Change format of IIS HTTP Error logging

Question

HTTP.sys by default creates error log files under C:\Windows\System32\LogFiles\HTTPERR.

Is it possible to change the format of these log files to include other fields including cs-host and cs-uri-query?

Answer 1

This list from Microsoft is a bit of outdated, as it does not include the recently introduced "streamid" field present in Windows Server 2016, but it definitely can help you specify the fields you need. https://docs.microsoft.com/en-us/windows/win32/http/error-logging-in-windows-server-2003-sp1

To quickly sum all the Hex values, just type them in Google as is (in this example I choosed to include all fields, including the new streamid fields available since Windows Server 2016 and above) :

0x00000001 + 0x00000002 + 0x00000004 + 0x00000020 + 0x00000040 + 0x00000080 + 0x00000400 + 0x00001000 + 0x00002000 + 0x00004000 + 0x00008000 + 0x00010000 + 0x00020000 + 0x00040000 + 0x00080000 + 0x00100000 + 0x00400000 + 0x00800000 + 0x01000000 + 0x02000000 + 0x04000000 + 0x08000000

That will return 0xFDFF4E7 !

Just create then execute a new .REG file with this content :

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Parameters]

; WIN 2016-2019-2022
; LOG THE FOLLOWING #Fields: date time s-computername c-ip c-port s-ip s-port cs-version cs-method cs-uri cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-bytes cs-bytes time-taken s-siteid s-reason s-queuename streamid
"ErrorLoggingFields"=dword:0fdff4e7

Answer 2

Expanding on the earlier answer you need to assign a value to the following registry entry for chosen fields.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Parameters] "ErrorLoggingFields"=dword:0fc884c7

Basically the value is a sum of all the bit values from the list below for whichever fields you want included.

Log field	Logged by default	Bit value
Date	Yes	0x00000001
Time	Yes	0x00000002
Client IP Address	Yes	0x00000004
Server Computer Name	No	0x00000020
Server IP Address	Yes	0x00000040
Method	Yes	0x00000080
Protocol Status	Yes	0x00000400
SC-Bytes	No	0x00001000
CS-Bytes	No	0x00002000
Time Taken	No	0x00004000
Server Port	Yes	0x00008000
User Agent	No	0x00010000
Cookie	No	0x00020000
referrer	No	0x00040000
Protocol Version	Yes	0x00080000
Host	No	0x00100000
Client Port	Yes	0x00400000
URI	Yes	0x00800000
SiteId	Yes	0x01000000
Reason Phrase	Yes	0x02000000
Queue Name	Yes	0x04000000
Stream Id	Yes	0x08000000

Answer 3

Here is a workaround:

1. Create a header file using the columns of your HTTPErr log file in the same order and save it as - header.txt

2. Use the following format for your SQL query

   LogParser.exe "select sc-status, s-reason, s-queuename, count(* ) from C:\temp\HTTPLogs*.log group by sc-status, s-reason, s-queuename order by count(*) desc" -i:TSV -iseparator:space -iHeaderFile C:\temp\HTTPLogs\header.txt