HTTP.sys by default creates error log files under C:\Windows\System32\LogFiles\HTTPERR.

Is it possible to change the format of these log files to include other fields including cs-host and cs-uri-query?


This list from Microsoft is a bit of outdated, as it does not include the recently introduced "streamid" field present in Windows Server 2016, but it definitely can help you specify the fields you need. https://docs.microsoft.com/en-us/windows/win32/http/error-logging-in-windows-server-2003-sp1


Expanding on the earlier answer you need to assign a value to the following registry entry for chosen fields.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Parameters] "ErrorLoggingFields"=dword:0fc884c7

Basically the value is a sum of all the bit values from the list below for whichever fields you want included.

Log field Logged by default Bit value
Date Yes 0x00000001
Time Yes 0x00000002
Client IP Address Yes 0x00000004
Server Computer Name No 0x00000020
Server IP Address Yes 0x00000040
Method Yes 0x00000080
Protocol Status Yes 0x00000400
SC-Bytes No 0x00001000
CS-Bytes No 0x00002000
Time Taken No 0x00004000
Server Port Yes 0x00008000
User Agent No 0x00010000
Cookie No 0x00020000
referrer No 0x00040000
Protocol Version Yes 0x00080000
Host No 0x00100000
Client Port Yes 0x00400000
URI Yes 0x00800000
SiteId Yes 0x01000000
Reason Phrase Yes 0x02000000
Queue Name Yes 0x04000000
Stream Id Yes 0x08000000

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.