Seeing the 400 status code in IIS logs is rare but it’s good to know why it happens and what to do when it happens.
A sample IIS log with 400 status:
2021-09-20 09:16:32 172.13.1.8 POST /Page.asmx - 8081 - 172.26.7.31 SAP+NetWeaver+Application+Server+(1.0;754) - 400 0 64 125858
400 Status Code
400 status means “Bad Request”. So this is not a server-side issue. There is something wrong with the request. Is not well-formed before reaching to IIS
If the substatus code was something other than 0, it would be easier to troubleshoot. For example, If it was 1, it would mean “Invalid Destination Header”. If it was 2, that would mean “Invalid Depth Header”. Here is the full list of status codes.
Value 64 in sc-win32-status
Code 64 in IIS logs points out a network-related issue. It refers to “The specified network name is no longer available”. After sending the response, IIS waits for ACK package from the client. If the client resets the connection instead of sending this package, IIS logs 64 code since it’s not a graceful connection close.
Additionally, note the time-taken value which is 125 seconds (Mostly likely, it’s the result of the request not being processed within the default IIS time out ~ 120 seconds).
Recommendations
For 400.0.64 scenario, check HTTPERR logs. In the server I troubleshoot, it showed Timer_EntityBody error for the same timestamp:
2021-09-20 09:16:32 172.26.7.31 46342 172.13.1.8 8081 HTTP/1.1 POST /Page.asmx - - 2 Timer_EntityBody SAP_Update
Timer_EntityBody error means “The connection expired before the request entity body arrived”. It looks like either the client is not sending the full request or the request is being held on the way (possible network issues).
Recommendations:
- Check if there are software like antivirus or network endpoint protection in the server. Uninstall them and monitor the system for a while to see if the issue occurs again (Note: disabling them sometimes doesn’t mean they don’t run in the background anymore. Uninstalling is the ultimate way of eliminating them from the troubleshooting process)
- Work with the third-party product support to see if there is anything blocking the requests to be fully sent. Application might be initiating the connection but not completing it
- Check with your Networking team to analyze the network between the web server and client. Ideally, a network trace would be very helpful