Edit

Share via

Format of the HTTP Server API Error Logs

  • Article

In general, HTTP Server API error log files have the same format as W3C error logs except that HTTP Server API error log files do not contain column headings. Each line of an HTTP Server API error log records one error with fields in a specific order. Each field is separated from the preceding field by a single space character (0x0020). Within each field, space characters, tabs, and unprintable control characters are replaced by plus signs (0x002B).

The following table identifies the fields and the order of the fields in an error log record.

Field Description
Date
 The Date field follows the W3C format and is based on Coordinated Universal Time (UTC).The Date field is always 10 characters in the form of "YYYY-MM-DD". For example, May 1, 2003 is expressed as "2003-05-01".
Time
 The Time field follows the W3C format and is based on UTC. The time field is always 8 characters in the form of "MM:HH:SS". For example, 5:30 PM (UTC) is expressed as "17:30:00".
Client IP Address
 The IP address of the affected client that can be either an IPv4 address or an IPv6 address. If the client IP address is an IPv6 address, the ScopeId field is also included in the address.
Client Port
 The port number for the affected client.
Server IP Address
 The IP address of the affected server that can be either an IPv4 address or an IPv6 address. If the server IP address is an IPv6 address, the ScopeId field is also included in the address.
Server Port
 The port number of the affected server.
Protocol Version
 The version of the protocol that is being used.
  • If the connection has not been parsed enough to determine the protocol version, then a hyphen (0x002D) is used as a placeholder for the empty field.
  • If either the major or minor version number parsed is greater than or equal to 10, the version is logged as "HTTP/?.?".
Verb
 The verb state passed by the last request parsed. Unknown verbs are included, but any verb that is more than 255 bytes is truncated to this length. If a verb is not available, a hyphen (0x002D) is used as a placeholder for the empty field.
CookedURL + Query
 The URL and any query associated with it are logged as one field, separated by a question mark (0x3F). This field is truncated at its length limit of 4096 bytes.
  • If this URL has been parsed ("cooked"), it is logged with local code page conversion, and is treated as a Unicode field.
  • If this URL has not been parsed ("cooked") at the time of logging, it is copied exactly, without any Unicode conversion.
  • If the HTTP Server API cannot parse this URL, a hyphen (0x002D) is used as a placeholder for the empty field.
Protocol Status
 The protocol status cannot exceed 999.
  • If the protocol status of the response to a request is available, it is logged in this field.
  • If the protocol status is not available, a hyphen (0x002D) is used as a placeholder for the empty field.
SiteId
 Not used in this version of the HTTP Server API. A placeholder hyphen (0x002D) always appears in this field.
Reason Phrase
 This field contains a string that identifies the kind of error that is being logged. It is never left empty.

The following sample lines are from an HTTP Server API error log:

2002-07-05 18:45:09 172.31.77.6 2094 172.31.77.6 80 
                    HTTP/1.1 GET /qos/1kbfile.txt 503 - ConnLimit
2002-07-05 19:51:59 127.0.0.1 2780 127.0.0.1 80 
                    HTTP/1.1 GET /ThisIsMyUrl.htm 400 - Hostname
2002-07-05 19:53:00 127.0.0.1 2894 127.0.0.1 80 
                    HTTP/2.0 GET / 505 - Version_N/S
2002-07-05 20:06:01 172.31.77.6 64388 127.0.0.1 80 
                    - - - - - Timer_MinBytesPerSecond