Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 14148 Source: MicrosoftWebProxy

Level
Description
Web Proxy service failed to bind its socket to 127.0.0.1 port 80. This could be caused by another service that is already using the same port or by a network interface card that is not functional. The error code specified in the Data area of the event properties indicates the cause of the failure. For more information about this event, see ISA Server Help.
Comments
 
See the link to "EventID 14141 from source Microsoft Web Proxy" for information on this event.
If the server has IBM ServerRAID manager version 8 with the "ServeRAID FlashCopy Agent" installed, it will prevent ISA2004 from binding to port 8080 since the agent has already done so. On my system, I changed the service from automatic to manual as a workaround.
A very simple way to check if IIS socket pooling is still active, is to check the output of "netstat -na" for an entry like "0.0.0.0:80". If this is present, then IIS will try to bind to all available IP addresses on port 80.
This problem occurs when the Web Proxy cannot bind the forward Web listenerís port because IIS is already using the port. See ME284662 for more information about this issue.
This can also occur if the internal NIC is disabled (for example, if the internal NIC is attached to a switch and the switch is rebooted or for a short time in a downed state), and then re-enabled. The Web Proxy service sometimes fails to bind (Firewall and secure NAT still works). Stop the Firewall Service then restart it. Web Proxy Service will then re-bind.


See ME313072 to find out how to configure the Web Publishing Service to work with Internet Security and Acceleration Server in Win2k. Also reinstalling ISA SP1 might fix this problem for you.
By default, IIS looks at port 80 on all IPs on your server. You can configure IIS to only listen to a unique IP, but the IIS service itself still listens to all IPs. To use ISA and IIS on the same box you'll need to disable IIS connection pooling (see ME238131).
ISA could not take control of port 80 (http port) on the local host. This is most probably due to another website on the server or another program running which uses port 80. To see if a program is using port 80 go to run and type in http://127.0.0.1:80/ to and see if a page is visable. If so stop the service from using port 80, or move it to another port. If there is no webpage visable, type in netstat -an at the command prompt and see if Port 80 is being used.
This issue can occur if the Web Proxy service is unable to register itself to listen on the port that is specified. The Web Proxy service cannot listen on the port if the port is being used by another program, usually Internet Information Services (IIS) or another Web server. See ME275233.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...