Today I’ve done an inplace upgrade for a customers ISA 2004 server up to ISA 2006 the upgrade itself went well once we removed the Firewall Client Share in ISA 2004. The client uses GFI’s Webmonitor for ISA Server to monitor their users and block certain sites. It works pretty well and gives them control over the users internet access above and beyond that provided by ISA. The client was on v3.0 of this product and following the upgrade I noticed an error message in the event log.
Event Type: Warning
Event Source: Microsoft ISA Server Web Proxy
Event Category: None
Event ID: 21237
Time: 8:22:48 AM
Description: Web filter 'GFI WebMonitor3 filter' is not installed on this server. Install the filter and then restart the Firewall service.
I figured that if we removed Webmonitor for ISA v3.0 and installed the later version all should be good. So we removed the old version, downloaded and installed the later version which also went well. However we then found that any HTTP access to the internet was so slow as to timeout. We found that this also related to the http://monitor.isa as well. A dig into the event logs found the following;
Event Type: Warning
Event Source: ASP.NET 2.0.50727.0
Event Category: Web Event
Event ID: 1309
Time: 8:49:14 AM
Event code: 3005 Event message: An unhandled exception has occurred. Event time: 29/08/2007 8:49:14 AM Event time (UTC): 28/08/2007 10:49:14 PM Event ID: 380151aedd694068b8688d3cee0ddb40 Event sequence: 12 Event occurrence: 1 Event detail code: 0 Application information: Application domain: 877b0161-1-128328149238155063 Trust level: Full Application Virtual Path: / Application Path: C:\Program Files\GFI\WebMonitor\Interface\ Machine name: SERVERNAME Process information: Process ID: 4144 Process name: WMonWeb.exe Account name: DOMAIN\ServiceAccount Exception information: Exception type: HttpException Exception message: Session state has created a session id, but cannot save it because the response was already flushed by the application. Request information: Request URL: http://localhost:1007/UrlHistory.aspx?ID=1 Request path: /UrlHistory.aspx User host address: 127.0.0.1 User: Is authenticated: False Authentication Type: Thread account name: DOMAIN\ServiceAccount Thread information: Thread ID: 4 Thread account name: DOMAIN\ServiceAccount Is impersonating: False Stack trace: at System.Web.SessionState.SessionIDManager.SaveSessionID(HttpContext context, String id, Boolean& redirected, Boolean& cookieAdded)
at System.Web.SessionState.SessionStateModule.OnReleaseState(Object source, EventArgs eventArgs)
at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)
Ok at this point we just needed to get services running for the user, so we disabled the Web Filter via ISA 2006’s Management Console and things worked fine for us. I then talked to GFI’s Tech Support here in Australia and found that they have in the last 24hours heard about this problem and they are investigating. To resolve the issue for the client at the moment they suggested that we remove v4 and reinstall v3. This worked fine for us and we’ve got our monitoring back again. I’ll post here again with the solution once it becomes available.