Hanging, crashing, slowing down… What’s going on with my ISA Server?

1. Introduction


One of the most trick things sometimes for the end user or even for the network administrator is to define what the real behavior is when the subject is related to performance.  Sometimes they say: my ISA Server is crashing on me. Hold on, is it really crashing? How do you define crashing? Did you get a blue screen? Is it the whole server that crashes or only the ISA Services? Which service? See, it is complicated sometimes to be precise on this matter.



2. Reviewing ISA Server Architecture


Before start to talk about those issues and definitions let’s review the core ISA Server architecture:


Figure 1 – ISA Server Core Architecture.


As you can see on the picture above the main component of ISA Server that runs on Kernel Mode is the Firewall Engine (FWENG), all the others ran in User Mode. For a complete definition of the ISA Server Services check the Services article at Microsoft TechNet.


For more in depth explanation about the ISA Server architecture review the article ISA Server 2006 Firewall Core at Microsoft TechNet.


3. Performance Issues on User Mode


In the user mode one of the issues that can happen is the performance degradation due a memory leak. In some situations, the Microsoft Firewall (wspsrv) can be the one that is showing up this behavior; however it might not be the culprit for that.  There is a typical scenario where the Antivirus software can corrupt the log files or the cache files. This can happen if it locks the file for scanning while ISA Server tries to access the file.


In this scenario you might see the wspsrv.exe hitting 100% CPU utilization and keep up there for awhile. This definitely will cause the server’s performance to go down the hill. There are a couple of techniques that can be used to obtain and troubleshoot data in this matter. In this case I’m going to ask you to review the post that I wrote for the ISA Server Team Blog: Isolating problems that seems to be related to the ISA Server – Part III. This was a real experience in a case that I worked and the good thing about this post is that it has the whole action plan to grab the right data that you need.


4. Issues on Kernel Mode


Usually when we have issues in the kernel mode the side effect will be more drastic, for example: server will crash with a blue screen. The good part is that it sometimes faster to identify the root cause, mainly if we compare with performance issues that sometimes can take days and days to identify who was causing this.


On a blue screen scenario what you need to pay attention is on the error message, what driver is showing up on the top of the window and prepare the system to get a dump. For more detail information on how to troubleshoot a blue screen error use the article Blue Screen or STOP Error Message Troubleshooting Before You Call Microsoft Support from Microsoft Help and Support.


5. Besides that, what should I do?


If there is something that ISA Server has in abundance, this is called: performance troubleshooting articles. I’m not going to try to reinvent the wheel here and start writing about Perf Issues and how to troubleshoot. So if you need to really dive in this area, make sure to use the articles below:



When to use it?

Capacity Planning

This planner should be used during the conception of the project, before deploy ISA Server. However you also can use it to see if you ISA Server configuration are appropriated for your environment.

ISA Server Performance Best Practices

Use this article to understand what are the best practices while implementing ISA Server as far as performance is concern.

Monitoring and Troubleshooting Performance

Use this article for troubleshooting purpose. As the name suggests, this is a guide that has the steps to monitor ISA Server’s performance, collect the right data and troubleshoot performance issues.

Improving Web Proxy Client Authentication Performance on ISA Server 2006

Use this article to know how to improve client performance while browsing Internet.


So, if you follow the order above you will be covering the following phases:

1.       Planning.

2.       Pilot (implementing on the lab and evaluating ISA Server).

3.       Post implementation through monitoring and troubleshooting isolated scenarios.

4.       Fine tuning for performance improvement on the client’s perspective.


This should be a good startup to better understand how to improve ISA Server’s performance.


Note: For a complete Perfmon counters reference use Performance Counters article at Microsoft TechNet.




Comments (0)

Skip to main content