First published on TechNet on Nov 30, 2005
On some SBS servers, we've seen this event logged every hour. Typically this occurs around 47 minutes after the hour:
Event ID: 14079
Source: Microsoft ISA Server Control
Description: Due to an unexpected error, the service fwsrv stopped responding to all requests. Stop the service or the corresponding process if it does not respond, and then start it again. Check the Windows event Viewer for related error messages.
You also receive the error message in the list of alerts when you click Monitoring in the ISA Server Management console and then click the Alerts tab. If you click the line that contains the error message, the following description appears in the Alert Information section:
Description: Due to an unexpected error, the service fwsrv stopped responding to all requests. Try to stop the service or kill the corresponding process if it does not respond, and start it again. Check the Event Viewer for related error messages.
So, so far this looks pretty alarming. In virtually every case we've seen of this, however, there is no loss of connectivity. If you watch the fwsrv process in Task Manager, you'll see that its PID does not change, meaning that the process is not really crashing.
The scheduled task "Collect Server Performance Data" is configured to run every hour on the :45. This task is very CPU and disk intensive. Some machines with slow disks (IDE) or slow CPUs will report this false alarm. Per
840180
you can usually ignore this error as long as they are not losing connectivity to the server. You can also modify the scheduled task to only run at night when no-one is onsite.
Thanks to Justin Crosby for this tip.
