Export (0) Print
Expand All

Log File Format for HTTP.sys Error Logging

Updated: August 22, 2005

Applies To: Windows Server 2003, Windows Server 2003 with SP1

HTTP.sys error log files contain a fixed set of fields. Table 10.8 lists the fields that are recorded in HTTP.sys error logging log files and describes them.

Table 10.8 HTTP.sys Error Logging Fields

Field Description

Date

The date, in UTC time. This entry is always 10 characters long, for example, 2000-01-31.

Time

The time, in UTC time. This entry is always eight characters long, for example, 00:12:23.

Client IP

The IP address of the client. The version of the IP address can be either IPv4 or IPv6. If it is IPv6, the Scope ID field also appears.

Client Port

The port number of the client.

Server IP

The IP address of the server. The server IP address can be either IPv4 or IPv6. If it is IPv6, the Scope ID field also appears.

Server Port

The port number of the server.

Protocol version

The protocol version, if the last request on the connection has been parsed enough to identify the protocol version. If either the major or the minor version is greater than or equal to 10, the driver records the version as HTTP/?.?.

Verb

The verb, if the last request that was parsed passed the verb state. Unknown verbs are also recorded. HTTP.sys enforces a length limit of 255 bytes for the verb; anything longer is truncated.

CookedURL and query

The URL and its query, if both exist. A question mark (?) separates the URL from the query. If the URL of the request is completely processed (also known as cooked), then the processed URL is recorded with a local code page conversion and is treated as a Unicode field.

If only the unprocessed (raw) URL was present at the time of logging, then it is recorded as is, without a local code page conversion. HTTP.sys enforces a length limit of 4096 bytes for the URL; anything longer is truncated.

Protocol status

The protocol status of the response for the request, if it is available. The value cannot be greater than 999.

Site ID

The site ID, as a numeric value. For example, instead of recording W3SVC1, the field contains 1. There is no maximum value for the site ID. (This value can be as large as a MAX_ULONG.)

Reason phrase

Detailed information about why the error occurred, depending on the error type. This field can never be empty. For more information about reason phrases, see HTTP.sys Reason Phrases later in this section.

For fields for which information is unavailable, a hyphen (-) appears as a placeholder. Fields are separated by spaces. If a field contains a nonprintable character, HTTP.sys replaces it with a plus sign (+) to preserve the log file format.

Was this page helpful?
(1500 characters remaining)
Thank you for your feedback

Community Additions

ADD
Show:
© 2014 Microsoft