I'm really hoping somebody can help apply some sanity to this IIS issue that has been driving me crazy. I seem to be experiencing the same problem as the poor soul in this thread: https://forums.iis.net/t/1240175.aspx - IIS will not serve static content over a certain (arbitrary?) size. NOTE: Previously had no problems serving static content on this same system.
OS: Windows 10 Pro 64-bit 2004 19041.508
Problem: Basically, IIS will not serve static content over a certain arbitrary size - static files over that size will just timeout eventually. Non-static content, for example asp files do not have this limit and load as expected regardless of size. This started happening seemingly out of nowhere with no directly related IIS/system/network/permission changes.
Things I've Tried:
- Yes, static content is turned on!
- Static compression enabled/disabled
- Same thing, every browser
- Completely virus/malware free
- Hardware and network healthy
- Don't see anything relevant in event logs
- Disabled ad blocker/anti-virus/firewall/etc.
- No proxies (except when Fiddler is running)
- Completely removed IIS (disabled feature, moved \inetpub and \windows\system32\inetsrv) and re-enabled feature which recreated them)
- Checked logs, enabled tracing
- SFC scan clean
- Checked permissions, toggled app user between IUSR and domain user
Details:
About a 1 or 1.5 months ago my local IIS stopped working, out of the blue. By out of the blue I mean the the previous day it was working fine as always and the next it stopped - without having done any system changes whatsoever. By stopped working I mean (eventually realized) that it was only static files that were not serving correctly. Unfortunately/fortunately, I noticed the problem because I had created the obligatory personal COVID tracker. It was html/js running against a .NET API back end. The pages stopped loading and I spent time wondering what I had borked in the code (which I also hadn't touched). Eventually I realized no static content - images, css, js, html, txt etc. - was loading properly. I ran some tests and I found that there was a cutoff point in size of content that would load, but it is somewhat arbitrary. For example, the iisstart.png image in the default IIS website does not load - it's 97K. I replaced it with an 8k file that loads fine. I could get about 1500 bytes served in an html file - 1501 bytes would send it off the rails but 1500 worked. Same sort of thing was found for text files although I was able to send more than 1500 bytes - don't remember how much but did find a point where a 1 byte difference caused a problem.
Test Load of Default IIS Website:
IIS log is not helpful - it reports the failed attempt as a 200 but says it took 19 seconds. It is returning a win32 status code of 121 though:
#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken
2020-10-23 13:36:12 127.0.0.1 GET /iisstart.png - 80 - 127.0.0.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64;+rv:82.0)+Gecko/20100101+Firefox/82.0 http://localhost/ 200 0 121 18944
The failed tracing doesn't fire every time - not sure why. I've included an example output below.
Fiddler gives me this for the image request:
[Fiddler] ReadResponse() failed: The server did not return a complete response for this request. Server returned 0 bytes.
For this site the actual html loads fine - it's only 696 bytes - the image it references does not though (97K).
If anybody can shed some light on this or give me a direction in troubleshooting (I'm out of ideas short of Windows re-install and I don't want to do that) I would greatly appreciate it.
Thanks
I'll put a snippet from my most recent FailedRequestLogFile output here:
<?xml version="1.0" encoding="UTF-8" ?>
<?xml-stylesheet type='text/xsl' href='freb.xsl'?>
<!-- saved from url=(0014)about:internet -->
<failedRequest url="http://localhost:80/iisstart.png"
siteId="1"
appPoolId="DefaultAppPool"
processId="9916"
verb="GET"
remoteUserName=""
userName=""
tokenUserName="NT AUTHORITY\IUSR"
authenticationType="anonymous"
activityId="{80000002-0005-F300-B63F-84710C7967BB}"
failureReason="TIME_TAKEN"
statusCode="200"
triggerStatusCode="0"
timeTaken="10047"
xmlns:freb="http://schemas.microsoft.com/win/2006/06/iis/freb"
>
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="WWW Server" Guid="{3A2A4E84-4C21-4981-AE10-3FDA0D9B0F83}"/>
<EventID>0</EventID>
<Version>1</Version>
<Level>0</Level>
<Opcode>1</Opcode>
<Keywords>0x0</Keywords>
<TimeCreated SystemTime="2020-10-29T21:16:48.320Z"/>
<Correlation ActivityID="{80000002-0005-F300-B63F-84710C7967BB}"/>
<Execution ProcessID="9916" ThreadID="23540"/>
<Computer>NEBULA</Computer>
</System>
<RenderingInfo Culture="en-US">
<Opcode>NOTIFY_MODULE_START</Opcode>
<Keywords>
<Keyword>RequestNotifications</Keyword>
</Keywords>
<freb:Description Data="Notification">UPDATE_REQUEST_CACHE</freb:Description>
</RenderingInfo>
<ExtendedTracingInfo xmlns="http://schemas.microsoft.com/win/2004/08/events/trace">
<EventGuid>{002E91E3-E7AE-44AB-8E07-99230FFA6ADE}</EventGuid>
</ExtendedTracingInfo>
</Event>
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="WWW Server" Guid="{3A2A4E84-4C21-4981-AE10-3FDA0D9B0F83}"/>
<EventID>0</EventID>
<Version>1</Version>
<Level>4</Level>
<Opcode>17</Opcode>
<Keywords>0x80</Keywords>
<TimeCreated SystemTime="2020-10-29T21:16:48.320Z"/>
<Correlation ActivityID="{80000002-0005-F300-B63F-84710C7967BB}"/>
<Execution ProcessID="9916" ThreadID="23540"/>
<Computer>NEBULA</Computer>
</System>
<EventData>
<Data Name="ContextId">{80000002-0005-F300-B63F-84710C7967BB}</Data>
<Data Name="CachePolicy">0</Data>
<Data Name="TimeToLive">0</Data>
</EventData>
<RenderingInfo Culture="en-US">
<Opcode>OUTPUT_CACHE_UPDATE_START</Opcode>
<Keywords>
<Keyword>Cache</Keyword>
</Keywords>
<freb:Description Data="CachePolicy">NO_CACHE</freb:Description>
</RenderingInfo>
<ExtendedTracingInfo xmlns="http://schemas.microsoft.com/win/2004/08/events/trace">
<EventGuid>{AC1D69F1-BF33-4CA0-9313-BCA13873E1DC}</EventGuid>
</ExtendedTracingInfo>
</Event>
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="WWW Server" Guid="{3A2A4E84-4C21-4981-AE10-3FDA0D9B0F83}"/>
<EventID>0</EventID>
<Version>1</Version>
<Level>4</Level>
<Opcode>18</Opcode>
<Keywords>0x80</Keywords>
<TimeCreated SystemTime="2020-10-29T21:16:48.320Z"/>
<Correlation ActivityID="{80000002-0005-F300-B63F-84710C7967BB}"/>
<Execution ProcessID="9916" ThreadID="23540"/>
<Computer>NEBULA</Computer>
</System>
<EventData>
<Data Name="ContextId">{80000002-0005-F300-B63F-84710C7967BB}</Data>
<Data Name="Result">2</Data>
</EventData>
<RenderingInfo Culture="en-US">
<Opcode>OUTPUT_CACHE_UPDATE_END</Opcode>
<Keywords>
<Keyword>Cache</Keyword>
</Keywords>
<freb:Description Data="Result">NOT_FREQUENTLY_HIT</freb:Description>
</RenderingInfo>
<ExtendedTracingInfo xmlns="http://schemas.microsoft.com/win/2004/08/events/trace">
<EventGuid>{AC1D69F1-BF33-4CA0-9313-BCA13873E1DC}</EventGuid>
</ExtendedTracingInfo>
</Event>
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="WWW Server" Guid="{3A2A4E84-4C21-4981-AE10-3FDA0D9B0F83}"/>
<EventID>0</EventID>
<Version>1</Version>
<Level>5</Level>
<Opcode>2</Opcode>
<Keywords>0x100</Keywords>
<TimeCreated SystemTime="2020-10-29T21:16:48.320Z"/>
<Correlation ActivityID="{80000002-0005-F300-B63F-84710C7967BB}"/>
<Execution ProcessID="9916" ThreadID="23540"/>
<Computer>NEBULA</Computer>
</System>
<EventData>
<Data Name="ContextId">{80000002-0005-F300-B63F-84710C7967BB}</Data>
<Data Name="ModuleName">HttpCacheModule</Data>
<Data Name="Notification">512</Data>
<Data Name="fIsPostNotificationEvent">false</Data>
<Data Name="NotificationStatus">0</Data>
</EventData>
<RenderingInfo Culture="en-US">
<Opcode>NOTIFY_MODULE_END</Opcode>
<Keywords>
<Keyword>RequestNotifications</Keyword>
</Keywords>
<freb:Description Data="Notification">UPDATE_REQUEST_CACHE</freb:Description>
<freb:Description Data="NotificationStatus">NOTIFICATION_CONTINUE</freb:Description>
</RenderingInfo>
<ExtendedTracingInfo xmlns="http://schemas.microsoft.com/win/2004/08/events/trace">
<EventGuid>{002E91E3-E7AE-44AB-8E07-99230FFA6ADE}</EventGuid>
</ExtendedTracingInfo>
</Event>
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="WWW Server" Guid="{3A2A4E84-4C21-4981-AE10-3FDA0D9B0F83}"/>
<EventID>0</EventID>
<Version>1</Version>
<Level>5</Level>
<Opcode>1</Opcode>
<Keywords>0x100</Keywords>
<TimeCreated SystemTime="2020-10-29T21:16:48.320Z"/>
<Correlation ActivityID="{80000002-0005-F300-B63F-84710C7967BB}"/>
<Execution ProcessID="9916" ThreadID="23540"/>
<Computer>NEBULA</Computer>
</System>
<EventData>
<Data Name="ContextId">{80000002-0005-F300-B63F-84710C7967BB}</Data>
<Data Name="ModuleName">CustomLoggingModule</Data>
<Data Name="Notification">1024</Data>
<Data Name="fIsPostNotification">false</Data>
</EventData>
<RenderingInfo Culture="en-US">
<Opcode>NOTIFY_MODULE_START</Opcode>
<Keywords>
<Keyword>RequestNotifications</Keyword>
</Keywords>
<freb:Description Data="Notification">LOG_REQUEST</freb:Description>
</RenderingInfo>
<ExtendedTracingInfo xmlns="http://schemas.microsoft.com/win/2004/08/events/trace">
<EventGuid>{002E91E3-E7AE-44AB-8E07-99230FFA6ADE}</EventGuid>
</ExtendedTracingInfo>
</Event>
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="WWW Server" Guid="{3A2A4E84-4C21-4981-AE10-3FDA0D9B0F83}"/>
<EventID>0</EventID>
<Version>1</Version>
<Level>5</Level>
<Opcode>2</Opcode>
<Keywords>0x100</Keywords>
<TimeCreated SystemTime="2020-10-29T21:16:48.320Z"/>
<Correlation ActivityID="{80000002-0005-F300-B63F-84710C7967BB}"/>
<Execution ProcessID="9916" ThreadID="23540"/>
<Computer>NEBULA</Computer>
</System>
<EventData>
<Data Name="ContextId">{80000002-0005-F300-B63F-84710C7967BB}</Data>
<Data Name="ModuleName">CustomLoggingModule</Data>
<Data Name="Notification">1024</Data>
<Data Name="fIsPostNotificationEvent">false</Data>
<Data Name="NotificationStatus">0</Data>
</EventData>
<RenderingInfo Culture="en-US">
<Opcode>NOTIFY_MODULE_END</Opcode>
<Keywords>
<Keyword>RequestNotifications</Keyword>
</Keywords>
<freb:Description Data="Notification">LOG_REQUEST</freb:Description>
<freb:Description Data="NotificationStatus">NOTIFICATION_CONTINUE</freb:Description>
</RenderingInfo>
<ExtendedTracingInfo xmlns="http://schemas.microsoft.com/win/2004/08/events/trace">
<EventGuid>{002E91E3-E7AE-44AB-8E07-99230FFA6ADE}</EventGuid>
</ExtendedTracingInfo>
</Event>
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="WWW Server" Guid="{3A2A4E84-4C21-4981-AE10-3FDA0D9B0F83}"/>
<EventID>0</EventID>
<Version>1</Version>
<Level>5</Level>
<Opcode>1</Opcode>
<Keywords>0x100</Keywords>
<TimeCreated SystemTime="2020-10-29T21:16:48.320Z"/>
<Correlation ActivityID="{80000002-0005-F300-B63F-84710C7967BB}"/>
<Execution ProcessID="9916" ThreadID="23540"/>
<Computer>NEBULA</Computer>
</System>
<EventData>
<Data Name="ContextId">{80000002-0005-F300-B63F-84710C7967BB}</Data>
<Data Name="ModuleName">HttpLoggingModule</Data>
<Data Name="Notification">536870912</Data>
<Data Name="fIsPostNotification">false</Data>
</EventData>
<RenderingInfo Culture="en-US">
<Opcode>NOTIFY_MODULE_START</Opcode>
<Keywords>
<Keyword>RequestNotifications</Keyword>
</Keywords>
<freb:Description Data="Notification">SEND_RESPONSE</freb:Description>
</RenderingInfo>
<ExtendedTracingInfo xmlns="http://schemas.microsoft.com/win/2004/08/events/trace">
<EventGuid>{002E91E3-E7AE-44AB-8E07-99230FFA6ADE}</EventGuid>
</ExtendedTracingInfo>
</Event>
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="WWW Server" Guid="{3A2A4E84-4C21-4981-AE10-3FDA0D9B0F83}"/>
<EventID>0</EventID>
<Version>1</Version>
<Level>5</Level>
<Opcode>2</Opcode>
<Keywords>0x100</Keywords>
<TimeCreated SystemTime="2020-10-29T21:16:48.320Z"/>
<Correlation ActivityID="{80000002-0005-F300-B63F-84710C7967BB}"/>
<Execution ProcessID="9916" ThreadID="23540"/>
<Computer>NEBULA</Computer>
</System>
<EventData>
<Data Name="ContextId">{80000002-0005-F300-B63F-84710C7967BB}</Data>
<Data Name="ModuleName">HttpLoggingModule</Data>
<Data Name="Notification">536870912</Data>
<Data Name="fIsPostNotificationEvent">false</Data>
<Data Name="NotificationStatus">0</Data>
</EventData>
<RenderingInfo Culture="en-US">
<Opcode>NOTIFY_MODULE_END</Opcode>
<Keywords>
<Keyword>RequestNotifications</Keyword>
</Keywords>
<freb:Description Data="Notification">SEND_RESPONSE</freb:Description>
<freb:Description Data="NotificationStatus">NOTIFICATION_CONTINUE</freb:Description>
</RenderingInfo>
<ExtendedTracingInfo xmlns="http://schemas.microsoft.com/win/2004/08/events/trace">
<EventGuid>{002E91E3-E7AE-44AB-8E07-99230FFA6ADE}</EventGuid>
</ExtendedTracingInfo>
</Event>
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="WWW Server" Guid="{3A2A4E84-4C21-4981-AE10-3FDA0D9B0F83}"/>
<EventID>0</EventID>
<Version>1</Version>
<Level>5</Level>
<Opcode>1</Opcode>
<Keywords>0x100</Keywords>
<TimeCreated SystemTime="2020-10-29T21:16:48.320Z"/>
<Correlation ActivityID="{80000002-0005-F300-B63F-84710C7967BB}"/>
<Execution ProcessID="9916" ThreadID="23540"/>
<Computer>NEBULA</Computer>
</System>
<EventData>
<Data Name="ContextId">{80000002-0005-F300-B63F-84710C7967BB}</Data>
<Data Name="ModuleName">ProtocolSupportModule</Data>
<Data Name="Notification">536870912</Data>
<Data Name="fIsPostNotification">false</Data>
</EventData>
<RenderingInfo Culture="en-US">
<Opcode>NOTIFY_MODULE_START</Opcode>
<Keywords>
<Keyword>RequestNotifications</Keyword>
</Keywords>
<freb:Description Data="Notification">SEND_RESPONSE</freb:Description>
</RenderingInfo>
<ExtendedTracingInfo xmlns="http://schemas.microsoft.com/win/2004/08/events/trace">
<EventGuid>{002E91E3-E7AE-44AB-8E07-99230FFA6ADE}</EventGuid>
</ExtendedTracingInfo>
</Event>
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="WWW Server" Guid="{3A2A4E84-4C21-4981-AE10-3FDA0D9B0F83}"/>
<EventID>0</EventID>
<Version>1</Version>
<Level>5</Level>
<Opcode>2</Opcode>
<Keywords>0x100</Keywords>
<TimeCreated SystemTime="2020-10-29T21:16:48.320Z"/>
<Correlation ActivityID="{80000002-0005-F300-B63F-84710C7967BB}"/>
<Execution ProcessID="9916" ThreadID="23540"/>
<Computer>NEBULA</Computer>
</System>
<EventData>
<Data Name="ContextId">{80000002-0005-F300-B63F-84710C7967BB}</Data>
<Data Name="ModuleName">ProtocolSupportModule</Data>
<Data Name="Notification">536870912</Data>
<Data Name="fIsPostNotificationEvent">false</Data>
<Data Name="NotificationStatus">0</Data>
</EventData>
<RenderingInfo Culture="en-US">
<Opcode>NOTIFY_MODULE_END</Opcode>
<Keywords>
<Keyword>RequestNotifications</Keyword>
</Keywords>
<freb:Description Data="Notification">SEND_RESPONSE</freb:Description>
<freb:Description Data="NotificationStatus">NOTIFICATION_CONTINUE</freb:Description>
</RenderingInfo>
<ExtendedTracingInfo xmlns="http://schemas.microsoft.com/win/2004/08/events/trace">
<EventGuid>{002E91E3-E7AE-44AB-8E07-99230FFA6ADE}</EventGuid>
</ExtendedTracingInfo>
</Event>
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="WWW Server" Guid="{3A2A4E84-4C21-4981-AE10-3FDA0D9B0F83}"/>
<EventID>0</EventID>
<Version>1</Version>
<Level>5</Level>
<Opcode>1</Opcode>
<Keywords>0x100</Keywords>
<TimeCreated SystemTime="2020-10-29T21:16:48.320Z"/>
<Correlation ActivityID="{80000002-0005-F300-B63F-84710C7967BB}"/>
<Execution ProcessID="9916" ThreadID="23540"/>
<Computer>NEBULA</Computer>
</System>
<EventData>
<Data Name="ContextId">{80000002-0005-F300-B63F-84710C7967BB}</Data>
<Data Name="ModuleName">HttpCacheModule</Data>
<Data Name="Notification">536870912</Data>
<Data Name="fIsPostNotification">false</Data>
</EventData>
<RenderingInfo Culture="en-US">
<Opcode>NOTIFY_MODULE_START</Opcode>
<Keywords>
<Keyword>RequestNotifications</Keyword>
</Keywords>
<freb:Description Data="Notification">SEND_RESPONSE</freb:Description>
</RenderingInfo>
<ExtendedTracingInfo xmlns="http://schemas.microsoft.com/win/2004/08/events/trace">
<EventGuid>{002E91E3-E7AE-44AB-8E07-99230FFA6ADE}</EventGuid>
</ExtendedTracingInfo>
</Event>
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="WWW Server" Guid="{3A2A4E84-4C21-4981-AE10-3FDA0D9B0F83}"/>
<EventID>0</EventID>
<Version>1</Version>
<Level>5</Level>
<Opcode>2</Opcode>
<Keywords>0x100</Keywords>
<TimeCreated SystemTime="2020-10-29T21:16:48.320Z"/>
<Correlation ActivityID="{80000002-0005-F300-B63F-84710C7967BB}"/>
<Execution ProcessID="9916" ThreadID="23540"/>
<Computer>NEBULA</Computer>
</System>
<EventData>
<Data Name="ContextId">{80000002-0005-F300-B63F-84710C7967BB}</Data>
<Data Name="ModuleName">HttpCacheModule</Data>
<Data Name="Notification">536870912</Data>
<Data Name="fIsPostNotificationEvent">false</Data>
<Data Name="NotificationStatus">0</Data>
</EventData>
<RenderingInfo Culture="en-US">
<Opcode>NOTIFY_MODULE_END</Opcode>
<Keywords>
<Keyword>RequestNotifications</Keyword>
</Keywords>
<freb:Description Data="Notification">SEND_RESPONSE</freb:Description>
<freb:Description Data="NotificationStatus">NOTIFICATION_CONTINUE</freb:Description>
</RenderingInfo>
<ExtendedTracingInfo xmlns="http://schemas.microsoft.com/win/2004/08/events/trace">
<EventGuid>{002E91E3-E7AE-44AB-8E07-99230FFA6ADE}</EventGuid>
</ExtendedTracingInfo>
</Event>
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="WWW Server" Guid="{3A2A4E84-4C21-4981-AE10-3FDA0D9B0F83}"/>
<EventID>0</EventID>
<Version>1</Version>
<Level>4</Level>
<Opcode>14</Opcode>
<Keywords>0x80</Keywords>
<TimeCreated SystemTime="2020-10-29T21:16:48.320Z"/>
<Correlation ActivityID="{80000002-0005-F300-B63F-84710C7967BB}"/>
<Execution ProcessID="9916" ThreadID="23540"/>
<Computer>NEBULA</Computer>
</System>
<EventData>
<Data Name="ContextId">{80000002-0005-F300-B63F-84710C7967BB}</Data>
<Data Name="HttpsysCacheable">false</Data>
<Data Name="Reason">23</Data>
<Data Name="CachePolicy">0</Data>
<Data Name="TimeToLive">0</Data>
</EventData>
<RenderingInfo Culture="en-US">
<Opcode>HTTPSYS_CACHEABLE</Opcode>
<Keywords>
<Keyword>Cache</Keyword>
</Keywords>
<freb:Description Data="Reason">NO_CACHE_INVALIDATOR</freb:Description>
<freb:Description Data="CachePolicy">NO_CACHE</freb:Description>
</RenderingInfo>
<ExtendedTracingInfo xmlns="http://schemas.microsoft.com/win/2004/08/events/trace">
<EventGuid>{AC1D69F1-BF33-4CA0-9313-BCA13873E1DC}</EventGuid>
</ExtendedTracingInfo>
</Event>
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="WWW Server" Guid="{3A2A4E84-4C21-4981-AE10-3FDA0D9B0F83}"/>
<EventID>0</EventID>
<Version>1</Version>
<Level>4</Level>
<Opcode>35</Opcode>
<Keywords>0x0</Keywords>
<TimeCreated SystemTime="2020-10-29T21:16:48.320Z"/>
<Correlation ActivityID="{80000002-0005-F300-B63F-84710C7967BB}"/>
<Execution ProcessID="9916" ThreadID="23540"/>
<Computer>NEBULA</Computer>
</System>
<EventData>
<Data Name="ContextId">{80000002-0005-F300-B63F-84710C7967BB}</Data>
</EventData>
<RenderingInfo Culture="en-US">
<Opcode>GENERAL_FLUSH_RESPONSE_START</Opcode>
</RenderingInfo>
<ExtendedTracingInfo xmlns="http://schemas.microsoft.com/win/2004/08/events/trace">
<EventGuid>{D42CF7EF-DE92-473E-8B6C-621EA663113A}</EventGuid>
</ExtendedTracingInfo>
</Event>
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="WWW Server" Guid="{3A2A4E84-4C21-4981-AE10-3FDA0D9B0F83}"/>
<EventID>0</EventID>
<Version>1</Version>
<Level>4</Level>
<Opcode>47</Opcode>
<Keywords>0x0</Keywords>
<TimeCreated SystemTime="2020-10-29T21:16:48.320Z"/>
<Correlation ActivityID="{80000002-0005-F300-B63F-84710C7967BB}"/>
<Execution ProcessID="9916" ThreadID="23540"/>
<Computer>NEBULA</Computer>
</System>
<EventData>
<Data Name="ContextId">{80000002-0005-F300-B63F-84710C7967BB}</Data>
<Data Name="Headers">Content-Type: image/png
Last-Modified: Thu, 22 Oct 2020 19:11:06 GMT
Accept-Ranges: bytes
ETag: "37b28017a7a8d61:0"
Server: Microsoft-IIS/10.0
</Data>
</EventData>
<RenderingInfo Culture="en-US">
<Opcode>GENERAL_RESPONSE_HEADERS</Opcode>
</RenderingInfo>
<ExtendedTracingInfo xmlns="http://schemas.microsoft.com/win/2004/08/events/trace">
<EventGuid>{D42CF7EF-DE92-473E-8B6C-621EA663113A}</EventGuid>
</ExtendedTracingInfo>
</Event>
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="WWW Server" Guid="{3A2A4E84-4C21-4981-AE10-3FDA0D9B0F83}"/>
<EventID>0</EventID>
<Version>1</Version>
<Level>5</Level>
<Opcode>48</Opcode>
<Keywords>0x0</Keywords>
<TimeCreated SystemTime="2020-10-29T21:16:48.320Z"/>
<Correlation ActivityID="{80000002-0005-F300-B63F-84710C7967BB}"/>
<Execution ProcessID="9916" ThreadID="23540"/>
<Computer>NEBULA</Computer>
</System>
<EventData>
<Data Name="ContextId">{80000002-0005-F300-B63F-84710C7967BB}</Data>
<Data Name="FileName">\\?\C:\inetpub\wwwroot\iisstart.png</Data>
<Data Name="Offset">0</Data>
<Data Name="Size">98757</Data>
</EventData>
<RenderingInfo Culture="en-US">
<Opcode>GENERAL_RESPONSE_ENTITY_FILE</Opcode>
</RenderingInfo>
<ExtendedTracingInfo xmlns="http://schemas.microsoft.com/win/2004/08/events/trace">
<EventGuid>{D42CF7EF-DE92-473E-8B6C-621EA663113A}</EventGuid>
</ExtendedTracingInfo>
</Event>
</failedRequest>