
  4. Type VM_THRESHOLD_ALERT, and then press ENTER.
  5. Right-click VM_THRESHOLD_ALERT, and then click Modify.
  6. Under Base, click Decimal.
  7. In the Value data box, type an appropriate value, and then click OK.

    Note The value that you type inside the Value data box is the number of bytes that triggers the alert. For example, type 1900000000 in the Value data box for common configurations. If you type 0 in the Value data box, the memory monitoring mechanism is disabled.
  8. Exit Registry Editor.
Note If the Log Failure alert is frequently triggered after you apply this hotfix, the ISA Server computer is likely to be overloaded. In this situation, you must add more servers to the ISA Server array.

WORKAROUND

To work around this problem, restart the Microsoft Firewall service before it reaches 2 GB of memory consumption.

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

REFERENCES

For more information about lockdown mode, click the following article number to view the article in the Microsoft Knowledge Base:
838711 Lockdown mode of operation in ISA Server 2006 or in ISA Server 2004
For more information about advanced registry operations, click the following article number to view the article in the Microsoft Knowledge Base:
256986 Windows registry information for advanced users

Properties

Article ID: 941296 - Last Review: November 16, 2007 - Revision: 1.4
APPLIES TO
  • Microsoft Internet Security and Acceleration Server 2006 Enterprise Edition
  • Microsoft Internet Security and Acceleration Server 2006 Standard Edition
Keywords: 
kbexpertiseinter kbqfe KB941296

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com