Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have an internal web application hosted on IIS 8 that exposes some REST services through HTTPS. Since it's accessed by other applications, we require client certificates. We are getting some authentication failures due to missing or bad client certificate, but we need them to be recorded as Windows Events so we can use our monitoring infrastructure. How can we properly configure IIS 8, running on Windows Server 2012, to forward client certificate authentication failures errors so they appear on Windows Events? Is there any special server Feature that needs to be installed and running in order for this to work?

share|improve this question

As far as I know there is no built-in way to forward any IIS request related errors to the Windows event log.

Certificate related errors should show up in the http logs with a special sub-code (403.7,403.13,403.16,403.17) so you can write a short PowerShell script to run once an hour, going through all log files and looking for these subcodes. Then for each matching request or an aggregated summary writing an entry to the Windows event log.

share|improve this answer
One alternative to running a script would be to use a real-time log file monitoring solution to log contents from a log file (e.g. IIS log) to the event log. We develop EventSentry (, and the free edition EventSentry Light does exactly that. You just configure to look for certain text patterns (e.g. 403.7), and when found it logs the entire line of the log file to the event log. – Lucky Luke Nov 8 '13 at 4:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.