The loghttp module in the worker process with id 'xxxx' could not obtain custom log data for '1' req

[Archi_Chakraborty]

Recently we worked on an issue where if we set “Both log file and ETW event” for Log Event Destination in the IIS logging, we would see the below error in the event logs for each and every request:

Log Name:      Application

Source:        Microsoft-Windows-IIS-W3SVC-WP

Date:          11/1/2021 12:46:39 AM

Event ID:      2308

Task Category: None

Level:         Error

Keywords:      Classic

User:          N/A

Computer:      xxxx

Description:

The loghttp module in the worker process with id 'xxxx' could not obtain custom log data for '1' requests. The data field contains the error code.

Event Xml:

<Event xmlns=http://schemas.microsoft.com/win/2004/08/events/event>

  <System>

    <Provider Name="Microsoft-Windows-IIS-W3SVC-WP" Guid="{670080D9-742A-4187-8D16-41143D1290BD}" EventSourceName="W3SVC-WP" />

    <EventID Qualifiers="49152">2308</EventID>

    <Version>0</Version>

    <Level>2</Level>

    <Task>0</Task>

    <Opcode>0</Opcode>

    <Keywords>0x80000000000000</Keywords>

    <TimeCreated SystemTime="2021-11-01T07:46:39.9624364Z" />

    <EventRecordID>112953</EventRecordID>

    <Correlation />

    <Execution ProcessID="0" ThreadID="0" />

    <Channel>Application</Channel>

    <Computer>xxxx</Computer>

    <Security />

  </System>

  <EventData>

    <Data Name="RequestCount">1</Data>

    <Data Name="PID">xxxx</Data>

    <Binary>

    </Binary>

  </EventData>

</Event>

Steps to replicate this problem:

1. Create a 32-bit application pool on a 64-bit OS (Windows 2019 or later).
2. Create a site and enable logging to be "Both log file and ETW event".
3. Browse the site.

Event 2308 from IIS-W3SVC-WP will be created for each request:

The loghttp module in the worker process with id '93692' could not obtain custom log data for '1' requests. The data field contains the error code.

Cause:

This issue has been identified as a bug in Windows Server 2019 and newer releases. Please note that this only occurs with the 32 bit applications when ETW logging is enabled.

Possible workarounds:

1. Turn off logging or log to file only (no ETW).
2. Switch to use a 64-bit Application Pool.
3. Use custom fields in logging. In IIS Manager, go to the logging module for the site, click “Select Fields…”. Select desirable standard fields and add any custom field (for example, Server Variable HTTP_METHOD).

Here is an example snippet in applicationHost.config:

<site name="Test" id="2" serverAutoStart="true">

    <application path="/" applicationPool="Test">

        <virtualDirectory path="/" physicalPath="C:\inetpub\wwwroot" />

    </application>

    <bindings>

        <binding protocol="http" bindingInformation="*:8080:" />

    </bindings>

    <logFile logTargetW3C="File, ETW">

        <customFields>

            <clear />

            <add logFieldName="Method" sourceName="HTTP_METHOD" sourceType="ServerVariable" />

        </customFields>

    </logFile>

</site>