New Warning event message that occurs in ISA Server 2004 SP3 to notify delay in logging

Methods to prevent lockdown mode

Method 1

1. Click Start, point to All Programs, point to Accessories, point to System Tools, and then click Disk Defragmenter.
2. Click the volume where you store the log files, and then click Analyze.
3. Click Defragment if the Disk Defragmenter suggests defragmenting the volume.
4. Verify disk performance.

• To avoid long commits, you must frequently defragment the disks where you store ISA log files.
• For reliability and better performance, use RAID volumes.

Method 2

Use master
   	Alter database <DataBaseName>
MODIFY FILE  (<FileName> , FILEGROWTH=<GrowthIncrement>)

Method 3

1. In the ISA Server MMC snap-in, click Monitoring.
2. In the Details pane, click the Logging tab.
3. On the Tasks tab, click Configure Firewall Logging.
4. On the Log tab, click the appropriate Log storage format, and then click Options.
5. In the Store the log file in box, note the path of the folder where firewall logs are stored.
6. Under Log file storage limits, make appropriate changes to reduce the log file size.
7. Click OK, and then click Apply.
8. On the Tasks tab, click Web Proxy Logging.
9. On the Log tab, click the appropriate log storage format, and then click Options.
10. Make sure that the path that you noted in step 5 is not the same path that is listed for Web proxy logging.
    
    Note Make sure that the Web proxy logs are stored to a different disk.
11. Under Log file storage limits, make appropriate changes to reduce the log file size.
12. Click OK, and then click Apply.

Method 4

1. In the ISA Server MMC snap-in, click Monitoring.
2. In the Details pane, click the Logging tab.
3. On the Tasks tab, click Configure Firewall Logging.
4. On the Fields tab, select only the fields that you want, click Apply, and then click OK.
5. Repeat step 2 through step 4 for Web Proxy Logging.

Method 5

1. You can define the following rules at the beginning of the firewall policy:
   • Deny probable malicious traffic to the firewall itself, and log these tries. For example, deny the following types of probable malicious traffic:
     • Telnet
     • FTP
   • Deny any other traffic to the firewall computer itself, and do not log the activity.
2. You can define the following rules at the end of the firewall policy:
   • Deny high-load traffic that is not defined as dangerous, and do not log the activity. For example, deny the following types of high-load traffic:
     • NetBios
     • RIP
     • OSPF
     • DHCP
   • Deny any other traffic with logging enabled.

How to set the time-out period

1. Start Notepad.
2. Copy the following script into a new text file.

   Const SE_VPS_GUID = "{143F5698-103B-12D4-FF34-1F34767DEabc}"
   Const SE_VPS_NAME = "FireLongLogCommitAfterThisAmountOfSeconds"
   Const SE_VPS_VALUE = 15
   
   Sub SetValue()
   
       ' Create the root obect.
       Dim root  ' The FPCLib.FPC root object
       Set root = CreateObject("FPC.Root")
   
       'Declare the other objects needed.
       Dim array       ' An FPCArray object
       Dim VendorSets  ' An FPCVendorParametersSets collection
       Dim VendorSet   ' An FPCVendorParametersSet object
   
       ' Get references to the array object
       ' and the network rules collection.
       Set array = root.GetContainingArray
       Set VendorSets = array.VendorParametersSets
   
       On Error Resume Next
       Set VendorSet = VendorSets.Item( SE_VPS_GUID )
   
       If Err.Number <> 0 Then
           Err.Clear
   
           ' Add the item
           Set VendorSet = VendorSets.Add( SE_VPS_GUID )
           CheckError
           WScript.Echo "New VendorSet added... " & VendorSet.Name
   
       Else
           WScript.Echo "Existing VendorSet found... value- " &  VendorSet.Value(SE_VPS_NAME)
       End If
   
       if VendorSet.Value(SE_VPS_NAME) <> SE_VPS_VALUE Then
   
           Err.Clear
           VendorSet.Value(SE_VPS_NAME) = SE_VPS_VALUE
   
           If Err.Number <> 0 Then
               CheckError
           Else
               VendorSets.Save false, true
               CheckError
   
               If Err.Number = 0 Then
                   WScript.Echo "Done with " & SE_VPS_NAME & ", saved!"
               End If
           End If
       Else
           WScript.Echo "Done with " & SE_VPS_NAME & ", no change!"
       End If
   
   End Sub
   
   Sub CheckError()
   
       If Err.Number <> 0 Then
           WScript.Echo "An error occurred: 0x" & Hex(Err.Number) & " " & Err.Description
           Err.Clear
       End If
   
   End Sub
   
   SetValue
   
   

   Note This script uses the default value of 15 seconds. Change the SE_VPS_VALUE value that is set in the script to an appropriate value.
3. Save the file by using the following file name:
   FireLongLogcommitAfterThisAmountOfSecontds.vbs
4. Double-click the file that you saved in step 3 to run the script.