Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 23002 Source: MicrosoftISAServerWebProxy

ISA Server was unable to process a response body from /exchange because the response was compressed by the none method, which is not supported by ISA Server. As a result, the response was discarded. This happens when the server ignores the request from ISA Server for GZIP compression and instead compresses the response with none.
I wouldn't recommend disabling Compression Filters. I disabled the alert so it wouldn't fill my Event Log up because this error can be ignored. In ISA 2004 management go to Monitoring, Alerts tab, Configure Alert Definitions then locate the four Compression Failure alerts and uncheck to disable. Alternatively you can adjust the threshold higher on the Events tab or on the Actions tab uncheck to record in the Windows Event log on each one if you do not want to disable them.
See ME916106 and ME916573 for information related to this problem.
I solved this problem by disabling Compression Filter in Add-ins -> Web Filters. ZIP and other compressed files work with OWA now.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.