Home
%3CLINGO-SUB%20id%3D%22lingo-sub-297652%22%20slang%3D%22en-US%22%3EIssue%3A%20IIS%20logs%20200%20status%20code%20instead%20of%20404%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-297652%22%20slang%3D%22en-US%22%3E%3CP%3EExample%3A%20If%20you%20try%20to%20access%20a%20web%20page%20that%20doesn%E2%80%99t%20exist%2C%20browser%20displays%20404%20error%20page.%20However%2C%20you%20may%20see%20200%20status%20code%20instead%20of%20404%20in%20IIS%20logs.%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EA%20sample%20line%20from%20my%20IIS%20logs.%20This%20is%20actually%20a%20failed%20request%20that%20displayed%20%E2%80%9C%3CSTRONG%3E404%20Page%20not%20Found%3C%2FSTRONG%3E%E2%80%9D%20error%20to%20the%20user.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3E2018-11-27%2017%3A32%3A28%20%3A%3A1%20GET%20%2Fapp1%2Fkkrr1%20%E2%80%93%2080%20%E2%80%93%20%3A%3A1%20Mozilla%2F5.0%2B(Windows%2BNT%2B10.0%3B%2BWOW64%3B%2BTrident%2F7.0%3B%2BTouch%3B%2Brv%3A11.0)%2Blike%2BGecko%20%E2%80%93%20%3CFONT%20color%3D%22%230000ff%22%3E%3CSTRONG%3E200%20%3C%2FSTRONG%3E%3C%2FFONT%3E0%200%200%3C%2FPRE%3E%0A%3CH2%20id%3D%22toc-hId-1653107299%22%20id%3D%22toc-hId-1764701505%22%20id%3D%22toc-hId-1764701505%22%20id%3D%22toc-hId-1764701505%22%20id%3D%22toc-hId-1764701505%22%20id%3D%22toc-hId-1764701505%22%20id%3D%22toc-hId-1764701505%22%20id%3D%22toc-hId-1764701505%22%20id%3D%22toc-hId-1764701505%22%20id%3D%22toc-hId-1764701505%22%3E%26nbsp%3B%3C%2FH2%3E%0A%3CH2%20id%3D%22toc-hId--899049662%22%20id%3D%22toc-hId--787455456%22%20id%3D%22toc-hId--787455456%22%20id%3D%22toc-hId--787455456%22%20id%3D%22toc-hId--787455456%22%20id%3D%22toc-hId--787455456%22%20id%3D%22toc-hId--787455456%22%20id%3D%22toc-hId--787455456%22%20id%3D%22toc-hId--787455456%22%20id%3D%22toc-hId--787455456%22%3ESolution%20for%20logging%20wrong%20status%20code%3C%2FH2%3E%0A%3CP%3EIn%20my%20case%2C%20the%20root%20cause%20was%26nbsp%3B%20the%20custom%20error%20page%20configured%20in%20the%20%3CCODE%3Eweb.config%3C%2FCODE%3E%20file%3A%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3E%26lt%3BhttpErrors%20existingResponse%3D%22Replace%22%20defaultResponseMode%3D%22Redirect%22%20errorMode%3D%22Custom%22%26gt%3B%0A%20%20%20%20%20%26lt%3Bremove%20statusCode%3D%22404%22%2F%26gt%3B%0A%20%20%20%20%20%26lt%3Berror%20statusCode%3D%22404%22%20responseMode%3D%22ExecuteURL%22%20path%3D%22%2Findex1.htm%22%2F%26gt%3B%20%20%20%20%20%20%20%20%20%20%0A%26lt%3B%2FhttpErrors%26gt%3B%3C%2FPRE%3E%0A%3CP%3EOnce%20I%20changed%20%3CCODE%3EExecuteURL%3C%2FCODE%3E%20to%20%3CCODE%3ERedirect%3C%2FCODE%3E%20in%20the%20%3CCODE%3EresponseMode%3C%2FCODE%3E%20attribute%2C%20IIS%20started%20logging%20404%20errors.%26nbsp%3B%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3E%26lt%3BhttpErrors%20existingResponse%3D%22Replace%22%20defaultResponseMode%3D%22Redirect%22%20errorMode%3D%22Custom%22%26gt%3B%0A%20%20%20%20%20%26lt%3Bremove%20statusCode%3D%22404%22%2F%26gt%3B%0A%20%20%20%20%20%26lt%3Berror%20statusCode%3D%22404%22%20responseMode%3D%22Redirect%22%20path%3D%22%2Findex1.htm%22%2F%26gt%3B%20%20%20%20%20%20%20%20%20%20%0A%26lt%3B%2FhttpErrors%26gt%3B%3C%2FPRE%3E%0A%3CP%3EHere%20is%20the%20IIS%20log%20that%20shows%20the%20correct%20status%20code%20(404)%20after%20the%20change%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3E2018-11-27%2017%3A33%3A25%20%3A%3A1%20GET%20%2Fapp1%2Foopp%20%E2%80%93%2080%20%E2%80%93%20%3A%3A1%20Mozilla%2F5.0%2B(Windows%2BNT%2B10.0%3B%2BWOW64%3B%2BTrident%2F7.0%3B%2BTouch%3B%2Brv%3A11.0)%2Blike%2BGecko%20%E2%80%93%20%3CFONT%20color%3D%22%230000ff%22%3E%3CSTRONG%3E404%3C%2FSTRONG%3E%20%3C%2FFONT%3E0%202%2046%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId-843760673%22%20id%3D%22toc-hId-955354879%22%20id%3D%22toc-hId-955354879%22%20id%3D%22toc-hId-955354879%22%20id%3D%22toc-hId-955354879%22%20id%3D%22toc-hId-955354879%22%20id%3D%22toc-hId-955354879%22%20id%3D%22toc-hId-955354879%22%20id%3D%22toc-hId-955354879%22%20id%3D%22toc-hId-955354879%22%3EBackground%3C%2FH2%3E%0A%3CP%3E%3CCODE%3EresponseMode%3D%E2%80%9DExecuteURL%E2%80%9D%3C%2FCODE%3E%20attribute%20redirects%20users%20to%20the%20URL%20in%20the%20custom%20error%20configuration.%20Therefore%2C%20IIS%20logs%20200%20instead%20of%20404%20status%20code.%20However%2C%20%3CCODE%3EresponseMode%3D%22Redirect%E2%80%9D%3C%2FCODE%3E%20attribute%20sends%20302%20response%20with%20the%20custom%20error%20page%20URL%20to%20the%20user.%20User%E2%80%99s%20browser%20makes%20another%20request%20to%20the%20given%20URL.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId--1708396288%22%20id%3D%22toc-hId--1596802082%22%20id%3D%22toc-hId--1596802082%22%20id%3D%22toc-hId--1596802082%22%20id%3D%22toc-hId--1596802082%22%20id%3D%22toc-hId--1596802082%22%20id%3D%22toc-hId--1596802082%22%20id%3D%22toc-hId--1596802082%22%20id%3D%22toc-hId--1596802082%22%20id%3D%22toc-hId--1596802082%22%3EGeneric%20Solution%3C%2FH2%3E%0A%3CP%3EAs%20a%20generic%20solution%2C%20adding%20the%20line%20below%20into%20the%20custom%20error%20page%20should%20guarantee%20that%20404%20message%20is%20logged.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3E%26lt%3B%25%20Response.StatusCode%20%3D%20404%3B%20%25%26gt%3B%3C%2FPRE%3E%0A%3CH2%20id%3D%22toc-hId-34414047%22%20id%3D%22toc-hId-146008253%22%20id%3D%22toc-hId-146008253%22%20id%3D%22toc-hId-146008253%22%20id%3D%22toc-hId-146008253%22%20id%3D%22toc-hId-146008253%22%20id%3D%22toc-hId-146008253%22%20id%3D%22toc-hId-146008253%22%20id%3D%22toc-hId-146008253%22%20id%3D%22toc-hId-146008253%22%3E%26nbsp%3B%3C%2FH2%3E%0A%3CH2%20id%3D%22toc-hId-1777224382%22%20id%3D%22toc-hId-1888818588%22%20id%3D%22toc-hId-1888818588%22%20id%3D%22toc-hId-1888818588%22%20id%3D%22toc-hId-1888818588%22%20id%3D%22toc-hId-1888818588%22%20id%3D%22toc-hId-1888818588%22%20id%3D%22toc-hId-1888818588%22%20id%3D%22toc-hId-1888818588%22%20id%3D%22toc-hId-1888818588%22%3EMultiple%20identical%20logs%20in%20Advanced%20Logging%3C%2FH2%3E%0A%3CP%3EYou%20may%20see%20more%20than%20one%20record%20in%20logs%20for%20the%20same%20request.%20Logging%20two%20or%20more%20events%20instead%20of%20one%20is%20by-design%20for%20Advanced%20Logging%20extension.%20Advanced%20Logging%20extension%20subscribes%20to%20%3CCODE%3EGENERAL_REQUEST_START%3C%2FCODE%3E%20event%20in%20the%20pipeline.%20Whenever%20this%20event%20is%20called%2C%20a%20new%20log%20is%20recorded.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIn%20order%20to%20confirm%20this%20scenario%2C%20check%20your%20Failed%20Request%20Tracing%20(FREB)%20logs.%20If%20you%20see%20that%20there%20are%20child%20requests%2C%20It%20is%20expected%20from%20Advanced%20Logging%20to%20log%20more%20than%20one%20records%20for%20the%20same%20request.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EOn%20the%20other%20hand%2C%20IIS%20logging%20system%20works%20differently.%20They%20are%20based%20on%20%3CCODE%3EHTTP.sys%3C%2FCODE%3E%20kernel%20driver%20which%20creates%20notifications%20only%20when%20a%20response%20is%20submitted.%20Therefore%2C%20there%20is%20one%20record%20per%20request%20in%20IIS%20logs.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EStarting%20with%20IIS%208.5%2C%20Advanced%20Logging%20module%20is%20integrated%20in%20the%20logging%20infrastructure%20of%20IIS%20server.%20So%20that%20this%20issue%20won%E2%80%99t%20happen%20in%20IIS%208.5%20and%20newer%20versions.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-297652%22%20slang%3D%22en-US%22%3E%3CP%3EThere%20are%20cases%20where%20IIS%20may%20log%20an%20expected%20status%20code%20or%20multiple%20status%20codes%20for%20the%20same%20request.%20Here%20are%20general%20troubleshooting%20steps%20for%20these%20issues.%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-SUB%20id%3D%22lingo-sub-662360%22%20slang%3D%22en-US%22%3ERe%3A%20Issue%3A%20IIS%20logs%20200%20status%20code%20instead%20of%20404%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-662360%22%20slang%3D%22en-US%22%3E%3CP%3Ewe%20did%20all%20that%20and%20now%20from%20200%20error%20we%20now%20get%20302%20error%2C%20can%20you%20please%20tell%20us%20how%20to%20fix%20that%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-665007%22%20slang%3D%22en-US%22%3ERe%3A%20Issue%3A%20IIS%20logs%20200%20status%20code%20instead%20of%20404%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-665007%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F352927%22%20target%3D%22_blank%22%3E%40ispaces%3C%2FA%3E%2C%20can%20you%20check%20the%20trace%20in%20F12%20Developer%20Tools%3F%20There%20should%20be%20404%20after%20302.%20Please%20share%20the%20trace%20as%20well%20as%20the%20corresponding%20records%20from%20IIS%20logs.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-665017%22%20slang%3D%22en-US%22%3ERe%3A%20Issue%3A%20IIS%20logs%20200%20status%20code%20instead%20of%20404%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-665017%22%20slang%3D%22en-US%22%3E%3CP%3Ewe%20tried%20following%20your%20advice%20but%20then%20it%20gave%20us%20server%20error%20so%20we%20had%20to%20rollback%20and%20just%20put%20the%20status%20code%20404%20in%20the%20error%20page%20itself%2C%20this%20solved%20the%20problem%20of%20status%20code%20404%20but%20the%20url%20does%20not%20redirect%20to%20the%20error%20page%20(example%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fwww.ispace1.com%2FAboutx%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fwww.ispace1.com%2FAboutx%3C%2FA%3E)%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-665716%22%20slang%3D%22en-US%22%3ERe%3A%20Issue%3A%20IIS%20logs%20200%20status%20code%20instead%20of%20404%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-665716%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F352927%22%20target%3D%22_blank%22%3E%40ispaces%3C%2FA%3E%20I%20am%20not%20sure%20if%20ASP.NET%20or%20IIS%20is%20throwing%20the%20error.%20I%20would%20recommend%20implementing%3CCODE%3E%3CCUSTOMERRORS%3E%3C%2FCUSTOMERRORS%3E%3C%2FCODE%3E%20in%20addition%20to%20%3CCODE%3E%3CHTTPERRORS%3E%3C%2FHTTPERRORS%3E%3C%2FCODE%3E%20you%20already%20have%20to%20cover%20all%20corner%20cases.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIt%20is%20better%20to%20check%20Failed%20Request%20Tracing%20logs%20to%20see%20which%20module%20is%20throwing%20the%20error%20and%20why%20the%20redirection%20is%20not%20taking%20place.%20I%20would%20appreciate%20if%20you%20create%20a%20support%20request%20with%20us%20so%20we%20can%20troubleshoot%20it%20further.%20Thanks!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-679019%22%20slang%3D%22en-US%22%3ERe%3A%20Issue%3A%20IIS%20logs%20200%20status%20code%20instead%20of%20404%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-679019%22%20slang%3D%22en-US%22%3E%3CP%3Ewe%20have%20both%20custom%20as%20well%20as%20http%20errors%20but%20it%20still%20does%20not%20work%20properly%26nbsp%3Band%20you%20can%20check%20it%20here%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fwww.ispace1.com%2F%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fwww.ispace1.com%2F%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-679020%22%20slang%3D%22en-US%22%3ERe%3A%20Issue%3A%20IIS%20logs%20200%20status%20code%20instead%20of%20404%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-679020%22%20slang%3D%22en-US%22%3E%3CP%3Ewe%20are%20also%20facing%20problems%20with%20hiding%20the%20asp.net%20version%20but%20that%20is%20also%20not%20working%2C%20so%20how%20can%20we%20create%20a%20support%20ticket%20or%20can%20you%20inbox%20me%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-683719%22%20slang%3D%22en-US%22%3ERe%3A%20Issue%3A%20IIS%20logs%20200%20status%20code%20instead%20of%20404%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-683719%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F352927%22%20target%3D%22_blank%22%3E%40ispaces%3C%2FA%3E%2C%20please%20use%20%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhub%2F4343728%2Fsupport-for-business%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ethis%20link%3C%2FA%3E%20to%20create%20a%20support%20request.%20Please%20note%20that%20the%20phone%2Femail%20support%20is%20unlikely%20to%20be%20free.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Microsoft

Example: If you try to access a web page that doesn’t exist, browser displays 404 error page. However, you may see 200 status code instead of 404 in IIS logs. 

 

A sample line from my IIS logs. This is actually a failed request that displayed “404 Page not Found” error to the user.

 

2018-11-27 17:32:28 ::1 GET /app1/kkrr1 – 80 – ::1 Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko – 200 0 0 0

 

Solution for logging wrong status code

In my case, the root cause was  the custom error page configured in the web.config file: 

 

<httpErrors existingResponse="Replace" defaultResponseMode="Redirect" errorMode="Custom">
     <remove statusCode="404"/>
     <error statusCode="404" responseMode="ExecuteURL" path="/index1.htm"/>          
</httpErrors>

Once I changed ExecuteURL to Redirect in the responseMode attribute, IIS started logging 404 errors.  

 

<httpErrors existingResponse="Replace" defaultResponseMode="Redirect" errorMode="Custom">
     <remove statusCode="404"/>
     <error statusCode="404" responseMode="Redirect" path="/index1.htm"/>          
</httpErrors>

Here is the IIS log that shows the correct status code (404) after the change:

 

2018-11-27 17:33:25 ::1 GET /app1/oopp – 80 – ::1 Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko – 404 0 2 46

 

Background

responseMode=”ExecuteURL” attribute redirects users to the URL in the custom error configuration. Therefore, IIS logs 200 instead of 404 status code. However, responseMode="Redirect” attribute sends 302 response with the custom error page URL to the user. User’s browser makes another request to the given URL.

 

Generic Solution

As a generic solution, adding the line below into the custom error page should guarantee that 404 message is logged.

 

<% Response.StatusCode = 404; %>

 

Multiple identical logs in Advanced Logging

You may see more than one record in logs for the same request. Logging two or more events instead of one is by-design for Advanced Logging extension. Advanced Logging extension subscribes to GENERAL_REQUEST_START event in the pipeline. Whenever this event is called, a new log is recorded.

 

In order to confirm this scenario, check your Failed Request Tracing (FREB) logs. If you see that there are child requests, It is expected from Advanced Logging to log more than one records for the same request.

 

On the other hand, IIS logging system works differently. They are based on HTTP.sys kernel driver which creates notifications only when a response is submitted. Therefore, there is one record per request in IIS logs.

 

Starting with IIS 8.5, Advanced Logging module is integrated in the logging infrastructure of IIS server. So that this issue won’t happen in IIS 8.5 and newer versions.

7 Comments
Frequent Visitor

we did all that and now from 200 error we now get 302 error, can you please tell us how to fix that?

Microsoft

@ispaces, can you check the trace in F12 Developer Tools? There should be 404 after 302. Please share the trace as well as the corresponding records from IIS logs.

Frequent Visitor

we tried following your advice but then it gave us server error so we had to rollback and just put the status code 404 in the error page itself, this solved the problem of status code 404 but the url does not redirect to the error page (example: https://www.ispace1.com/Aboutx

Microsoft

@ispaces I am not sure if ASP.NET or IIS is throwing the error. I would recommend implementing <customErrors> in addition to <httpErrors> you already have to cover all corner cases.

 

It is better to check Failed Request Tracing logs to see which module is throwing the error and why the redirection is not taking place. I would appreciate if you create a support request with us so we can troubleshoot it further. Thanks!

Frequent Visitor

we have both custom as well as http errors but it still does not work properly and you can check it here https://www.ispace1.com/

 

Frequent Visitor

we are also facing problems with hiding the asp.net version but that is also not working, so how can we create a support ticket or can you inbox me?

Microsoft

Hi @ispaces, please use this link to create a support request. Please note that the phone/email support is unlikely to be free.