GFI Webmonitor for ISA v3.0 to v4.0 Upgrade may cause very slow internet access for users

Today I’ve done an inplace upgrade for a customers ISA 2004 server up to ISA 2006 the upgrade itself went well once we removed the Firewall Client Share in ISA 2004. The client uses GFI’s Webmonitor for ISA Server to monitor their users and block certain sites. It works pretty well and gives them control over the users internet access above and beyond that provided by ISA. The client was on v3.0 of this product and following the upgrade I noticed an error message in the event log.

Event Type:        Warning

Event Source:        Microsoft ISA Server Web Proxy

Event Category:    None

Event ID:        21237

Date:            29/08/2007

Time:            8:22:48 AM

User:            N/A

Computer:        SERVERNAME

Description:        Web filter 'GFI WebMonitor3 filter' is not installed on this server. Install the filter and then restart the Firewall service.

I figured that if we removed Webmonitor for ISA v3.0 and installed the later version all should be good. So we removed the old version, downloaded and installed the later version which also went well. However we then found that any HTTP access to the internet was so slow as to timeout. We found that this also related to the http://monitor.isa as well. A dig into the event logs found the following;

Event Type:        Warning

Event Source:        ASP.NET 2.0.50727.0

Event Category:    Web Event 

Event ID:        1309

Date:            29/08/2007

Time:            8:49:14 AM

User:            N/A

Computer:        SERVERNAME

Description:

Event code:         3005 
Event message: An unhandled exception has occurred. 
Event time: 29/08/2007 8:49:14 AM 
Event time (UTC): 28/08/2007 10:49:14 PM 
Event ID: 380151aedd694068b8688d3cee0ddb40 
Event sequence: 12 
Event occurrence: 1 
Event detail code: 0 
 
Application information: 
    Application domain: 877b0161-1-128328149238155063 
    Trust level: Full 
    Application Virtual Path: / 
    Application Path: C:\Program Files\GFI\WebMonitor\Interface\ 
    Machine name: SERVERNAME 
 
Process information: 
    Process ID: 4144 
    Process name: WMonWeb.exe 
    Account name: DOMAIN\ServiceAccount 
 
Exception information: 
    Exception type: HttpException 
    Exception message: Session state has created a session id, but cannot save it because the response was already flushed by the application. 
 
Request information: 
    Request URL: http://localhost:1007/UrlHistory.aspx?ID=1 
    Request path: /UrlHistory.aspx 
    User host address: 127.0.0.1 
    User:  
    Is authenticated: False 
    Authentication Type:  
    Thread account name: DOMAIN\ServiceAccount 
 
Thread information: 
    Thread ID: 4 
    Thread account name: DOMAIN\ServiceAccount 
    Is impersonating: False 
    Stack trace:    at System.Web.SessionState.SessionIDManager.SaveSessionID(HttpContext context, String id, Boolean& redirected, Boolean& cookieAdded)

   at System.Web.SessionState.SessionStateModule.CreateSessionId()

   at System.Web.SessionState.SessionStateModule.DelayedGetSessionId()

   at System.Web.SessionState.SessionStateModule.OnReleaseState(Object source, EventArgs eventArgs)

   at System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()

   at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

Ok at this point we just needed to get services running for the user, so we disabled the Web Filter via ISA 2006’s Management Console and things worked fine for us. I then talked to GFI’s Tech Support here in Australia and found that they have in the last 24hours heard about this problem and they are investigating. To resolve the issue for the client at the moment they suggested that we remove v4 and reinstall v3. This worked fine for us and we’ve got our monitoring back again. I’ll post here again with the solution once it becomes available.