Status Code 400 with 64 in sc-win32-status column

Seeing the 400 status code in IIS logs is rare but it’s good to know why it happens and what to do when it happens.

A sample IIS log with 400 status:

2021-09-20 09:16:32 172.13.1.8 POST /Page.asmx - 8081 - 172.26.7.31 SAP+NetWeaver+Application+Server+(1.0;754) - 400 0 64 125858

400 Status Code

400 status means “Bad Request”. So this is not a server-side issue. There is something wrong with the request. Is not well-formed before reaching to IIS

If the substatus code was something other than 0, it would be easier to troubleshoot. For example, If it was 1, it would mean “Invalid Destination Header”. If it was 2, that would mean “Invalid Depth Header”. Here is the full list of status codes.

Value 64 in sc-win32-status

Code 64 in IIS logs points out a network-related issue. It refers to “The specified network name is no longer available”. After sending the response, IIS waits for ACK package from the client. If the client resets the connection instead of sending this package, IIS logs 64 code since it’s not a graceful connection close.

Additionally, note the time-taken value which is 125 seconds (Mostly likely, it’s the result of the request not being processed within the default IIS time out ~ 120 seconds).

Recommendations

For 400.0.64 scenario, check HTTPERR logs. In the server I troubleshoot, it showed Timer_EntityBody error for the same timestamp:

2021-09-20 09:16:32  172.26.7.31  46342 172.13.1.8 8081 HTTP/1.1 POST /Page.asmx - - 2 Timer_EntityBody SAP_Update

Timer_EntityBody error means “The connection expired before the request entity body arrived”. It looks like either the client is not sending the full request or the request is being held on the way (possible network issues).

Recommendations:

• Check if there are software like antivirus or network endpoint protection in the server. Uninstall them and monitor the system for a while to see if the issue occurs again (Note: disabling them sometimes doesn’t mean they don’t run in the background anymore. Uninstalling is the ultimate way of eliminating them from the troubleshooting process)
• Work with the third-party product support to see if there is anything blocking the requests to be fully sent. Application might be initiating the connection but not completing it
• Check with your Networking team to analyze the network between the web server and client. Ideally, a network trace would be very helpful