HTTP.sys Error Log Files

Applies To: Windows Server 2003, Windows Server 2003 with SP1

For the W3C Extended, IIS, and NCSA Common log file formats and for centralized binary logging, the log data is generated from the worker processes, passed to HTTP.sys through APIs, and then recorded in log files. However, because of the separation of the HTTP protocol stack in kernel mode and the worker processes in user mode, HTTP.sys-initiated error responses are not recognized by the user mode and are, therefore, not passed back to HTTP.sys for logging. To record these error responses, HTTP.sys needs its own error logging scheme that comes directly from the kernel mode. This is accomplished with HTTP.sys error logging. By default, HTTP.sys error logging is turned on.

Common HTTP.sys Error Log File Entries

There are a number of cases where HTTP.sys will generate its own errors. For example, when HTTP.sys sends an error response back to a client and a site is not yet associated with the request, an error is recorded in the HTTP.sys error log files. This error usually happens when there is a parse error in the request that was last received on the connection and HTTP.sys disconnects the connection after sending the response.

Another example of an HTTP.sys-generated error is a connection time-out. If a time-out occurs during a request, the request is recorded in the HTTP.sys error log file to provide more information about the connection.

Also, if a worker process in user mode unexpectedly terminates or closes its application pool handle while there are still outstanding requests that were queued and routed to this worker process, the outstanding requests are recorded in the HTTP.sys error log files. In this case, you can use the site ID field entry to identify the problematic site.

HTTP.sys error log files will sometimes contain connection errors that occur when IIS does not immediately destroy connections that the client terminates before a response for the last request on these connections is complete. HTTP.sys cannot resolve these connections (also known as zombie connections) until IIS completes its send or passes the last send call containing the logging information. Typically, unresolved connections are recorded in normal IIS log files. However, if IIS never sends the logging information back to HTTP.sys, unresolved connections are dropped after 30 seconds to one minute. HTTP.sys records these dropped connections in the HTTP.sys error log file to alert the administrator to their presence.