Result code log values
The Web Proxy and Firewall logs can include a Result Code field that specifies the status of the request. It may be a Windows (Win32) error code (for values less than 100), an HTTP status code (for values between 100 and 1,000), a Winsock error code (for values between 10,004 and 11,031), or a Microsoft Forefront Threat Management Gateway error code.
Web Proxy: result code log values
For the Web Proxy log, the HTTP Status Code column represents an HTTP error (from the Web proxy). This error can return one of the following values:
- An HTTP response code, as defined in the HTTP RFC. For a list of HTTP response codes, see the Platform SDK.
- A Winsock error code. For a list of Winsock error codes, see MSDN.
- A Forefront TMG Web Proxy error code. These errors also include a description.
The following table summarizes some of the result code values.
| Source values | Description |
|---|---|
0 |
The operation completed successfully. |
200 |
OK. |
201 |
Created. |
202 |
Accepted. |
204 |
No content. |
301 |
Moved permanently. |
302 |
Moved temporarily. |
304 |
Not modified. |
400 |
Bad request. |
401 |
Unauthorized. |
403 |
Forbidden. |
404 |
Not found. |
500 |
Server error. |
501 |
Not implemented. |
502 |
Bad gateway. |
503 |
Out of resources. |
995 |
Operation aborted. |
10060 |
A connection timed out. |
10061 |
A connection was refused by the destination host. |
10065 |
No route to host. |
11001 |
Host not found. |
12217 |
The request was rejected by HTTP filter. |
Firewall: Result Code Log Values
In the Firewall log, the result code field represents an error. It can be one of the following:
- A Windows-based HRESULT error code.
- A Forefront TMG service error code. These errors typically begin with 0xC00. Error text typically includes FWX_E_.
The following table summarizes run-time error codes, defined in Wspfwerr.h, which may be returned by the Microsoft Firewall service and may appear as result codes in Forefront TMG logs.
| Symbolic name | Code | Message text |
|---|---|---|
FWX_E_TERMINATING |
0xC0040001 |
The object is shutting down. |
FWX_E_INVALID_ARG |
0xC0040002 |
The argument is invalid. |
FWX_E_ALREADY_IN_BLOCKING_OP |
0xC0040003 |
The blocking operation is already started. |
FWX_E_NOT_IN_BLOCKING_OP |
0xC0040004 |
There is no blocking operation to be ended. |
FWX_E_FILTER_NOT_REGISTERED |
0xC0040005 |
The filter is not registered. |
FWX_E_ALREADY_EXISTS |
0x800700B7 |
The object cannot be created because an object with the same name already exists. |
FWX_E_BUFFERFULL |
0xC0040007 |
Not all the data was appended to the buffer object because the buffer was full. |
FWX_E_ALREADY_EMULATED |
0xC0040009 |
The connection is already emulated by another filter. |
FWX_E_BAD_CONTEXT |
0xC004000A |
The method was not called while handling any of the supported events. |
FWX_E_NOT_SUPPORTED |
0xC004000B |
Modifying this property is not allowed for this session. |
FWX_E_NOT_AUTHENTICATED |
0xC004000C |
The action cannot be performed because the session is not authenticated. |
FWX_E_POLICY_RULES_DENIED |
0xC004000D |
The policy rules do not allow the user request. |
FWX_E_MIME_NEEDED |
0xC004000E |
The MIME type is required. |
FWX_E_MUST_USE_DS |
0xC004000F |
- |
FWX_E_NOT_EMULATED |
0xC0040010 |
The connection is not emulated. |
FWX_E_IS_BUSY |
0xC0040011 |
- |
FWX_E_NETWORK_RULES_DENIED |
0xC0040012 |
- |
FWX_E_FRAGMENT_PACKET_DROPPED |
0xC0040013 |
- |
FWX_E_FWE_SPOOFING_PACKET_DROPPED |
0xC0040014 |
- |
FWX_E_TCPIPDROP_PACKET_DROPPED |
0xC0040015 |
- |
FWX_E_NO_BACKLOG_PACKET_DROPPED |
0xC0040016 |
- |
FWX_E_TCP_NOT_SYN_PACKET_DROPPED |
0xC0040017 |
A non-SYN packet was dropped because it was sent by a source that does not have an established connection with the Forefront TMG computer. |
FWX_E_BAD_LENGTH_PACKET_DROPPED |
0xC0040018 |
- |
FWX_E_PING_OF_DEATH_PACKET_DROPPED |
0xC0040019 |
- |
FWX_E_OUT_OF_BAND_PACKET_DROPPED |
0xC004001A |
- |
FWX_E_IP_HALF_SCAN_PACKET_DROPPED |
0xC004001B |
- |
FWX_E_LAND_ATTACK_DROPPED |
0xC004001C |
- |
FWX_E_UDP_BOMB_DROPPED |
0xC004001D |
- |
FWX_E_FULLDENY_DROPPED |
0xC004001E |
- |
FWX_E_IPOPTIONS_DROPPED |
0xC004001F |
- |
FWX_E_UNCOMPLETED_CONNECTION_REQUEST |
0xC0040020 |
An attempt to log on to the VPN server was rejected during the authentication phase because the authentication data was not received in a timely manner. The client session was disconnected. |
FWX_E_CONNECTION_REQUEST_REJECTED |
0xC0040021 |
An attempt to log on to the VPN server was rejected during the authentication phase. The client session was disconnected. |
FWX_E_VALIDATE_QUARANTINE_FAILED |
0xC0040022 |
The VPN quarantine settings could not be validated. The client session was disconnected. |
FWX_E_VPN_CONNECTIONS_LIMIT_EXCEEDED |
0xC0040023 |
The VPN client connection limit was exceeded. The client session was disconnected. |
FWX_E_OUT_OF_RESOURCES |
0xC0040024 |
- |
FWX_E_BROADCAST_PACKET_DROPPED |
0xC0040025 |
- |
FWX_E_UNKNOWN_ADAPTER_DROPPED |
0xC0040026 |
- |
FWX_E_ICMP_ERROR_PACKET_DROPPED |
0xC0040027 |
- |
FWX_E_INVALID_PROTOCOL_PACKET_DROPPED |
0xC0040028 |
- |
FWX_E_PORT_ZERO_PACKET_DROPPED |
0xC0040029 |
- |
FWX_E_SYN_ATTACK_START |
0xC004002A |
Forefront TMG detected a SYN attack. |
FWX_E_SYN_ATTACK_END |
0xC004002B |
Forefront TMG is no longer experiencing a SYN attack. |
FWX_E_INVALID_DHCP_OFFER |
0xC004002C |
- |
FWX_E_UNREACHABLE_ADDRESS |
0xC004002D |
- |
FWX_E_ADDRESS_NOT_ALLOWED |
0xC004002E |
- |
FWX_E_IPSEC_NO_ROUTE_DROPPED |
0xC004002F |
- |
FWX_E_OUTBOUND_PATH_THROUGH_DROPPED |
0xC0040030 |
- |
FWX_E_BAD_TCP_CHECKSUM_DROPPED |
0xC0040031 |
- |
FWX_E_VPN_USER_MAPPING_FAILED |
0xC0040032 |
An attempt to map a VPN client to a Windows user failed. The client session was disconnected. |
FWX_E_RULE_QUOTA_EXCEEDED_DROPPED |
0xC0040033 |
A connection was rejected because the maximum number of connections that can be created for a rule during one second was exceeded. |
FWX_E_SEQ_ACK_MISMATCH |
0xC0040034 |
A TCP packet was rejected because it has an invalid sequence number or an invalid acknowledgement number. |
WSA_RWS_GRACEFUL_SHUTDOWN or FWX_E_GRACEFUL_SHUTDOWN |
0x80074E20 |
A connection was gracefully closed in an orderly shutdown process with a three-way FIN-initiated handshake. |
WSA_RWS_ABORTIVE_SHUTDOWN or FWX_E_ABORTIVE_SHUTDOWN |
0x80074E21 |
A connection was abortively closed after one of the peers sent a RST segment. |
WSA_RWS_QUOTA or FWX_E_RULE_QUOTA_EXCEEDED_DROPPED |
0x80074E23 |
A connection was refused because a quota set in a rule was exceeded. |
WSA_RWS_CONNECTION_KILLED or FWX_E_CONNECTION_KILLED |
0x80074E24 |
Forefront TMG killed a connection. |
WSA_RWS_TIMEOUT or FWX_E_TIMEOUT |
0x80074E25 |
A connection was terminated because it was idle for more than the time-out period, or the time-out on an incomplete action expired. |
WSA_RWS_ADMIN_TERMINATE or FWX_E_ADMIN_TERMINATE |
0x80074E26 |
A connection was terminated from Forefront TMG Management during shutdown, or when a VPN client was disconnected. |
FWX_E_THREAD_QUOTA_EXCEEDED |
0xC0040035 |
A blocking operation could not be performed because the thread limit for this operation was reached. |
FWX_E_DNS_QUOTA_EXCEEDED |
0xC0040036 |
A DNS query could not be performed because the query limit was reached. |
FWX_E_TCP_RATE_QUOTA_EXCEEDED_DROPPED |
0xC0040037 |
A connection was rejected because the maximum connections rate for a single client host was exceeded. |
FWX_E_TCP_NO_SERVER_REPLY |
0xC0040038 |
A connection was closed because no SYN/ACK reply was received from the server. |