Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. LogFiles
  5. HTTPERR
FolderRisk: Caution

HTTPERR C:\Windows\System32\LogFiles\HTTPERR

HTTPERR\httperr<n>.log: HTTP.sys driver error logs, listing requests rejected before they reach IIS or the application. Useful for 400 errors.

Updated on By AltF4 Formation

What it’s for

HTTPERR receives the error logs of the HTTP Server API, that is of the HTTP.sys driver that listens in front of IIS and other HTTP servers. It is created in the configured log folder (%SystemRoot%\System32\LogFiles by default) and is open only to administrators and the system account. It lists the requests the driver refuses before they reach the web server, which makes it the source for a 400 error that never shows in the IIS logs, or for dropped connections.

What it contains

  • httperr<n>.log files (httperr1.log, httperr2.log…), numbered in sequence.
  • Text in the W3C log format. The #Fields line gives the columns: date, time, client address and port, server address and port, HTTP version, method, URI, response code, site, rejection reason (s-reason) and queue name.
  • The reason is the column that matters. Frequent values include BadRequest, Hostname, Timer_ConnectionIdle and Connection_Abandoned_By_AppPool.

Risks and best practices

  • A file is closed when it reaches ErrorLogFileTruncateSize (1 MB by default, which is also the minimum) and a new one is opened, so no manual cleanup is needed.
  • The settings are under HKLM\System\CurrentControlSet\Services\HTTP\Parameters (EnableErrorLogging, ErrorLogFileTruncateSize, ErrorLoggingDir). They only take effect after the driver restarts (net stop http, net start http), which interrupts dependent services, so schedule it.
  • The files contain client IP addresses, so protect copies.

Useful commands

Fenêtre de terminal
# List the HTTP.sys error files
Get-ChildItem -Force "$env:windir\System32\LogFiles\HTTPERR" | Select-Object Name, Length, LastWriteTime


# Read the end of the most recent file
Get-ChildItem "$env:windir\System32\LogFiles\HTTPERR\httperr*.log" | Sort-Object LastWriteTime | Select-Object -Last 1 | Get-Content -Tail 40


# Look for a rejection reason (for example Timer_ or BadRequest)
Select-String -Path "$env:windir\System32\LogFiles\HTTPERR\httperr*.log" -Pattern "BadRequest|Timer_" | Select-Object -Last 20


# Read the HTTP.sys error logging configuration
Get-ItemProperty "HKLM:\System\CurrentControlSet\Services\HTTP\Parameters" | Select-Object EnableErrorLogging, ErrorLogFileTruncateSize, ErrorLoggingDir

Report a mistake