The following Table summarizes the Forefront TMG Event IDs.

This table was put into graphs with event information of the Forefront SCOM Management Pack 7.0. We hope you find it useful.

Credits to Jan Tiedemann, Microsoft Forefront Sr. Premier Field Engineer, who prepared this table:

Message

EventIDs

Severity

Category

The Microsoft Firewall failed to log information to the SQL database

21204

Error

Logging: SQL Database

The Microsoft Firewall service was unable to connect to the SQL database

21203, 21202

Error

Logging: SQL Database

The Microsoft Firewall service was unable to open an ADO connection

7

Error

Logging: SQL Database

The TMG Server Web Filter failed to log information to the SQL database

21204

Error

Logging: SQL Database

The TMG Server Web Filter was unable to connect to the SQL database

21202, 21203

Error

Logging: SQL Database

The TMG Server Web Proxy was unable to open an ADO connection

7

Error

Logging: SQL Database

The Microsoft Firewall service failed to log information to the MSDE database

8

Error

Logging: SQL Server Express Database

The Microsoft Firewall service was unable to connect to the MSDE database

21192

Error

Logging: SQL Server Express Database

The TMG Server Web Filter failed to log information to the MSDE database

8

Error

Logging: SQL Server Express Database

The TMG Server Web Filter was unable to connect to the MSDE database

21192

Error

Logging: SQL Server Express Database

All log records from the log queue were successfully formatted and moved to the appropriate formatted store

23415

Error

Logging: Text-File

Invalid TMG Server log directory

21002, 21004

Error

Logging: Text-File

The action to retrieve the TMG Server log directory failed

21001

Error

Logging: Text-File

The log generation rate exceeds the log formatting rate

23414

Error

Logging: Text-File

The Microsoft Firewall service failed to log information because the Firewall log does not exist

4

Error

Logging: Text-File

The Microsoft Firewall service failed to log information to a text file

5

Error

Logging: Text-File

The TMG Server Web Proxy failed to log information because the Web Proxy log does not exist

4

Error

Logging: Text-File

The TMG Server Web Proxy failed to log information to a text file

5

Error

Logging: Text-File

TMG server failed to initialize the log queue

23411, 23412

Error

Logging: Text-File

TMG server failed to log network traffic

23413

Error

Logging: Text-File

A load balanced network has no network adapter and is behind another load balanced network

21230

Warning

NLB-Server Component

A network adapter was found but it does not have a static IP address that can be used as a dedicated IP

21114

Error

NLB-Server Component

A network that is load balanced has a Virtual IP but this Virtual IP belongs to another network

21234

Error

NLB-Server Component

A network that is load balanced is behind a network that is not load balanced

21231

Error

NLB-Server Component

A networks Virtual IP set is the same as the Dedicated IP of a network adapter

21241

Error

NLB-Server Component

A Virtual IP and a Dedicated IP do not have the same subnet mask or are in different subnets

21242

Error

NLB-Server Component

A web server name indicated by a web publishing rule couldnt be resolved

21243

Error

NLB-Server Component

An inconsistency between the Network Load Balancing configuration and the network rules was detected

21215

Error

NLB-Server Component

An NLB network adapter may be used for intraarray communication

21269

Error

NLB-Server Component

Network Load Balancing cannot be configured properly because there is no suitable network adapter

21113

Error

NLB-Server Component

The connection with the Windows Management Instrumentation WMI is broken

21275

Error

NLB-Server Component

The Firewall service failed to apply the Network Load Balancing configuration on the local computer

21107

Error

NLB-Server Component

The network adapter has an illegal IP address configuration

21115

Error

NLB-Server Component

A disk cache failed to initialize

14176

Error

Server Component: Cache

All cache drives failed to initialize properly

14164

Warning

Server Component: Cache

Failed to reduce the size of cache file

14196

Error

Server Component: Cache

The cache was not properly initialized

14172

Error

Server Component: Cache

There is inconsistency in some cache files

14165

Warning

Server Component: Cache

TMG Server failed to initialize the cache because the Network services account does not have sufficient permissions for the root folder and the Urlcache folder on a cache drive

21334

Error

Server Component: Cache

TMG Server failed to write content to the cache file

14197

Error

Server Component: Cache

TMG Server will not be able save all the run-time configuration information of a cache disk when you shut down TMG Server

14195

Warning

Server Component: Cache

While restoring cache data, objects with conflicting information were detected

14169

Warning

Server Component: Cache

A fatal error occurred while attempting to access a certificate private key

12260

Error

Server Component: Publishing

A RADIUS server did not respond

21288

Warning

Server Component: Publishing

A server publishing rule failed

21150

Error

Server Component: Publishing

A server publishing rule failed because a runtime error occurred while processing the rule

21151

Error

Server Component: Publishing

A server publishing rule failed because a session cannot be created for the server

14089

Error

Server Component: Publishing

A server publishing rule failed because the listening IP addresses specified for the rule are not valid

21217

Error

Server Component: Publishing

A server publishing rule failed because the protocol specified cannot be used for publishing

14092

Error

Server Component: Publishing

A server publishing rule failed because there was no valid network listener

21174

Error

Server Component: Publishing

A server publishing rule was unable to bind a socket for the server

14090, 21311

Warning

Server Component: Publishing

A server publishing rule was unable to bind a socket for the server because the port is already in use

14163, 21312

Warning

Server Component: Publishing

A Web publishing rule failed because the Web listener selected for the rule is not valid

21216

Error

Server Component: Publishing

A Web publishing rule stopped forwarding requests to published servers in a Web farm because there are currently no online servers that can accept requests

10150

Warning

Server Component: Publishing

A Web server published by a rule rejected a request because TMG Server does not delegate the credentials required by the Web server for authentication

21330

Error

Server Component: Publishing

An LDAP server did not respond

21286

Warning

Server Component: Publishing

The connection to a RADIUS server was restored

21289

Information

Server Component: Publishing

The connection to an LDAP server was restored

21287

Information

Server Component: Publishing

The name of a published Web server could not be resolved

21313

Error

Server Component: Publishing

The name of a RADIUS server cannot be resolved

21301

Warning

Server Component: Publishing

The reference to the protocol from a server publishing rule could not be read

14159

Error

Server Component: Publishing

The RPC filter cannot use the defined port

20023

Error

Server Component: Publishing

The RPC filter failed to start listening on some of the publishing rules

20024

Error

Server Component: Publishing

The SSL server certificate used by a published server expired or is not yet valid

23406

Error

Server Component: Publishing

The Web site published by a rule rejected the type of credentials that TMG Server tried to delegate

21314

Error

Server Component: Publishing

TMG Server could not delegate credentials using Kerberos constrained delegation

21315

Error

Server Component: Publishing

TMG Server failed to initialize server publishing because an internal error occurred

14095

Error

Server Component: Publishing

TMG Server failed to read one or more server publishing rules from the stored configuration because an internal error occurred

14097

Error

Server Component: Publishing

TMG Server failed to read the parameters of a publishing rule from the stored configuration

14098

Error

Server Component: Publishing

TMG Server failed to read the server publishing rules from the stored configuration because an internal error occurred

14096

Error

Server Component: Publishing

A content download job was stopped

13107

Warning

Server Component: VPN

An invalid request to be released from quarantine was sent from a VPN NAP client

23456

Error

Server Component: VPN

Changes made to the VPN configuration require the computer to be restarted

14112

Warning

Server Component: VPN

Changes to the network will take effect only after restarting the computer

21167

Warning

Server Component: VPN

DHCP cannot be used on multi-server arrays to assign IP addresses to VPN clients or remote endpoint servers

21247

Error

Server Component: VPN

Failed to enable the Routing and Remote Access service

14106

Error

Server Component: VPN

Failed to read the Routing and Remote Access service configuration from the registry

14103

Error

Server Component: VPN

Failed to resolve a remote gateway address specified for VPN site-to-site network

21255

Warning

Server Component: VPN

Failed to save the Routing and Remote Access service configuration in the registry

14102

Error

Server Component: VPN

Failed to save VPN configuration, the IPsec pre-shared key for this server may be unavailable

21258

Error

Server Component: VPN

Failed to start the Routing and Remote Access service

14104

Error

Server Component: VPN

Failed to stop the Routing and Remote Access service

14105

Error

Server Component: VPN

IPSecPol could not be detected on the TMG Server computer

21195

Error

Server Component: VPN

No connection owner is specified for a VPN site-to-site network

21244

Warning

Server Component: VPN

One or more previously unavailable array member is not handling VPN connections

21246

Warning

Server Component: VPN

Quarantine in the Remote Access Policy cannot be enabled

15109

Warning

Server Component: VPN

The connection request policy for NPS may prevent new RADIUS clients from obtaining NPS (RADIUS) services

23455

Error

Server Component: VPN

The Firewall service cannot create the IPSec configuration for a network

21165

Error

Server Component: VPN

The Firewall service cannot remove the IPSec configuration for a network

21166

Error

Server Component: VPN

The IPsec tunnel is not functioning because the local endpoint was misconfigured

21245

Error

Server Component: VPN

The RADIUS Server List is empty

21098

Error

Server Component: VPN

The Remote Access Service configuration for VPN could not be completed

21199

Error

Server Component: VPN

The TMG Scheduler service was unable to connect to the Web Proxy filter

13109

Error

Server Component: VPN

TMG Server cannot locate a route to a remote site

21197

Error

Server Component: VPN

TMG Server could not query the status of the Remote Access Service

21176

Error

Server Component: VPN

TMG Server failed to disable the Remote Access service

21175

Error

Server Component: VPN

A web filter failed to reload its configuration

21177

Error

Server Component: WebProxy

A web filter is not installed on this server

21237

Error

Server Component: WebProxy

Definitions for malware inspection could not be loaded during update

23468

Error

Server Component: WebProxy

Definitions for malware inspection could not be loaded when the Microsoft Firewall Service attempted to start

23486

Error

Server Component: WebProxy

Forefront TMG cannot route network traffic through a specific ISP link due to configuration problems

23421

Error

Server Component: WebProxy

Forefront TMG failed to reload the newly downloaded URL filtering database from the folder %1

30533

Error

Server Component: WebProxy

One or more licenses to subscription services have expired. For more information about the status of your licenses, check the Update Center

23471

Error

Server Component: WebProxy

Some certificates cannot be initialized

14177

Error

Server Component: WebProxy

The amount of disk space that the Malware Inspection Filter needs for the accumulation of content exceeded the available disk space

23460

Error

Server Component: WebProxy

The certification authority (CA) certificate that should be used to sign cloned SSL server certificates for destination servers has expired

23443

Error

Server Component: WebProxy

The certification authority (CA) certificate that will be used to sign cloned SSL server certificates for destination servers was successfully imported

23447

Error

Server Component: WebProxy

The client certificate was revoked due to an invalid or missing Certificate Revocation List CRL

21198

Error

Server Component: WebProxy

The HTTPS inspection configuration settings could not be loaded

23434

Error

Server Component: WebProxy

The imported certification authority (CA) certificate that should be used to sign cloned SSL server certificates for destination servers is not trusted by the local computer

23444

Error

Server Component: WebProxy

The imported certification authority (CA) certificate that should be used to sign cloned SSL server certificates for destination servers is not yet valid

23442

Error

Server Component: WebProxy

The IntraArrayAddress defined on this server is not in the Local Address Table LAT

14158

Error

Server Component: WebProxy

The Malware Inspection Filter failed to load a progress notification template file

23464

Error

Server Component: WebProxy

The maximum amount of disk space allowed for accumulation by the Malware Inspection Filter was exceeded

23459

Error

Server Component: WebProxy

The number of HTTP requests per minute from a specific source IP address exceeded the configured limit

21285

Error

Server Component: WebProxy

The TMG Server Web Proxy memory pool is low

31212

Warning

Server Component: WebProxy

The Web Proxy filter could not initialize

14127

Error

Server Component: WebProxy

The Web Proxy filter failed to bind its socket to a port

14148

Warning

Server Component: WebProxy

The Web Proxy filter failed to connect to one of the array members

14132

Warning

Server Component: WebProxy

The Web Proxy filter failed to create a network socket

14198

Error

Server Component: WebProxy

The Web Proxy filter is not listening on the defined intraarray address on a specified port

14153

Error

Server Component: WebProxy

TMG Server cannot connect to a proxy server

14000

Error

Server Component: WebProxy

TMG Server detected a proxy server loop

14141

Warning

Server Component: WebProxy

TMG Server failed to establish an SSL connection

14200

Error

Server Component: WebProxy

TMG Server failed to initialize due to a corrupted registry

14145

Error

Server Component: WebProxy

TMG Server failed to load a Web Filter DLL

14146

Error

Server Component: WebProxy

Web filters cannot be initialized or updated changes cannot be applied To resolve this error check recent changes made to Web filters configuration

21159

Error

Server Component: WebProxy

Web Proxy filter failed to listen to a socket

14149

Warning

Server Component: WebProxy

A Forefront TMG computer may be subject to policy conflicts

23474

Warning

TMG Server

A missing enterprise policy preventing the TMG Server configuration agent from uploading the configuration to the TMG Server services

21254

Error

TMG Server

A network adapter belongs to an enterprise network which is not included in an array level network

21266

Error

TMG Server

A published RPC service cannot be reached

20021

Warning

TMG Server

A report could not be created

21023

Error

TMG Server

A report could not be created due to low memory resources

21027

Error

TMG Server

A report could not be published

21140

Warning

TMG Server

A report was not created

21026

Error

TMG Server

A shortage of available memory caused the Firewall service to fail

14007

Error

TMG Server

A shortage of available memory caused the Microsoft Firewall service to fail

11007

Error

TMG Server

A shortage of available memory caused the Microsoft Forefront TMG Control service to fail

11007

Error

TMG Server

All of the local IP addresses that are specified for performing NAT to a specific network are not available

23409

Error

TMG Server

An application filter could not be loaded

14060

Error

TMG Server

An application filter is not installed on this server

21236

Warning

TMG Server

An application filter performed an illegal operation inside the Firewall service process

14056

Error

TMG Server

An array network has more than one reference to an enterprise network

21221

Error

TMG Server

An array network has reference to a non existent enterprise network

21220

Error

TMG Server

An array network overlaps with another array network

21219

Error

TMG Server

An enterprise network is not included in an array level network

21264

Error

TMG Server

An enterprise network overlaps with another enterperise network

21218

Error

TMG Server

An error occurred during an attempt to check for, download, or install definition updates

23450

Error

TMG Server

An externally defined filter is registered to a Forefront TMG Windows Filtering Platform sub-layers

23473

Error

TMG Server

An insecure configuration was detected

14087

Error

TMG Server

Attempts to check for new definition updates failed consecutively

23481

Error

TMG Server

Configuration changes made may result in loss of connectivity to the TMG Configuration Storage Server and therefore couldn't be applied

21257

Error

TMG Server

Continuous changes to the configuration were detected

21267

Warning

TMG Server

Failed to connect to a COM server class on the local computer

21005

Error

TMG Server

Failed to stop the service

14048

Error

TMG Server

Failed to write the last daily summary date to the registry

21158

Warning

TMG Server

Failed to write the last monthly summary date to the registry

21157

Warning

TMG Server

Forefront TMG cannot route network traffic through a specific ISP link

23425

Error

TMG Server

Forefront TMG cannot route network traffic to the internet

31234

Error

TMG Server

Forefront TMG entered a state in which all traffic is blocked

23453

Error

TMG Server

Forefront TMG is no longer configured to use Microsoft Update

23482

Error

TMG Server

H323 filter failed to bind IP address for listening

20004

Error

TMG Server

H323 filter invalid port configured for listening

20005

Error

TMG Server

Initialization of the H323 performance counters failed

20062

Warning

TMG Server

Initializing the RAS client module failed

20059

Error

TMG Server

Intra array account must be defined and enabled when working when the array members are in a workgroup

21225

Error

TMG Server

Invalid parameters were specified for the ReportGen utility

21025

Error

TMG Server

Listening for Q931 connections failed

20060

Error

TMG Server

Low resources Memory allocation failed

20020

Error

TMG Server

Memory allocation failed

20040

Error

TMG Server

Microsoft Firewall Service could not create or access the accumulation folder

23417

Error

TMG Server

Microsoft Firewall Service failed to create the configuration required for processing IPsec traffic

23454

Error

TMG Server

New definition updates are available, but were not installed

23477

Error

TMG Server

One or more licenses to subscription services are about to expire

31276

Warning

TMG Server

One or more licenses to subscription services have expired

23471

Warning

TMG Server

One or more of the actions associated with an alert has failed due to configuration settings

14065

Error

TMG Server

Registration with the H323 Gatekeeper failed

20066

Warning

TMG Server

Routing configurations for some intra array servers are not defined properly

21226

Warning

TMG Server

SOCKS filter failed to bind IP address for listening

20002

Error

TMG Server

SOCKS filter invalid port configured for listening

20001

Error

TMG Server

Software Update Required

23502

Error

TMG Server

The action to connect to the TMG Server report data collector failed

21000

Error

TMG Server

The action to copy the period summary from an array member failed

21020

Error

TMG Server

The action to summarize all period summaries from the array failed

21022

Error

TMG Server

The alert feature of the TMG Server Control service failed to logon to run a command

14072

Error

TMG Server

The configuration required for correct processing of IPsec-secured traffic could not be applied

23452

Error

TMG Server

The daily summaries could not be deleted

21017

Error

TMG Server

The daily summaries could not be rolled up into a monthly summary

30974

Error

TMG Server

The daily summaries for a specific period could not be rolled up into a single summary

21019

Error

TMG Server

The daily summary was not created

30973

Error

TMG Server

The email signaling that a report was generated could not be sent

21141

Warning

TMG Server

The Firewall service cannot connect to another proxy server

14058, 14059

Error

TMG Server

The Firewall service cannot initialize the firewall engine driver

14009

Error

TMG Server

The Firewall service cannot initialize WinSock

14002

Error

TMG Server

The Firewall service detected a demand dial interface connection that was not created by TMG Server

21162

Warning

TMG Server

The Firewall service detected a possible configuration error in a demand dial interface

21163

Warning

TMG Server

The Firewall service detected a possible dial up connection configuration error

21164

Warning

TMG Server

The Firewall service detected that an upstream proxy server is not available

14061

Warning

TMG Server

The Firewall service encountered an illegal operation runtime error R6025 in a pure virtual function

14055

Error

TMG Server

The Firewall service failed to load a security dynamic link library DLL

14015

Error

TMG Server

The Firewall service failed to open a listener for Firewall clients

14035

Warning

TMG Server

The Firewall service requires Windows Server 2000 Service Pack 4 or Windows Server 2003

14014

Error

TMG Server

The Firewall service stopped because an application filter module generated an exception code

14057

Error

TMG Server

The FTP filter failed to parse the allowed FTP commands

21172

Error

TMG Server

The Microsoft Firewall service could not start because it failed to connect to The TMG Server Control service

14070

Error

TMG Server

The Microsoft Firewall service encountered a failure

11003, 11001, 11010

Error

TMG Server

The Microsoft Firewall service encountered a system call failure

11005

Error

TMG Server

The Microsoft Firewall Service failed to initialize

14001

Error

TMG Server

The Microsoft Firewall service failed to start

11004, 11006, 11008

Error

TMG Server

The Microsoft Firewall service failed to start

11009, 11002, 11000

Error

TMG Server

The Microsoft Forefront TMG Control service encountered a failure

11003, 11010, 11001

Error

TMG Server

The Microsoft Forefront TMG Control service encountered a system call failure

11005

Error

TMG Server

The Microsoft Forefront TMG Control service failed to start

11009, 11002, 11000, 11004, 11006, 14077, 14192, 11008

Error

TMG Server

The Microsoft TMG Job Scheduler service could not start because it failed to connect to The TMG Server Control service

14070

Error

TMG Server

The monthly summaries could not be deleted

21018

Error

TMG Server

The non TCP connection limit for a specific IP address was exceeded

15113

Warning

TMG Server

The number of denied connections from a specific source IP address exceeded the configured limit

21284

Error

TMG Server

The number of denied TCP and non TCP packets per second exceeded the system limit

21282

Error

TMG Server

The number of pending DNS name resolution requests exceeds the system defined maximum

21279

Error

TMG Server

The number of TCP connections allowed from a specific source IP address exceeded the configured limit

15120

Warning

TMG Server

The number of TCP connections per minute from a specific source IP address exceeded the configured limit

15119

Warning

TMG Server

The percentage of threads used for pending DNS requests out of the total number of available threads is below the system defined maximum

21283

Information

TMG Server

The registry hive could not be loaded

21260

Error

TMG Server

The routing table for a network adapter includes IP address ranges that are not included in the array level network to which it is bound

21265

Error

TMG Server

The service could not start because it failed to load RADIUS related configuration

21091

Error

TMG Server

The size of the free non paged pool fell below the system defined minimum

21280

Error

TMG Server

The size of the free non paged pool is above the system defined minimum

21281

Information

TMG Server

The TMG Control service requires Windows Server 2000 with Service Pack 4 or Windows Server 2003

14025

Error

TMG Server

The TMG Control service was stopped

14037

Error

TMG Server

The TMG Firewall Service was stopped the evaluation period has expired

14032

Error

TMG Server

The TMG Server configuration agent was unable to upload the configuration to the TMG Server services

21209

Error

TMG Server

The TMG Server Control service configuration agent was unable to revert to last known configuration

21210

Error

TMG Server

The TMG Server Standard Edition cannot run because either the server is using more than 4 processors or it is configured to use the Active Directory service

14109

Error

TMG Server

TMG failed to load the firewall policy configuration

14020, 14018, 14019

Error

TMG Server

TMG Server detected a network adapter connected to multiple networks

21125

Error

TMG Server

TMG Server detected a network element containing an invalid address range

21096

Error

TMG Server

TMG Server detected network elements that contain overlapping address ranges

21097

Error

TMG Server

TMG Server detected routes through a network adapter that do not correlate with the network to which this adapter belongs

14147

Error

TMG Server

TMG Server detected that an IP address was removed from a network

21139

Information

TMG Server

TMG Server failed to activate the Firewall Engine

21094

Error

TMG Server

TMG Server failed to connect to the Configuration Storage server

21238

Warning

TMG Server

TMG Server has detected RADIUS servers with identical names in the RADIUS Server List storage

21102

Warning

TMG Server

TMG Server has encountered an error while loading the RADIUS Server List

21100, 21099

Error

TMG Server

TMG Server report or summary generation error

21152, 31031, 21028, 21153

Error

TMG Server

Two array networks include the same enterprise network

21222

Error

TMG Server

Unable to update local registry with changes made to the Central Storage

21212

Error

TMG Server

Unexpected error the service has stopped responding to all requests

14079

Error

TMG Server

Update Center Required Service Not Started

23513

Error

TMG Server

Updating of the computer name or FQDN failed

21124

Warning

TMG Server

Windows user based authentication is required for the applied policy

15118

Warning

TMG Server