Example: If you try to access a web page that doesn’t exist, browser displays 404 error page. However, you may see 200 status code instead of 404 in IIS logs.
A sample line from my IIS logs. This is actually a failed request that displayed “404 Page not Found” error to the user.
2018-11-27 17:32:28 ::1 GET /app1/kkrr1 – 80 – ::1 Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko – 200 0 0 0
In my case, the root cause was the custom error page configured in the
<httpErrors existingResponse="Replace" defaultResponseMode="Redirect" errorMode="Custom"> <remove statusCode="404"/> <error statusCode="404" responseMode="ExecuteURL" path="/index1.htm"/> </httpErrors>
Once I changed
Redirect in the
responseMode attribute, IIS started logging 404 errors.
<httpErrors existingResponse="Replace" defaultResponseMode="Redirect" errorMode="Custom"> <remove statusCode="404"/> <error statusCode="404" responseMode="Redirect" path="/index1.htm"/> </httpErrors>
Here is the IIS log that shows the correct status code (404) after the change:
2018-11-27 17:33:25 ::1 GET /app1/oopp – 80 – ::1 Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko – 404 0 2 46
responseMode=”ExecuteURL” attribute redirects users to the URL in the custom error configuration. Therefore, IIS logs 200 instead of 404 status code. However,
responseMode="Redirect” attribute sends 302 response with the custom error page URL to the user. User’s browser makes another request to the given URL.
As a generic solution, adding the line below into the custom error page should guarantee that 404 message is logged.
<% Response.StatusCode = 404; %>
You may see more than one record in logs for the same request. Logging two or more events instead of one is by-design for Advanced Logging extension. Advanced Logging extension subscribes to
GENERAL_REQUEST_START event in the pipeline. Whenever this event is called, a new log is recorded.
In order to confirm this scenario, check your Failed Request Tracing (FREB) logs. If you see that there are child requests, It is expected from Advanced Logging to log more than one records for the same request.
On the other hand, IIS logging system works differently. They are based on
HTTP.sys kernel driver which creates notifications only when a response is submitted. Therefore, there is one record per request in IIS logs.
Starting with IIS 8.5, Advanced Logging module is integrated in the logging infrastructure of IIS server. So that this issue won’t happen in IIS 8.5 and newer versions.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.