In the "Actions" Pane of IIS Manager, under Configure there is supposed to be a link for "Failed Request Tracing". I don't see that... I just have "Limits..."
Install the Tracing component of the Web Server role through Server Manager.
(By the way: Whenever you add a component to IIS, you need to restart the IIS Manager GUI, to reload the list of UI modules that'll be displayed to you. This doesn't apply to most other changes, because they happen "live" - it's just the user interface module list which is cached at startup)
Failed Request Tracing then shows up in the Actions Pane at the Site level, and needs to be enabled there before rules will fire.
Then, you configure Failed Request Tracing rules at any level within that site to capture what you want.