TMG Event Log IDs

Article
04/18/2012

The following Table summarizes the Forefront TMG Event IDs.

This table was put into graphs with event information of the Forefront SCOM Management Pack 7.0. We hope you find it useful.

Credits to Jan Tiedemann, Microsoft Forefront Sr. Premier Field Engineer, who prepared this table:

Message	EventIDs	Severity	Category
The Microsoft Firewall failed to log information to the SQL database	21204	Error	Logging: SQL Database
The Microsoft Firewall service was unable to connect to the SQL database	21203, 21202	Error	Logging: SQL Database
The Microsoft Firewall service was unable to open an ADO connection	7	Error	Logging: SQL Database
The TMG Server Web Filter failed to log information to the SQL database	21204	Error	Logging: SQL Database
The TMG Server Web Filter was unable to connect to the SQL database	21202, 21203	Error	Logging: SQL Database
The TMG Server Web Proxy was unable to open an ADO connection	7	Error	Logging: SQL Database
The Microsoft Firewall service failed to log information to the MSDE database	8	Error	Logging: SQL Server Express Database
The Microsoft Firewall service was unable to connect to the MSDE database	21192	Error	Logging: SQL Server Express Database
The TMG Server Web Filter failed to log information to the MSDE database	8	Error	Logging: SQL Server Express Database
The TMG Server Web Filter was unable to connect to the MSDE database	21192	Error	Logging: SQL Server Express Database
All log records from the log queue were successfully formatted and moved to the appropriate formatted store	23415	Error	Logging: Text-File
Invalid TMG Server log directory	21002, 21004	Error	Logging: Text-File
The action to retrieve the TMG Server log directory failed	21001	Error	Logging: Text-File
The log generation rate exceeds the log formatting rate	23414	Error	Logging: Text-File
The Microsoft Firewall service failed to log information because the Firewall log does not exist	4	Error	Logging: Text-File
The Microsoft Firewall service failed to log information to a text file	5	Error	Logging: Text-File
The TMG Server Web Proxy failed to log information because the Web Proxy log does not exist	4	Error	Logging: Text-File
The TMG Server Web Proxy failed to log information to a text file	5	Error	Logging: Text-File
TMG server failed to initialize the log queue	23411, 23412	Error	Logging: Text-File
TMG server failed to log network traffic	23413	Error	Logging: Text-File
A load balanced network has no network adapter and is behind another load balanced network	21230	Warning	NLB-Server Component
A network adapter was found but it does not have a static IP address that can be used as a dedicated IP	21114	Error	NLB-Server Component
A network that is load balanced has a Virtual IP but this Virtual IP belongs to another network	21234	Error	NLB-Server Component
A network that is load balanced is behind a network that is not load balanced	21231	Error	NLB-Server Component
A networks Virtual IP set is the same as the Dedicated IP of a network adapter	21241	Error	NLB-Server Component
A Virtual IP and a Dedicated IP do not have the same subnet mask or are in different subnets	21242	Error	NLB-Server Component
A web server name indicated by a web publishing rule couldnt be resolved	21243	Error	NLB-Server Component
An inconsistency between the Network Load Balancing configuration and the network rules was detected	21215	Error	NLB-Server Component
An NLB network adapter may be used for intraarray communication	21269	Error	NLB-Server Component
Network Load Balancing cannot be configured properly because there is no suitable network adapter	21113	Error	NLB-Server Component
The connection with the Windows Management Instrumentation WMI is broken	21275	Error	NLB-Server Component
The Firewall service failed to apply the Network Load Balancing configuration on the local computer	21107	Error	NLB-Server Component
The network adapter has an illegal IP address configuration	21115	Error	NLB-Server Component
A disk cache failed to initialize	14176	Error	Server Component: Cache
All cache drives failed to initialize properly	14164	Warning	Server Component: Cache
Failed to reduce the size of cache file	14196	Error	Server Component: Cache
The cache was not properly initialized	14172	Error	Server Component: Cache
There is inconsistency in some cache files	14165	Warning	Server Component: Cache
TMG Server failed to initialize the cache because the Network services account does not have sufficient permissions for the root folder and the Urlcache folder on a cache drive	21334	Error	Server Component: Cache
TMG Server failed to write content to the cache file	14197	Error	Server Component: Cache
TMG Server will not be able save all the run-time configuration information of a cache disk when you shut down TMG Server	14195	Warning	Server Component: Cache
While restoring cache data, objects with conflicting information were detected	14169	Warning	Server Component: Cache
A fatal error occurred while attempting to access a certificate private key	12260	Error	Server Component: Publishing
A RADIUS server did not respond	21288	Warning	Server Component: Publishing
A server publishing rule failed	21150	Error	Server Component: Publishing
A server publishing rule failed because a runtime error occurred while processing the rule	21151	Error	Server Component: Publishing
A server publishing rule failed because a session cannot be created for the server	14089	Error	Server Component: Publishing
A server publishing rule failed because the listening IP addresses specified for the rule are not valid	21217	Error	Server Component: Publishing
A server publishing rule failed because the protocol specified cannot be used for publishing	14092	Error	Server Component: Publishing
A server publishing rule failed because there was no valid network listener	21174	Error	Server Component: Publishing
A server publishing rule was unable to bind a socket for the server	14090, 21311	Warning	Server Component: Publishing
A server publishing rule was unable to bind a socket for the server because the port is already in use	14163, 21312	Warning	Server Component: Publishing
A Web publishing rule failed because the Web listener selected for the rule is not valid	21216	Error	Server Component: Publishing
A Web publishing rule stopped forwarding requests to published servers in a Web farm because there are currently no online servers that can accept requests	10150	Warning	Server Component: Publishing
A Web server published by a rule rejected a request because TMG Server does not delegate the credentials required by the Web server for authentication	21330	Error	Server Component: Publishing
An LDAP server did not respond	21286	Warning	Server Component: Publishing
The connection to a RADIUS server was restored	21289	Information	Server Component: Publishing
The connection to an LDAP server was restored	21287	Information	Server Component: Publishing
The name of a published Web server could not be resolved	21313	Error	Server Component: Publishing
The name of a RADIUS server cannot be resolved	21301	Warning	Server Component: Publishing
The reference to the protocol from a server publishing rule could not be read	14159	Error	Server Component: Publishing
The RPC filter cannot use the defined port	20023	Error	Server Component: Publishing
The RPC filter failed to start listening on some of the publishing rules	20024	Error	Server Component: Publishing
The SSL server certificate used by a published server expired or is not yet valid	23406	Error	Server Component: Publishing
The Web site published by a rule rejected the type of credentials that TMG Server tried to delegate	21314	Error	Server Component: Publishing
TMG Server could not delegate credentials using Kerberos constrained delegation	21315	Error	Server Component: Publishing
TMG Server failed to initialize server publishing because an internal error occurred	14095	Error	Server Component: Publishing
TMG Server failed to read one or more server publishing rules from the stored configuration because an internal error occurred	14097	Error	Server Component: Publishing
TMG Server failed to read the parameters of a publishing rule from the stored configuration	14098	Error	Server Component: Publishing
TMG Server failed to read the server publishing rules from the stored configuration because an internal error occurred	14096	Error	Server Component: Publishing
A content download job was stopped	13107	Warning	Server Component: VPN
An invalid request to be released from quarantine was sent from a VPN NAP client	23456	Error	Server Component: VPN
Changes made to the VPN configuration require the computer to be restarted	14112	Warning	Server Component: VPN
Changes to the network will take effect only after restarting the computer	21167	Warning	Server Component: VPN
DHCP cannot be used on multi-server arrays to assign IP addresses to VPN clients or remote endpoint servers	21247	Error	Server Component: VPN
Failed to enable the Routing and Remote Access service	14106	Error	Server Component: VPN
Failed to read the Routing and Remote Access service configuration from the registry	14103	Error	Server Component: VPN
Failed to resolve a remote gateway address specified for VPN site-to-site network	21255	Warning	Server Component: VPN
Failed to save the Routing and Remote Access service configuration in the registry	14102	Error	Server Component: VPN
Failed to save VPN configuration, the IPsec pre-shared key for this server may be unavailable	21258	Error	Server Component: VPN
Failed to start the Routing and Remote Access service	14104	Error	Server Component: VPN
Failed to stop the Routing and Remote Access service	14105	Error	Server Component: VPN
IPSecPol could not be detected on the TMG Server computer	21195	Error	Server Component: VPN
No connection owner is specified for a VPN site-to-site network	21244	Warning	Server Component: VPN
One or more previously unavailable array member is not handling VPN connections	21246	Warning	Server Component: VPN
Quarantine in the Remote Access Policy cannot be enabled	15109	Warning	Server Component: VPN
The connection request policy for NPS may prevent new RADIUS clients from obtaining NPS (RADIUS) services	23455	Error	Server Component: VPN
The Firewall service cannot create the IPSec configuration for a network	21165	Error	Server Component: VPN
The Firewall service cannot remove the IPSec configuration for a network	21166	Error	Server Component: VPN
The IPsec tunnel is not functioning because the local endpoint was misconfigured	21245	Error	Server Component: VPN
The RADIUS Server List is empty	21098	Error	Server Component: VPN
The Remote Access Service configuration for VPN could not be completed	21199	Error	Server Component: VPN
The TMG Scheduler service was unable to connect to the Web Proxy filter	13109	Error	Server Component: VPN
TMG Server cannot locate a route to a remote site	21197	Error	Server Component: VPN
TMG Server could not query the status of the Remote Access Service	21176	Error	Server Component: VPN
TMG Server failed to disable the Remote Access service	21175	Error	Server Component: VPN
A web filter failed to reload its configuration	21177	Error	Server Component: WebProxy
A web filter is not installed on this server	21237	Error	Server Component: WebProxy
Definitions for malware inspection could not be loaded during update	23468	Error	Server Component: WebProxy
Definitions for malware inspection could not be loaded when the Microsoft Firewall Service attempted to start	23486	Error	Server Component: WebProxy
Forefront TMG cannot route network traffic through a specific ISP link due to configuration problems	23421	Error	Server Component: WebProxy
Forefront TMG failed to reload the newly downloaded URL filtering database from the folder %1	30533	Error	Server Component: WebProxy
One or more licenses to subscription services have expired. For more information about the status of your licenses, check the Update Center	23471	Error	Server Component: WebProxy
Some certificates cannot be initialized	14177	Error	Server Component: WebProxy
The amount of disk space that the Malware Inspection Filter needs for the accumulation of content exceeded the available disk space	23460	Error	Server Component: WebProxy
The certification authority (CA) certificate that should be used to sign cloned SSL server certificates for destination servers has expired	23443	Error	Server Component: WebProxy
The certification authority (CA) certificate that will be used to sign cloned SSL server certificates for destination servers was successfully imported	23447	Error	Server Component: WebProxy
The client certificate was revoked due to an invalid or missing Certificate Revocation List CRL	21198	Error	Server Component: WebProxy
The HTTPS inspection configuration settings could not be loaded	23434	Error	Server Component: WebProxy
The imported certification authority (CA) certificate that should be used to sign cloned SSL server certificates for destination servers is not trusted by the local computer	23444	Error	Server Component: WebProxy
The imported certification authority (CA) certificate that should be used to sign cloned SSL server certificates for destination servers is not yet valid	23442	Error	Server Component: WebProxy
The IntraArrayAddress defined on this server is not in the Local Address Table LAT	14158	Error	Server Component: WebProxy
The Malware Inspection Filter failed to load a progress notification template file	23464	Error	Server Component: WebProxy
The maximum amount of disk space allowed for accumulation by the Malware Inspection Filter was exceeded	23459	Error	Server Component: WebProxy
The number of HTTP requests per minute from a specific source IP address exceeded the configured limit	21285	Error	Server Component: WebProxy
The TMG Server Web Proxy memory pool is low	31212	Warning	Server Component: WebProxy
The Web Proxy filter could not initialize	14127	Error	Server Component: WebProxy
The Web Proxy filter failed to bind its socket to a port	14148	Warning	Server Component: WebProxy
The Web Proxy filter failed to connect to one of the array members	14132	Warning	Server Component: WebProxy
The Web Proxy filter failed to create a network socket	14198	Error	Server Component: WebProxy
The Web Proxy filter is not listening on the defined intraarray address on a specified port	14153	Error	Server Component: WebProxy
TMG Server cannot connect to a proxy server	14000	Error	Server Component: WebProxy
TMG Server detected a proxy server loop	14141	Warning	Server Component: WebProxy
TMG Server failed to establish an SSL connection	14200	Error	Server Component: WebProxy
TMG Server failed to initialize due to a corrupted registry	14145	Error	Server Component: WebProxy
TMG Server failed to load a Web Filter DLL	14146	Error	Server Component: WebProxy
Web filters cannot be initialized or updated changes cannot be applied To resolve this error check recent changes made to Web filters configuration	21159	Error	Server Component: WebProxy
Web Proxy filter failed to listen to a socket	14149	Warning	Server Component: WebProxy
A Forefront TMG computer may be subject to policy conflicts	23474	Warning	TMG Server
A missing enterprise policy preventing the TMG Server configuration agent from uploading the configuration to the TMG Server services	21254	Error	TMG Server
A network adapter belongs to an enterprise network which is not included in an array level network	21266	Error	TMG Server
A published RPC service cannot be reached	20021	Warning	TMG Server
A report could not be created	21023	Error	TMG Server
A report could not be created due to low memory resources	21027	Error	TMG Server
A report could not be published	21140	Warning	TMG Server
A report was not created	21026	Error	TMG Server
A shortage of available memory caused the Firewall service to fail	14007	Error	TMG Server
A shortage of available memory caused the Microsoft Firewall service to fail	11007	Error	TMG Server
A shortage of available memory caused the Microsoft Forefront TMG Control service to fail	11007	Error	TMG Server
All of the local IP addresses that are specified for performing NAT to a specific network are not available	23409	Error	TMG Server
An application filter could not be loaded	14060	Error	TMG Server
An application filter is not installed on this server	21236	Warning	TMG Server
An application filter performed an illegal operation inside the Firewall service process	14056	Error	TMG Server
An array network has more than one reference to an enterprise network	21221	Error	TMG Server
An array network has reference to a non existent enterprise network	21220	Error	TMG Server
An array network overlaps with another array network	21219	Error	TMG Server
An enterprise network is not included in an array level network	21264	Error	TMG Server
An enterprise network overlaps with another enterperise network	21218	Error	TMG Server
An error occurred during an attempt to check for, download, or install definition updates	23450	Error	TMG Server
An externally defined filter is registered to a Forefront TMG Windows Filtering Platform sub-layers	23473	Error	TMG Server
An insecure configuration was detected	14087	Error	TMG Server
Attempts to check for new definition updates failed consecutively	23481	Error	TMG Server
Configuration changes made may result in loss of connectivity to the TMG Configuration Storage Server and therefore couldn't be applied	21257	Error	TMG Server
Continuous changes to the configuration were detected	21267	Warning	TMG Server
Failed to connect to a COM server class on the local computer	21005	Error	TMG Server
Failed to stop the service	14048	Error	TMG Server
Failed to write the last daily summary date to the registry	21158	Warning	TMG Server
Failed to write the last monthly summary date to the registry	21157	Warning	TMG Server
Forefront TMG cannot route network traffic through a specific ISP link	23425	Error	TMG Server
Forefront TMG cannot route network traffic to the internet	31234	Error	TMG Server
Forefront TMG entered a state in which all traffic is blocked	23453	Error	TMG Server
Forefront TMG is no longer configured to use Microsoft Update	23482	Error	TMG Server
H323 filter failed to bind IP address for listening	20004	Error	TMG Server
H323 filter invalid port configured for listening	20005	Error	TMG Server
Initialization of the H323 performance counters failed	20062	Warning	TMG Server
Initializing the RAS client module failed	20059	Error	TMG Server
Intra array account must be defined and enabled when working when the array members are in a workgroup	21225	Error	TMG Server
Invalid parameters were specified for the ReportGen utility	21025	Error	TMG Server
Listening for Q931 connections failed	20060	Error	TMG Server
Low resources Memory allocation failed	20020	Error	TMG Server
Memory allocation failed	20040	Error	TMG Server
Microsoft Firewall Service could not create or access the accumulation folder	23417	Error	TMG Server
Microsoft Firewall Service failed to create the configuration required for processing IPsec traffic	23454	Error	TMG Server
New definition updates are available, but were not installed	23477	Error	TMG Server
One or more licenses to subscription services are about to expire	31276	Warning	TMG Server
One or more licenses to subscription services have expired	23471	Warning	TMG Server
One or more of the actions associated with an alert has failed due to configuration settings	14065	Error	TMG Server
Registration with the H323 Gatekeeper failed	20066	Warning	TMG Server
Routing configurations for some intra array servers are not defined properly	21226	Warning	TMG Server
SOCKS filter failed to bind IP address for listening	20002	Error	TMG Server
SOCKS filter invalid port configured for listening	20001	Error	TMG Server
Software Update Required	23502	Error	TMG Server
The action to connect to the TMG Server report data collector failed	21000	Error	TMG Server
The action to copy the period summary from an array member failed	21020	Error	TMG Server
The action to summarize all period summaries from the array failed	21022	Error	TMG Server
The alert feature of the TMG Server Control service failed to logon to run a command	14072	Error	TMG Server
The configuration required for correct processing of IPsec-secured traffic could not be applied	23452	Error	TMG Server
The daily summaries could not be deleted	21017	Error	TMG Server
The daily summaries could not be rolled up into a monthly summary	30974	Error	TMG Server
The daily summaries for a specific period could not be rolled up into a single summary	21019	Error	TMG Server
The daily summary was not created	30973	Error	TMG Server
The email signaling that a report was generated could not be sent	21141	Warning	TMG Server
The Firewall service cannot connect to another proxy server	14058, 14059	Error	TMG Server
The Firewall service cannot initialize the firewall engine driver	14009	Error	TMG Server
The Firewall service cannot initialize WinSock	14002	Error	TMG Server
The Firewall service detected a demand dial interface connection that was not created by TMG Server	21162	Warning	TMG Server
The Firewall service detected a possible configuration error in a demand dial interface	21163	Warning	TMG Server
The Firewall service detected a possible dial up connection configuration error	21164	Warning	TMG Server
The Firewall service detected that an upstream proxy server is not available	14061	Warning	TMG Server
The Firewall service encountered an illegal operation runtime error R6025 in a pure virtual function	14055	Error	TMG Server
The Firewall service failed to load a security dynamic link library DLL	14015	Error	TMG Server
The Firewall service failed to open a listener for Firewall clients	14035	Warning	TMG Server
The Firewall service requires Windows Server 2000 Service Pack 4 or Windows Server 2003	14014	Error	TMG Server
The Firewall service stopped because an application filter module generated an exception code	14057	Error	TMG Server
The FTP filter failed to parse the allowed FTP commands	21172	Error	TMG Server
The Microsoft Firewall service could not start because it failed to connect to The TMG Server Control service	14070	Error	TMG Server
The Microsoft Firewall service encountered a failure	11003, 11001, 11010	Error	TMG Server
The Microsoft Firewall service encountered a system call failure	11005	Error	TMG Server
The Microsoft Firewall Service failed to initialize	14001	Error	TMG Server
The Microsoft Firewall service failed to start	11004, 11006, 11008	Error	TMG Server
The Microsoft Firewall service failed to start	11009, 11002, 11000	Error	TMG Server
The Microsoft Forefront TMG Control service encountered a failure	11003, 11010, 11001	Error	TMG Server
The Microsoft Forefront TMG Control service encountered a system call failure	11005	Error	TMG Server
The Microsoft Forefront TMG Control service failed to start	11009, 11002, 11000, 11004, 11006, 14077, 14192, 11008	Error	TMG Server
The Microsoft TMG Job Scheduler service could not start because it failed to connect to The TMG Server Control service	14070	Error	TMG Server
The monthly summaries could not be deleted	21018	Error	TMG Server
The non TCP connection limit for a specific IP address was exceeded	15113	Warning	TMG Server
The number of denied connections from a specific source IP address exceeded the configured limit	21284	Error	TMG Server
The number of denied TCP and non TCP packets per second exceeded the system limit	21282	Error	TMG Server
The number of pending DNS name resolution requests exceeds the system defined maximum	21279	Error	TMG Server
The number of TCP connections allowed from a specific source IP address exceeded the configured limit	15120	Warning	TMG Server
The number of TCP connections per minute from a specific source IP address exceeded the configured limit	15119	Warning	TMG Server
The percentage of threads used for pending DNS requests out of the total number of available threads is below the system defined maximum	21283	Information	TMG Server
The registry hive could not be loaded	21260	Error	TMG Server
The routing table for a network adapter includes IP address ranges that are not included in the array level network to which it is bound	21265	Error	TMG Server
The service could not start because it failed to load RADIUS related configuration	21091	Error	TMG Server
The size of the free non paged pool fell below the system defined minimum	21280	Error	TMG Server
The size of the free non paged pool is above the system defined minimum	21281	Information	TMG Server
The TMG Control service requires Windows Server 2000 with Service Pack 4 or Windows Server 2003	14025	Error	TMG Server
The TMG Control service was stopped	14037	Error	TMG Server
The TMG Firewall Service was stopped the evaluation period has expired	14032	Error	TMG Server
The TMG Server configuration agent was unable to upload the configuration to the TMG Server services	21209	Error	TMG Server
The TMG Server Control service configuration agent was unable to revert to last known configuration	21210	Error	TMG Server
The TMG Server Standard Edition cannot run because either the server is using more than 4 processors or it is configured to use the Active Directory service	14109	Error	TMG Server
TMG failed to load the firewall policy configuration	14020, 14018, 14019	Error	TMG Server
TMG Server detected a network adapter connected to multiple networks	21125	Error	TMG Server
TMG Server detected a network element containing an invalid address range	21096	Error	TMG Server
TMG Server detected network elements that contain overlapping address ranges	21097	Error	TMG Server
TMG Server detected routes through a network adapter that do not correlate with the network to which this adapter belongs	14147	Error	TMG Server
TMG Server detected that an IP address was removed from a network	21139	Information	TMG Server
TMG Server failed to activate the Firewall Engine	21094	Error	TMG Server
TMG Server failed to connect to the Configuration Storage server	21238	Warning	TMG Server
TMG Server has detected RADIUS servers with identical names in the RADIUS Server List storage	21102	Warning	TMG Server
TMG Server has encountered an error while loading the RADIUS Server List	21100, 21099	Error	TMG Server
TMG Server report or summary generation error	21152, 31031, 21028, 21153	Error	TMG Server
Two array networks include the same enterprise network	21222	Error	TMG Server
Unable to update local registry with changes made to the Central Storage	21212	Error	TMG Server
Unexpected error the service has stopped responding to all requests	14079	Error	TMG Server
Update Center Required Service Not Started	23513	Error	TMG Server
Updating of the computer name or FQDN failed	21124	Warning	TMG Server
Windows user based authentication is required for the applied policy	15118	Warning	TMG Server

TMG Event Log IDs

Additional resources