In my environment, I am having two ISA Servers. I have hosted my Exchange in one of the ISA Server. Running ISA 2006. Now a days intermittently the Firewall Service of ISA 2006 in which Exchange is hosted is stopping automatically there by causing service interruption. On preliminary analysis I found out that it happened because of Logging failure resulting in Graceful Stopping if fsrw service. Below is a jist of logs taken from the server when the service was stopped.

*************************************************************************************************
Event Type: Warning
Event Source: Microsoft ISA Server Web Proxy
Event Category: None
Event ID: 23501
Date: 1/31/2014
Time: 5:18:06 PM
User: N/A
Computer: FEDPXY01
Description:
Writing to the log took approximately 20 seconds. If this time exceeds 30 seconds, logging may fail and ISA Server may go into lockdown mode. For more information, see Microsoft article 919468, at the ISA Server Help and Support site (http://support.microsoft.com/ph/2108/).
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
**************************************************************************************************
Event Type: Information
Event Source: Microsoft Firewall
Event Category: None
Event ID: 21186
Date: 1/31/2014
Time: 5:18:33 PM
User: N/A
Computer: FEDPXY01
Description:
The total Web Proxy log size reached the maximum allowed size. To maintain the size limit, older log files will be deleted as new log files are added.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
*************************************************************************************************
Event Type: Warning
Event Source: Microsoft ISA Server Web Proxy
Event Category: None
Event ID: 23501
Date: 1/31/2014
Time: 5:31:33 PM
User: N/A
Computer: FEDPXY01
Description:
Writing to the log took approximately 20 seconds. If this time exceeds 30 seconds, logging may fail and ISA Server may go into lockdown mode. For more information, see Microsoft article 919468, at the ISA Server Help and Support site (http://support.microsoft.com/ph/2108/).
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
*************************************************************************************************
Event Type: Error
Event Source: Microsoft ISA Server Web Proxy
Event Category: Log
Event ID: 8
Date: 1/31/2014
Time: 5:31:53 PM
User: N/A
Computer: FEDPXY01
Description:
The ISA Server Web filter failed to log information to MSDE Database ISALOG_20140131_WEB_024 in path E:\ISA2006\ISALogs. The MSDE Error description is: Not enough storage is available to complete this operation.
. The problem may be resolved by restarting the MSSQL$MSFW service.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 0e 00 07 80               ...?    
*************************************************************************************************
Event Type: Error
Event Source: Microsoft ISA Server Web Proxy
Event Category: Log
Event ID: 8
Date: 1/31/2014
Time: 5:31:53 PM
User: N/A
Computer: FEDPXY01
Description:
The ISA Server Web filter failed to log information to MSDE Database ISALOG_20140131_WEB_024 in path E:\ISA2006\ISALogs. The MSDE Error description is: Not enough storage is available to complete this operation.
. The problem may be resolved by restarting the MSSQL$MSFW service.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 8007000e 
*************************************************************************************************
Event Type: Information
Event Source: Microsoft Firewall
Event Category: None
Event ID: 14182
Date: 1/31/2014
Time: 5:31:54 PM
User: N/A
Computer: FEDPXY01
Description:
The Firewall service was stopped gracefully.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
*************************************************************************************************

We are using MSDE for event logging. Usually new databases are created when the current log size goes above 1.5 GB. but this is not happening always there by resulting in service stopping. Can someone help me with a solution for this. This is now eating my head up because mail service is hampered because of this.

Thanks in Advance.

Regards,

As the events say, verify that you have enough disk space on the partition you log to. If not, take action so that you have enough space to fit the logs you need. It will take time to dismount an old database and delete it which in turn will result in the risk of ending up in lockdown mode.

If ISA cannot write to the log, the result i lockdown mode and ISA will not allow any traffic.