Error Logging in HTTP API

INFO: Error Logging in HTTP API

Article ID	:	820729
Last Review	:	October 9, 2003
Revision	:	1.0

On this Page

	SUMMARY
	MORE INFORMATION

SUMMARYThis article describes the error logging capabilities of Hypertext Transfer Protocol (HTTP) APIs.

Some errors that occur in an HTTP-based application are automatically handled by the http api instead of being passed back to an application for handling. this behavior occurs because the frequency of such errors might otherwise flood an event log or an application handler.

The following topics describe the different aspects of http api error logging:

•	Configure http api Error Logging Registry settings control the http api logs errors, the maximum permitted size of log files, and the location of the log files.
•	Format of the http api Error Logs The http api creates log files that comply with the World Wide Web consortings (W3C) log file conventions. you can use standard tools to parse these log files. however, unlike W3C log files, http api log files do not contain in the columns names.
•	Types of Errors That the http api Logs The http api logs a variety of common errors.

MORE ionionconfigure http api Error Logging

Three registry values underHTTP/ParametersKey control the http api error logging. These keys are located at the following registry key:

HKEY_LOCAL_MACHINE/System/CurrentControlSet/Services/HTTP/Parameters

NoteThe location and the form of the configuration values may change in later versions of the Microsoft Windows operating system.

You must have Administrator/Local System credentials to change the registry values, and to view or modify the log files and the folder that contains them.

Configuration information in the registry values is read when the http api driver starts. therefore, if you change the settings, you must stop, and then restart the driver to read the new values. to do this, type the following console commands:

Net stop httpnet start http

The following naming convention is used to name the log files:

Httperr +Sequence number+. Log
Example: Httperr4.log

Log files are cycled when they reach the maximum size thatErrorLogFileTruncateSizeRegistry value specifies. This value cannot be less than one megabyte (MB ).

If the configuration of error logging is not valid, or if any type of failure occurs while the http api is writing to the log files, the http api uses event logging to policy administrators that error logging is not occurring.

The following table describes the registry configuration values:

Registry Value	Description
EnableErrorLogging	ADWORDThat you can set to TRUE to enable error logging or to FALSE to disable it. The default value is TRUE.
ErrorLogFileTruncateSize	ADWORDThat specifies the maximum size of an error log file, in bytes. The default value is one MB (0x100000 ). NoteThe specified value cannot be smaller than the default value.
ErrorLoggingDir	AStringThat specifies the folder where the http api puts its logging files. The http api creates a subfolderHTTPERRIn the specified folder, and then stores the log files in the subfolder. this subfolder and the log files receive the same permission settings. the Administrator and local system accounts have full access. other users do not have access. The following is the default folder when the folder is not specified in the registry: % SystemRoot %/system32/logfiles NoteTheErrorLoggingDirString value must be a fully qualified path. However, it can contain % SystemRoot %.

Back to the top

Format of the http api Error Logs

Generally, http api error log files have the same format as W3C error logs, doesn t that http api error log files do not contain column headings. each line of an http api error log records one error. the fields appear in a specific order. A single space character (0x0020) separates each field from the previous field. in each field, plus signs (0x002b) Replace space characters, tabs, and nonprintable control characters.

The following table identifies the fields and the order of the fields in an error log record:

Field	Description
Date	The Date field follows the W3C format. this field is based on Coordinated Universal Time (UTC ). the Date field is always ten characters in the form of YYYY-MM-DD. for example, May 1, 2003 is expressed as 2003-05-01.
Time	The Time field follows the W3C format. this field is based on UTC. the time field is always eight characters in the form of MM: HH: SS. for example, 17:30:00 PM (UTC) is expressed.
Client IP Address	The IP address of the affected client. the value in this field can be either an IPv4 address or an IPv6 address. if the client IP address is an IPv6 address, the ScopeId field is also encoded in the address.
Client Port	The port number for the affected client.
Server IP Address	The IP address of the affected server. the value in this field can be either an IPv4 address or an IPv6 address. if the server IP address is an IPv6 address, the ScopeId field is also encoded in the address.
Server Port	The port number of the affected server.
Protocol Version	The version of the protocol that is being used. If the connection has not been parsed sufficiently to determine the Protocol version, a hyphen (0x002d) is used as a placeholder for the empty field. If either the major version number or the minor version number that is parsed is greater than or equal to 10, the version is logged as HTTP /?.?.
Verb	The verb state that the last request that is parsed passes. unknown verbs are encoded, but any verb that is more than 255 bytes is truncated to this length. if a verb is not available, a hyphen (0x002D) is used as a placeholder for the empty field.
CookedURL + Query	The URL and any query that is associated with it are logged as one field that is separated by a question mark (0x3F). This field is truncated at its length limit of 4096 bytes. If this URL has been parsed ("cooked"), it is logged with local code page conversion, and is treated as a Unicode field. If this URL has not been parsed ("cooked") at the time of logging, it is copied exactly, without any Unicode conversion. If the http api cannot parse this URL, a hyphen (0x002D) is used as a placeholder for the empty field.
Protocol Status	The Protocol status cannot be greater than 999. If the protocol status of the response to a request is available, it is logged in this field. If the protocol status is not available, a hyphen (0x002D) is used as a placeholder for the empty field.
Siteid	Not used in this version of the http api. A placeholder hyphen (0x002d) always appears in this field.
Reason phrase	This field contains a string that identifies the type of error that is being logged. This field is never left empty.
Queue name	This the Request queue name.

The following sample lines are from an http api Error Log:

18:45:09 listen 2094 limit 80 HTTP/1.1 GET/qos/1kbfile.txt 503-ConnLimit 2002-07-05 19:51:59 127.0.0.1 2780 127.0.0.1 80 HTTP/1.1 GET/secrets 400-Hostname 2002-07-05 19:53:00 127.0.0.1 2894 127.0.0.1 80 HTTP/ 2.0 GET/505-Version_N/S 20:06:01 172.31.77.6 64388 127.0.0.1 80---Timer_MinBytesPerSecond

Back to the top

Types of Errors That the http api Logs

The http api logs error responses to clients, connection time-outs, orphaned requests, and dropped connections that are handled incorrectly.

The following list identifies the types of errors that the http api logs:

•	Responses to clientsThe http api sends an error response to a client, for example, a 400 error that is caused by a parse error in the last received ed request. after the http api sends the error response, it terminates the connection.
•	Connection time-outsThe http api times out a connection. If a request is pending when the connection times out, the request is used to provide more information about the connection in the error log.
•	Orphaned requestsA user-mode process quits unexpectedly while there are still queued requests that are routed to that process. The http api logs the orphaned requests in the error log.

Specific error types are designatedReason PhraseStrings that always appear as the last field of each error line. The following table identifies the http api Reason Phrases:

Reason Phrase	Description
AppOffline	A service unavailable error occurred (an HTTP error 503). The service is not available because application errors caused the application to be taken offline.
AppPoolTimer	A service unavailable error occurred (an HTTP error 503). The service is not available because the application pool process is too busy to handle the request.
AppShutdown	A service unavailable error occurred (an HTTP error 503). The service is not available because the application shut down automatically in response to administrator policy.
BadRequest	A parse error occurred while processing a request.
Connection_Abandoned_By_AppPool	A worker process from the application pool that quit unexpectedly or orphaned a pending request by closing its handle.
Connection_Dropped	Reserved. Not currently used.
ConnLimit	A service unavailable error occurred (an HTTP error 503). The service is not available because the site level connection limit has been reached or exceeded.
Disabled	A service unavailable error occurred (an HTTP error 503). The service is not available because an administrator has taken the application offline.
EntityTooLarge	An entity exceeded the maximum size that is permitted.
FieldLength	A field length limit was exceeded.
Forbidden	A forbidden element or sequence was encountered while parsing.
Header	A parse error occurred in a header.
Hostname	A parse error occurred while processing a hostname.
Internal	An internal server error occurred (an HTTP Error 500 ).
Invalid_cr/LF	An illegal carriage return or line feed occurred.
Lengthrequired	A required length value was missing.
N/	A service unavailable error occurred (an HTTP Error 503). The service is not available because an internal error (such as a memory allocation failure) occurred.
N/I	A not-implemented error occurred (an HTTP Error 501), or a service unavailable error occurred (an HTTP Error 503) because of an unknown transfer encoding.
Number	A parse error occurred while processing a number.
Precondition	A required precondition was missing.
Queuefull	A service unavailable error occurred (an HTTP Error 503). The service is not available because the application request queue is full.
Requestlength	A request length limit was exceeded.
Timer_apppool	The connection expired because a request waited too long in an application pool queue for a server application to dequeue and process it. This timeout duration isConnectionTimeout. By default, this value is set to two minutes.
Timer_connectionidle	The connection expired and remains idle. The defaultConnectionTimeoutDuration is two minutes.
Timer_entitybody	The connection expired before the Request Entity body arrived. When it is clear that a request has an entity body, the http api turns onTimer_EntityBodyTimer. Initially, the limit of this timer is set toConnectionTimeoutValue (typically 2 minutes). Each time another data indication is stored on this request, the http api resets the timer to give the connection two more minutes (or whatever is specified inConnectionTimeout).
Timer_HeaderWait	The connection expired because the header parsing for a request took more time than the default limit of two minutes.
Timer_MinBytesPerSecond	The connection expired because the client was not processing a response at a reasonable speed. The response send rate was slower than the default of 150 bytes/sec.
Timer_Response	Reserved. Not currently used.
URL	A parse error occurred while processing a URL.
URL_Length	A url exceeded the maximum permitted size.
Verb	A parse error occurred while processing a verb.
Version_N/S	A version-not-supported error occurred (an HTTP error 505 ).

Back to the top

APPLIES

•	Microsoft Windows Server 2003, Datacenter Edition
•	Microsoft Windows Server 2003, Enterprise Edition
•	Microsoft Windows Server 2003, Standard Edition
•	Microsoft Windows Server 2003, Web Edition
•	Microsoft Windows Small Business Server 2003 Premium Edition
•	Microsoft Windows Small Business Server 2003 Standard Edition

Top of Page

Keywords:

Kberrmsg kbinfo kbhttp kbapi kbhttphandlers KB820729