Article ID: 820729 - View products that this article applies to.
Expand all | Collapse all

On This Page

Summary

This article describes the error-logging capabilities of HTTP APIs.

Some errors that occur in an HTTP-based application are automatically handled by the HTTP API instead of being passed back to an application for handling. This behavior occurs because the frequency of such errors might otherwise flood an event log or an application handler.

The following topics describe the different aspects of HTTP API error logging.

More information

Configure HTTP API error logging

To have us configure HTTP API error logging for you, go to the "Fix it for me" section. If you prefer to configure HTTP API error logging yourself, go to the "Let me fix it myself" section.

Fix it for me



To fix this problem automatically, click the Fix it button or link. In the File Download dialog box, click Run, and then follow the steps in the Fix it Wizard.

Disable HTTP API error logging
Microsoft Fix it 50635
Enable HTTP API error logging
Microsoft Fix it 50634


Notes
  • This wizard may be in English only. However, the automatic fix also works for other language versions of Windows.
  • If you are not on the computer that has the problem, save the Fix it solution to a flash drive or a CD, and then run it on the computer that has the problem.



Let me fix it myself

Three registry values under an HTTP \Parameters key control the HTTP API error logging. These keys are located at the following registry key:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\HTTP\Parameters
Note The location and the form of the configuration values may change in later versions of the Windows operating system.

You must have Administrator/Local System credentials to change the registry values, and to view or change the log files and the folder that contains them.

Configuration information in the registry values is read when the HTTP API driver starts. Therefore, if you change the settings, you must stop, and then restart the driver to read the new values. To do this, type the following console commands:
net stop http
net start http
The following naming convention is used to name the log files:
httperr + sequence number + .log
Example: httperr4.log
Log files are cycled when they reach the maximum size that the ErrorLogFileTruncateSize registry value specifies. This value cannot be less than one megabyte (MB).

If the configuration of error logging is not valid, or if any kind of failure occurs while the HTTP API is writing to the log files, the HTTP API uses event logging to notify administrators that error logging is not occurring.

The following table describes the registry configuration values.
Collapse this tableExpand this table
Registry valueDescription
EnableErrorLoggingA DWORD that you can set to TRUE to enable error logging or to FALSE to disable it. The default value is TRUE.
ErrorLogFileTruncateSizeA DWORD that specifies the maximum size of an error log file, in bytes. The default value is one MB (0x100000).

Note The specified value cannot be smaller than the default value.
ErrorLoggingDirA String that specifies the folder where the HTTP API puts its logging files.

The HTTP API creates a subfolder HTTPERR in the specified folder, and then stores the log files in the subfolder. This subfolder and the log files receive the same permission settings. The Administrator and Local System Accounts have full access. Other users do not have access.

The following is the default folder when the folder is not specified in the registry:
%SystemRoot%\System32\LogFiles

Note The ErrorLoggingDir string value must be a fully qualified local path. However, it can contain %SystemRoot%. A network drive or network share cannot be used.

Format of the HTTP API error logs

Generally, HTTP API error log files have the same format as W3C error logs, except that HTTP API error log files do not contain column headings. Each line of an HTTP API error log records one error. The fields appear in a specific order. A single space character (0x0020) separates each field from the previous field. In each field, plus signs (0x002B) replace space characters, tabs, and nonprintable control characters.

The following table identifies the fields and the order of the fields in an error log record.
Collapse this tableExpand this table
FieldDescription
DateThe Date field follows the W3C format. This field is based on Coordinated Universal Time (UTC). The Date field is always ten characters in the form of YYYY-MM-DD. For example, May 1, 2003 is expressed as 2003-05-01.
TimeThe Time field follows the W3C format. This field is based on UTC. The time field is always eight characters in the form of MM:HH:SS. For example, 5:30 PM (UTC) is expressed as 17:30:00.
Client IP AddressThe IP address of the affected client. The value in this field can be either an IPv4 address or an IPv6 address. If the client IP address is an IPv6 address, the ScopeId field is also included in the address.
Client PortThe port number for the affected client.
Server IP AddressThe IP address of the affected server. The value in this field can be either an IPv4 address or an IPv6 address. If the server IP address is an IPv6 address, the ScopeId field is also included in the address.
Server PortThe port number of the affected server.
Protocol VersionThe version of the protocol that is being used.

If the connection has not been parsed sufficiently to determine the protocol version, a hyphen (0x002D) is used as a placeholder for the empty field.

If either the major version number or the minor version number that is parsed is greater than or equal to 10, the version is logged as HTTP/?.?.
VerbThe verb state that the last request that is parsed passes. Unknown verbs are included, but any verb that is more than 255 bytes is truncated to this length. If a verb is not available, a hyphen (0x002D) is used as a placeholder for the empty field.
CookedURL + QueryThe URL and any query that is associated with it are logged as one field that is separated by a question mark (0x3F). This field is truncated at its length limit of 4,096 bytes.

If this URL was parsed ("cooked"), it is logged with local code page conversion and is treated as a Unicode field.

If this URL has not been parsed ("cooked") at the time of logging, it is copied exactly, without any Unicode conversion.

If the HTTP API cannot parse this URL, a hyphen (0x002D) is used as a placeholder for the empty field.
Protocol StatusThe protocol status cannot be greater than 999.

If the protocol status of the response to a request is available, it is logged in this field.

If the protocol status is not available, a hyphen (0x002D) is used as a placeholder for the empty field.
SiteIdNot used in this version of the HTTP API. A placeholder hyphen (0x002D) always appears in this field.
Reason PhraseThis field contains a string that identifies the kind of error that is being logged. This field is never left empty.
Queue NameThis the request queue name.
The following sample lines are from an HTTP API error log:
2002-07-05 18:45:09 172.31.77.6 2094 172.31.77.6 80 HTTP/1.1 GET /qos/1kbfile.txt 503 – ConnLimit 2002-07-05 19:51:59 127.0.0.1 2780 127.0.0.1 80 HTTP/1.1 GET /ThisIsMyUrl.htm 400 – Hostname 2002-07-05 19:53:00 127.0.0.1 2894 127.0.0.1 80 HTTP/2.0 GET / 505 - Version_N/S 2002-07-05 20:06:01 172.31.77.6 64388 127.0.0.1 80 - - - - - Timer_MinBytesPerSecond

Kinds of errors that the HTTP API logs

The HTTP API logs error responses to clients, connection time-outs, orphaned requests, and dropped connections that are handled incorrectly.

The following list identifies the kinds of errors that the HTTP API logs:
  • Responses to clients The HTTP API sends an error response to a client, for example, a 400 error that is caused by a parse error in the last received request. After the HTTP API sends the error response, it closes the connection.
  • Connection time-outs The HTTP API times out a connection. If a request is pending when the connection times out, the request is used to provide more information about the connection in the error log.
  • Orphaned requests A user-mode process stops unexpectedly while there are still queued requests that are routed to that process. The HTTP API logs the orphaned requests in the error log.
Specific error types are designated by Reason Phrase strings that always appear as the last field of each error line. The following table identifies the HTTP API Reason Phrases.
Collapse this tableExpand this table
Reason PhraseDescription

AppOfflineA service unavailable error occurred (an HTTP error 503). The service is not available because application errors caused the application to be taken offline.
AppPoolTimerA service unavailable error occurred (an HTTP error 503). The service is not available because the application pool process is too busy to handle the request.
AppShutdownA service unavailable error occurred (an HTTP error 503). The service is not available because the application shut down automatically in response to administrator policy.
BadRequestA parse error occurred while processing a request.
Client_ResetThe connection between the client and the server was closed before the request could be assigned to a worker process. The most common cause of this behavior is that the client prematurely closes its connection to the server.
Connection_Abandoned_By_AppPoolA worker process from the application pool has quit unexpectedly or orphaned a pending request by closing its handle.
Connection_Abandoned_By_ReqQueueA worker process from the application pool has quit unexpectedly or orphaned a pending request by closing its handle. Specific to Windows Vista and later versions and to Windows Server 2008 and later versions.
Connection_DroppedThe connection between the client and the server was closed before the server could send its final response packet. The most common cause of this behavior is that the client prematurely closes its connection to the server.
Connection_Dropped_List_FullThe list of dropped connections between clients and the server is full. Specific to Windows Vista and later versions and to Windows Server 2008 and later versions.
ConnLimitA service unavailable error occurred (an HTTP error 503). The service is not available because the site level connection limit has been reached or exceeded.
Connections_RefusedThe kernel NonPagedPool memory has dropped below 20MB and http.sys has stopped receiving new connections
DisabledA service unavailable error occurred (an HTTP error 503). The service is not available because an administrator has taken the application offline.
EntityTooLargeAn entity exceeded the maximum size that is permitted.
FieldLengthA field length limit was exceeded.
ForbiddenA forbidden element or sequence was encountered while parsing.
HeaderA parse error occurred in a header.
HostnameA parse error occurred while processing a Hostname.
InternalAn internal server error occurred (an HTTP error 500).
Invalid_CR/LFAn illegal carriage return or line feed occurred.
LengthRequiredA required length value was missing.
N/AA service unavailable error occurred (an HTTP error 503). The service is not available because an internal error (such as a memory allocation failure or URL Reservation List conflict) occurred.
N/IA not-implemented error occurred (an HTTP error 501), or a service unavailable error occurred (an HTTP error 503) because of an unknown transfer encoding.
NumberA parse error occurred while processing a number.
PreconditionA required precondition was missing.
QueueFullA service unavailable error occurred (an HTTP error 503). The service is not available because the application request queue is full.
RequestLengthA request length limit was exceeded.
Timer_AppPoolThe connection expired because a request waited too long in an application pool queue for a server application to de-queue and process it. This time-out duration is ConnectionTimeout. By default, this value is set to two minutes.
Timer_ConnectionIdleThe connection expired and remains idle. The default ConnectionTimeout duration is two minutes.
Timer_EntityBodyThe connection expired before the request entity body arrived. When a request clearly has an entity body, the HTTP API turns on the Timer_EntityBody timer. At first, the limit of this timer is set to the ConnectionTimeout value (typically, two minutes). Every time that another data indication is received on this request, the HTTP API resets the timer to give the connection two more minutes (or whatever is specified in ConnectionTimeout).
Timer_HeaderWaitThe connection expired because the header parsing for a request took more time than the default limit of two minutes.
Timer_MinBytesPerSecondThe connection expired because the client was not receiving a response at a reasonable speed. The response send rate was slower than the default of 240 bytes/sec. This can be controlled with the MinFileBytesPerSec metabase property.
Timer_ReqQueueThe connection expired because a request waited too long in an application pool queue for a server application to de-queue. This time-out duration is ConnectionTimeout. By default, this value is set to two minutes. Specific to Windows Vista and later versions and to Windows Server 2008 and later versions.
Timer_ResponseReserved. Currently not used.
Timer_SslRenegotiation The connection expired because SSL renegotiation between the client and server took longer than the default time-out of two minutes.
URLA parse error occurred while processing a URL.
URL_LengthA URL exceeded the maximum permitted size.
VerbA parse error occurred while processing a verb.
Version_N/SA version-not-supported error occurred (an HTTP error 505).

References

For more information about how to add additional logging fields for IIS HTTP error logging, click the following article number to view the article in the Microsoft Knowledge Base:
832975 Additional properties are now available for logging in the Httperr#.log file in IIS 6.0 and IIS 7.0

Properties

Article ID: 820729 - Last Review: February 12, 2013 - Revision: 18.0
Applies to
  • Windows Server 2012 Standard
  • Windows 8
  • Windows 8 Pro
  • Windows 8 Enterprise
  • Windows 7 Professional
  • Windows 7 Enterprise
  • Windows Server 2008 R2 Standard
  • Windows Server 2008 R2 Enterprise
  • Windows Server 2008 Enterprise
  • Windows Vista Enterprise
  • Windows Vista Ultimate
  • Microsoft Windows Server 2003, Standard Edition (32-bit x86)
  • Microsoft Windows Server 2003 R2 Enterprise Edition (32-Bit x86)
  • Microsoft Windows Server 2003 R2 Standard x64 Edition
  • Microsoft Windows Server 2003 R2 Enterprise x64 Edition
Keywords: 
kbhttphandlers kbhttp kbapi kberrmsg kbinfo kbfixme kbmsifixme KB820729

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com