Windows Server 2022 - IIS - incomming request - can't find in any log entries

Question

Windows Server 2022 - IIS - incomming request - can't find in any log entries

AttilaKrausz 0

Dear community,

On our Windows Server 2022 we have IIS installed and we are running a WCF service which service is waiting for SOAP requests from an external SAP system. The issue is that the external SAP system tries to communicate with this service and it gets back this error code:

"message": "Backside header ('N/A') failed to parse due to: Failed to process response headers, URL: https://HOST:8443/CONTROLCYCLEORDERNOTIFICATION/Service"

If we look into the IIS logs on the server then we don't find any log entires for this request. What we've already checked:

windows event logs
IIS logs
HTTPERR log
WCF service logs

We've checked the firewall and it seems that the external SAP system can reach our WCF service, but the communication fails. I wanna ask: why we don't see any log entries in the log files? From the server point of view it seems like the request never reached the server, but it reaches. What can we check? What extra logging can we set up or what can we change on IIS side to see these incomming requests? This server is a production server, so unfortunately we can't run for ex. a Fiddler on it.

Thank you in advance for your support!

Geoff McKenzie 865 Reputation points

2025-03-26T03:27:44.9833333+00:00

Hi,

you could run a netsh.exe trace command to confirm the packets are arriving - convert to pcap and read in wireshark. or depedning if it is installed on your version of windows, use pktmon.exe.
AttilaKrausz 0 Reputation points

2025-03-26T07:30:08.26+00:00

Hi,

Cant it cause any performance issue on the server? The problem is that this server is production server and we are not alloweed to cause any performance slow down on it.

Thanks!
Geoff McKenzie 865 Reputation points

2025-03-26T09:45:10.2633333+00:00

Can it cause performance issues? Unlikely. But I don't know your environment. How close to hitting a performance bottleneck is your system currently running?

How important is it to troubleshoot this issue?

Do you have a non-prod/test environment you can do the test in?

Do you have maintenance windows or regular high and low traffic volumes times of the day/week?

etc.

if you are really worried about it and don't have any flexibility in timing and no test environment, then you can mirror the port at the switch level (I think mirror is the correct terminology - I am not a network guy). So, you mirror the network port to another port with a machine plugged into the port that is not production and capture the traffic on that one. This will at least tell you if the traffic has got as far as the switch port or not. There are VM/VSwitch equivalents in the case your server is a VM.
AttilaKrausz 0 Reputation points

2025-03-27T13:59:32+00:00

We have a test environment of course. There we will try to reproduce the issue. What I was interested in is that what else can we chech on windows level to see the incomming request in a log entry. It is strange that there is no log but it seems that the request was processed somehow.

1 answer

Your answer

Geoff McKenzie 865 Reputation points

2025-03-26T03:27:44.9833333+00:00

Hi,

you could run a netsh.exe trace command to confirm the packets are arriving - convert to pcap and read in wireshark. or depedning if it is installed on your version of windows, use pktmon.exe.
AttilaKrausz 0 Reputation points

2025-03-26T07:30:08.26+00:00

Hi,

Cant it cause any performance issue on the server? The problem is that this server is production server and we are not alloweed to cause any performance slow down on it.

Thanks!
Geoff McKenzie 865 Reputation points

2025-03-26T09:45:10.2633333+00:00

Can it cause performance issues? Unlikely. But I don't know your environment. How close to hitting a performance bottleneck is your system currently running?

How important is it to troubleshoot this issue?

Do you have a non-prod/test environment you can do the test in?

Do you have maintenance windows or regular high and low traffic volumes times of the day/week?

etc.

if you are really worried about it and don't have any flexibility in timing and no test environment, then you can mirror the port at the switch level (I think mirror is the correct terminology - I am not a network guy). So, you mirror the network port to another port with a machine plugged into the port that is not production and capture the traffic on that one. This will at least tell you if the traffic has got as far as the switch port or not. There are VM/VSwitch equivalents in the case your server is a VM.
AttilaKrausz 0 Reputation points

2025-03-27T13:59:32+00:00

We have a test environment of course. There we will try to reproduce the issue. What I was interested in is that what else can we chech on windows level to see the incomming request in a log entry. It is strange that there is no log but it seems that the request was processed somehow.

Answer 1

Hello AttilaKrausz,

Thank you for posting in Q&A forum.

It sounds like you've already done a thorough job checking the usual suspects for logs. Since you're not finding any information, here are a few additional steps you might consider:

Use a network monitoring tool like Wireshark to capture and analyze the network traffic between the SAP system and your server. This can help you see if the requests are reaching your server and if there are any issues with the network communication.
Ensure that the application pool for your WCF service is configured correctly. Sometimes, issues with the application pool settings can prevent requests from being processed properly.
Double-check the configuration of your WCF service, including bindings, endpoints, and security settings. Make sure that they are compatible with the SAP system's requirements.
Temporarily increase the logging levels for your WCF service and IIS to capture more detailed information. This can help you identify any issues that might not be logged at the default logging levels.
Ensure that there are no firewall or security software settings that might be blocking the requests from the SAP system. Sometimes, these settings can prevent requests from reaching your server.
If possible, try sending requests to your WCF service from a different client (e.g., a simple SOAP client) to see if the issue is specific to the SAP system or if it affects all clients.

I hope the information above is helpful.

If you have any questions or concerns, please feel free to let us know.

Best Regards,

Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

AttilaKrausz 0 Reputation points

2025-03-27T14:04:24.53+00:00

Hi Daisy Zhou,

Thanks for your answer. I just wanna answer your points:

We can't use it in the PROD

It seems the config is fine. We can also reach the endpoint from the url.

The current solution was working before in windows server 2019. Last year we updated the server to windows server 2022 and after this update the service failed.

We already did it. But no entry in the log files for these SAP requests.

We already checked the network side. It seems fine, because the request somehow reaches the server.

We will try this. But out main problem is that we don't see any log entry what can describe what is the issue.

Share via

Windows Server 2022 - IIS - incomming request - can't find in any log entries

1 answer

Your answer