Example: If you try to access a web page that doesn’t exist, browser displays 404 error page. However, you may see 200 status code instead of 404 in IIS logs.
A sample line from my IIS logs. This is actually a failed request that displayed “404 Page not Found” error to the user.
2018-11-27 17:32:28 ::1 GET /app1/kkrr1 – 80 – ::1 Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko – 200 0 0 0
Solution for logging wrong status code
In my case, the root cause was the custom error page configured in the web.config file:
<httpErrors existingResponse="Replace" defaultResponseMode="Redirect" errorMode="Custom">
<remove statusCode="404"/>
<error statusCode="404" responseMode="ExecuteURL" path="/index1.htm"/>
</httpErrors>
Once I changed ExecuteURL to Redirect in the responseMode attribute, IIS started logging 404 errors.
<httpErrors existingResponse="Replace" defaultResponseMode="Redirect" errorMode="Custom">
<remove statusCode="404"/>
<error statusCode="404" responseMode="Redirect" path="/index1.htm"/>
</httpErrors>
Here is the IIS log that shows the correct status code (404) after the change:
2018-11-27 17:33:25 ::1 GET /app1/oopp – 80 – ::1 Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko – 404 0 2 46
Background
responseMode=”ExecuteURL” attribute redirects users to the URL in the custom error configuration. Therefore, IIS logs 200 instead of 404 status code. However, responseMode="Redirect” attribute sends 302 response with the custom error page URL to the user. User’s browser makes another request to the given URL.
Generic Solution
As a generic solution, adding the line below into the custom error page should guarantee that 404 message is logged.
<% Response.StatusCode = 404; %>
Multiple identical logs in Advanced Logging
You may see more than one record in logs for the same request. Logging two or more events instead of one is by-design for Advanced Logging extension. Advanced Logging extension subscribes to GENERAL_REQUEST_START event in the pipeline. Whenever this event is called, a new log is recorded.
In order to confirm this scenario, check your Failed Request Tracing (FREB) logs. If you see that there are child requests, It is expected from Advanced Logging to log more than one records for the same request.
On the other hand, IIS logging system works differently. They are based on HTTP.sys kernel driver which creates notifications only when a response is submitted. Therefore, there is one record per request in IIS logs.
Starting with IIS 8.5, Advanced Logging module is integrated in the logging infrastructure of IIS server. So that this issue won’t happen in IIS 8.5 and newer versions.
