Author Topic: Application Event Log Error  (Read 23436 times)

0 Members and 1 Guest are viewing this topic.

Burl

  • Guest
Application Event Log Error
« on: July 13, 2004, 07:34:27 PM »
Hello again,

I am seeing an Application Event Log error once every hour that appears to associated with an Avast .dll file as follows:

Source: Microsoft ISA Server Control
Event ID: 14146
Description: ISA Server failed to load Web Filter DLL C:\Program Files\Microsoft ISA Server\avpxyftr.dll.

Please provide some guidance in the cause and resolution to eliminating this error.

Best regards,
Burl

Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11658
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Re:Application Event Log Error
« Reply #1 on: July 13, 2004, 09:37:29 PM »
So you have avast! for ISA installed? You've always had?

And does the file "C:\Program Files\Microsoft ISA Server\avpxyftr.dll" exist, then?

BTW what OS/ISA version are you using?

Thanx
Vlk
If at first you don't succeed, then skydiving's not for you.

Burl

  • Guest
Re:Application Event Log Error
« Reply #2 on: July 14, 2004, 01:35:50 AM »
Ah, the details.  I always seem to forget that you need to see them.

The server is running Microsoft Small Business Server 2003 Premium edition with ISA Server 2000 SP1.

ISA was installed at the very beginning.

The C:\Program Files\Microsoft ISA Server\avpxyftr.dll file does exist  and is version 4.1.357.0 with a date of April 21, 2004.

Thanks,
Burl

Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11658
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Re:Application Event Log Error
« Reply #3 on: July 14, 2004, 08:45:09 AM »
So this started to happen just like that? With no obvious reason / update / config change etc.?

Also, do you have the program called Depends.exe? http://www.dependencywalker.com/
It would be useful to check if it is reporting any problems when run on the file "C:\Program Files\Microsoft ISA Server\avpxyftr.dll".

Also, the event log is otherwise clean?

Thanks
Vlk
If at first you don't succeed, then skydiving's not for you.

Burl

  • Guest
Re:Application Event Log Error
« Reply #4 on: July 14, 2004, 04:54:21 PM »
This started on the evening of July 7th and has been continuing once an hour ever since.

There are no other entries in any of the event logs on or about that time that would indicate a problem.

There were not and known configuration changes or updates done on the server at that time.

I ran the Dependency Walker against that DLL and found no errors.

Thanks,
Burl

Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11658
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Re:Application Event Log Error
« Reply #5 on: July 15, 2004, 04:49:44 PM »
Isn't there any additional binary info in the data field of the log entry?
If at first you don't succeed, then skydiving's not for you.

Burl

  • Guest
Re:Application Event Log Error
« Reply #6 on: July 15, 2004, 05:04:02 PM »
Yes, as follows:

0000: 5a 04 07 80

Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11658
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Re:Application Event Log Error
« Reply #7 on: July 15, 2004, 05:36:15 PM »
Hmm, thanks, that didn't help much.

BTW haven't you added the /3GB switch to boot.ini recently?

Thanks
If at first you don't succeed, then skydiving's not for you.

Burl

  • Guest
Re:Application Event Log Error
« Reply #8 on: July 15, 2004, 06:16:23 PM »
I have not added the 3GB switch setting.

Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11658
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Re:Application Event Log Error
« Reply #9 on: July 15, 2004, 06:38:48 PM »
Can you turn on verbose logging of the ISA plugin?

Double click avast tray icon -> double click MS/Proxy/ISA -> last tab -> Maximum logging.

Then see if it logs at least something, to the Antivirus category of the event log.

Thx.
Vlk
If at first you don't succeed, then skydiving's not for you.

Burl

  • Guest
Re:Application Event Log Error
« Reply #10 on: July 15, 2004, 07:11:29 PM »
I have elevated the logging to maximum.  I will monitor for the next few hours and send you feedback on the results.

Thanks

Burl

  • Guest
Re:Application Event Log Error
« Reply #11 on: July 15, 2004, 07:23:23 PM »
I am alredy seeing multiple event log ID 26195 entires with a message of "Avast proxy filter: preprocessing request headers."
They are occuring in groups of three, with a frequency of four or five times a minute.

Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11658
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Re:Application Event Log Error
« Reply #12 on: July 15, 2004, 07:24:29 PM »
Well that would indicate that the filter is in fact loaded...!
What does the avast MS/Proxy provider say as status: "Active" or "Waiting for a subsystem to start"?

If at first you don't succeed, then skydiving's not for you.

Burl

  • Guest
Re:Application Event Log Error
« Reply #13 on: July 15, 2004, 07:42:13 PM »
The status says "The provider is currently running"

Burl

  • Guest
Re:Application Event Log Error
« Reply #14 on: July 16, 2004, 06:09:31 PM »
Over the past several hours the Antivirus event log has been filling with Information type events with ID #'s of 26128, 26135, 26195, 26196, and 26197.  There have been no error messages and the Application event log is still showing the same ISA server error event about ever hour.

I would like to reset the Avast! logging level for the Proxy Server back to a lower setting if that is OK with you.

Thanks,
Burl