HTTP Service Connection Auditing

Article
02/02/2010

Applies To: Windows Server 2008

HTTP Service Connection Auditing provides information about the state of the service, but does not indicate whether the service is in a normal or error state.

Events

Event ID	Source	Message
1	Microsoft-Windows-HttpEvent	Request received (request ID %1) on connection (connection ID %2) from remote address %4.
2	Microsoft-Windows-HttpEvent	Parsed request (request pointer %1, method %2) with URI %3.
3	Microsoft-Windows-HttpEvent	Delivered request to server application (request pointer %1, request ID %2, site ID %3) from request queue %4 for URI %5 with status %6.
4	Microsoft-Windows-HttpEvent	Server application passed response (request ID %1, connection ID %2, method %4, header length %5, number of entity chunks %6, cache policy %7) with status code %3.
5	Microsoft-Windows-HttpEvent	Server application passed the last response (corresponding to request ID %1).
6	Microsoft-Windows-HttpEvent	Server application passed entity body for request ID %1 (connection ID %2).
7	Microsoft-Windows-HttpEvent	Server application passed the last entity body for request ID %1.
8	Microsoft-Windows-HttpEvent	Server application passed response (request ID %1, connection ID %2, method %4, header length %5, number of entity chunks %6, cache policy %7) with status code %3.
9	Microsoft-Windows-HttpEvent	Server application passed the last response (corresponding to request ID %1).
10	Microsoft-Windows-HttpEvent	Response ready for send (corresponding to request ID %1) with status code %2.
12	Microsoft-Windows-HttpEvent	Queued last response (corresponding to request ID %1) for sending. Status code is %2.
13	Microsoft-Windows-HttpEvent	Response sent (corresponding to request ID %1) with status code %2. If disconnect is required, a TCP FIN has been sent.
14	Microsoft-Windows-HttpEvent	Error occurred while sending the last response (corresponding to request ID %1) with status code %2. A TCP Reset has been sent.
21	Microsoft-Windows-HttpEvent	New connection created (local IP address %3 and remote address %5).
22	Microsoft-Windows-HttpEvent	Connection ID (%2) assigned to connection and request (request ID %1) will be parsed.
23	Microsoft-Windows-HttpEvent	Client closed the connection (connection pointer %1). Status of whether closed by TCP Reset: %2.
24	Microsoft-Windows-HttpEvent	Connection (connection pointer %1) cleanup started due to either the sending of a TCP Reset, receiving of a TCP Reset, or after the mutual exchange of TCP Fins.
46	Microsoft-Windows-HttpEvent	Successfully associated QoS flow with connection (connection ID %1). Bandwidth throttled to: %2 Bytes per second.
65	Microsoft-Windows-HttpEvent	Server application canceled the processing of its request (request ID %1).

HTTP Service Connections - Send and Receive