Unraveling the Mystery: Are Failed Connections Logged in IIS?

As a webmaster, system administrator, or developer, you’ve probably encountered the frustrating phenomenon of failed connections in IIS (Internet Information Services). You’re not alone! In this in-depth article, we’ll delve into the world of IIS logging, exploring the answers to the burning question: Are failed connections logged in IIS?

Understanding IIS Logging

IIS logging is an essential feature that helps you monitor and analyze website traffic, errors, and performance. There are two types of logging in IIS:

• Access Logging: Records information about incoming requests, including client IP addresses, request methods, and response codes.
• Failed Request Tracing (FRT): Logs detailed information about failed requests, including the error codes, failure reasons, and request URLs.

Failed Connection Logging in IIS

Now, let’s get to the heart of the matter: Are failed connections logged in IIS? The short answer is: it depends. By default, IIS does not log failed connections in the access log or FRT log. However, there are a few scenarios where you can enable logging for failed connections:

Scenario 1: Connection Failures due to HTTP.sys

When a connection fails due to an HTTP.sys error (e.g., a malformed request), IIS logs the error in the Windows Event Log. You can view these logs using the Event Viewer:

• Open the Event Viewer (eventvwr.msc).
• Navigate to the Windows Logs section.
• Filter the logs by selecting System as the event source.
• Look for events with an event ID of 107 (HTTP.sys error).

Scenario 2: Connection Failures due to IIS Configuration

If a connection fails due to an IIS configuration issue (e.g., a malformed URL), you can enable Failed Request Tracing (FRT) to log the error. Follow these steps:

1. Open IIS Manager (inetmgr).
2. Select the website or application pool you want to configure.
3. In the Actions panel, click Failed Request Tracing....
4. Enable FRT by checking the Enable box.
5. In the Failed Request Tracing Settings section, select the Trace All Failures option.
6. Specify the Failure Definitions (e.g., 404, 403, 500).
7. Click OK to apply the changes.

<system.webServer>
    <tracing>
        <traceFailedRequests>
            <add path="*">
                <traceAreas>
                    <add provider="ASP" verbosity="Verbose" />
                    <add provider="ASPNET" verbosity="Verbose" />
                    <add provider="ISAPI" verbosity="Verbose" />
                    <add provider="WWW Server" verbosity="Verbose" />
                </traceAreas>
                <failureDefinitions>
                    <add statusCodes="404,403,500" />
                </failureDefinitions>
            </add>
        </traceFailedRequests>
    </tracing>
</system.webServer>

Scenario 3: Custom Logging using Event Tracing for Windows (ETW)

ETW is a logging framework that allows you to capture custom events in IIS. You can use ETW to log failed connections. Here’s an example of how to configure ETW logging:

1. Open the Command Prompt as an administrator.
2. Run the following command to enable ETW logging for HTTP.sys:
   logman create trace "Failed Connections" -p {ddf5d204-2f8f-4357-81f1-6a74b5db72a2} -o "C:\logs\FailedConnections.etl"
3. In the IIS Manager, add the following custom logging module:
   <add name="FailedConnections" type="System.Web.RequestNotification, System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" preCondition="managedHandler" />

Column	Description
Timestamp	The time the event occurred
Level	The logging level (e.g., Error, Warning, Info)
Event ID	A unique identifier for the event
Message	A brief description of the event

Analyzing Failed Connection Logs

Once you’ve enabled logging for failed connections, you’ll need to analyze the log files to identify the root cause of the issue. Here are some tips for analyzing the logs:

• Use a log analysis tool like LogParser or Microsoft’s own logman command to parse the logs.
• Filter the logs by date, time, and event ID to narrow down the scope.
• Look for patterns and correlations between events.
• Verify that the failed connections are not due to a misconfigured IIS or HTTP.sys.

Conclusion

In conclusion, while IIS does not log failed connections by default, there are ways to enable logging for these events. By understanding the different logging mechanisms in IIS, you can gain valuable insights into the root causes of failed connections and take corrective action to improve the reliability and performance of your web applications. Remember to analyze the logs carefully, and don’t hesitate to reach out if you need further assistance.

Now, go forth and untangle the mysteries of IIS logging!

Frequently Asked Question

Get the inside scoop on IIS logging and find out what happens when connections fail!