Website IIS Log Interpretation

When a user attempts to access content on a server running Internet Information Service (IIS) through HTTP or file transfer protocol (FTP, IIS returns a digital code indicating the Request status. This status code is recorded in IIS logs and may also be displayed in a Web browser or an FTP client. The status code can indicate whether the request is successful or not, and reveal the exact cause of the Request failure.

By default, IIS stores its log files in the % Windows \ System32 \ Logfiles folder. Each WWW site and FTP site have a separate directory under this directory. By default, log files are created in these directories every day and named by date (for example, exYYMMDD. log ).
HTTP
1xx-Information prompt

These status codes indicate temporary responses. Before receiving a regular response, the client should be prepared to receive one or more 1xx responses. • 100-continue.
• 101-switch protocol.
2xx-success

This type of Status Code indicates that the server successfully accepts client requests. • 200-OK. The client request is successful.
• 201-created.
• 202-accepted.
• 203-non-authoritative information.
• 204-NO content.
• 205-Reset content.
• Part 1: content.
3xx-redirection

The client browser must perform more operations to implement the request. For example, the browser may have to request different pages on the server or repeat the request through the proxy server. • 302-the object has been moved.
• 304-not modified.
• 307-temporary redirection.
4xx-client Error

The client seems to be faulty when an error occurs. For example, the client does not provide valid authentication information for a page that does not exist in a request. • 400-Incorrect request.
• 401-Access denied. IIS defines many different 401 errors, which indicate more specific error causes. These specific error codes are displayed in the browser but not in the IIS log: • 401.1-Logon Failed.
• 401.2-login failed due to server configuration.
• 401.3-the ACL is not authorized due to resource restrictions.
• 401.4-filter authorization failed.
• 401.5-An error occurred while authorizing the ISAPI/CGI application.
• 401.7-the access is rejected by the URL Authorization Policy on the Web server. This error code is dedicated to IIS 6.0.

• 403-forbidden access: IIS defines many different 403 errors, which indicate a more specific cause of the error: • 403.1-the execution access is forbidden.
• 403.2-Read access is forbidden.
• 403.3-write access is forbidden.
• 403.4-requires SSL.
• 403.5-requires SSL 128.
• 403.6-the IP address is rejected.
• 403.7-client certificate required.
• 403.8-site access is denied.
• 403.9-too many users.
• 403.10-the configuration is invalid.
• 403.11-password change.
• 403.12-access to the ing table is denied.
• 403.13-client certificate revoked.
• 403.14-reject the directory list.
• 403.15-exceeds the client access permission.
• 403.16-the client certificate is untrusted or invalid.
• 403.17-the client certificate has expired or has not yet taken effect.
• 403.18-the requested URL cannot be executed in the current application pool. This error code is dedicated to IIS 6.0.
• 403.19-CGI cannot be executed for clients in this application pool. This error code is dedicated to IIS 6.0.
• 403.20-Passport Logon Failed. This error code is dedicated to IIS 6.0.

• 404-not found. • 404.0-(none)-No file or directory found.
• 404.1-unable to access the Web site on the requested port.
• 404.2-the Web service extended locking policy blocks this request.
• The 404.3-MIME ing policy blocks this request.

• 405-HTTP predicates used to access this page are not allowed (methods are not allowed)
• 406-the client browser does not accept the MIME type of the requested page.
• 407-proxy authentication is required.
224389 error message: HTTP errors 403, 403.4, 403.5 Prohibit Access: require SSL
• 403.6-the IP address is rejected. You have configured your server to deny access to your current IP address. For more information about how to solve this problem, click the following article number to view the article in the Microsoft Knowledge Base:
248043 error message: 403.6-Forbidden: IP Address Rejected (403.6-unavailable: IP Address denied)
• 403.7-client certificate required. You have configured your server as a client authentication certificate, but you have not installed a valid client certificate. For other information, click the following article number to view the article in the Microsoft Knowledge Base:
190004 error 403.7 or "Connection to Server cocould Not Be Established" (Connection to Server cannot Be Established)
186812 PRB: error message: 403.7 Forbidden: Client Certificate Required (403.7 Access prohibited: Client Certificate Required)
• 403.8-site access is denied. You have set domain name restrictions for the domain you use to access the server. For more information about how to solve this problem, click the following article number to view the article in the Microsoft Knowledge Base:
248032 error message: Forbidden: Site Access Denied 403.8 (Forbidden Access: Site Access Denied 403.8)
• 403.9-too many users. The number of users connected to the server exceeds the connection limit you set. For more information about how to change this restriction, click the following article number to view the article in the Microsoft Knowledge Base:
248074 error message: Access Forbidden: Too already Users Are Connected 403.9 (Forbidden Access: Too Many Connected Users: 403.9)
Note: Microsoft Windows 2000 Professional and Microsoft Windows XP Professional automatically set a maximum of 10 connections on IIS. You cannot change this restriction.
• 403.12-access to the ing table is denied. The client certificate is required for the page to be accessed, but the user ID mapped to your client certificate has been denied access to the file. For other information, click the following article number to view the article in the Microsoft Knowledge Base:
248075 error message: HTTP 403.12-Access Forbidden: Mapper Denied Access (HTTP 403.12-Access prohibited: ing Table Access Denied)
• 404-not found. This error occurs because the file you are trying to access has been removed or deleted. This error also occurs if you attempt to access a file with a limited extension after installing the URLScan tool. In this case, "Rejected by URLScan" appears in the log file of the request.
• 500-internal server error. Many server errors may cause this error message. The Event Viewer log contains more detailed error causes. In addition, you can disable the friendly HTTP Error message to receive detailed error descriptions. For more information about how to disable HTTP-friendly error messages, click the following article number to view the article in the Microsoft Knowledge Base:
294807 how to disable the "show friendly HTTP Error messages" function of Internet Explorer 5 on the server side
• 500.12-the application is restarting. This indicates that you attempt to load ASP pages When IIS restarts the application. After the page is refreshed, this information disappears. If this information appears again after the page is refreshed, it may be that the anti-virus software is scanning the Global. asa file. For other information, click the following article number to view the article in the Microsoft Knowledge Base:
248013 Error message: HTTP Error 500-12 Application Restarting (HTTP Error 500-12 Application Restarting)
• 500-100.ASP-ASP error. If the ASP page to be loaded contains the error code, this error message is displayed. To obtain more accurate error information, disable the friendly HTTP error message. By default, this error message is only enabled on the default Web site. For more information about how to view this error message on a non-default Web site, click the following article number to view the article in the Microsoft Knowledge Base:
261200: HTTP 500 error message is displayed, but ASP error message of 500-100.asp is not displayed.
• 502-Gateway error. This error message is returned if the CGI script to be run does not return a valid HTTP header set.