Should I worry about Timer_ConnectionIdle entries in HTTPERR Log?

  • Article

While helping customers troubleshooting HTTP-related error, a common question that we face: What is Timer_ConnectionIdle (as we see a lot of them in the HTTPERR log)?, and is this something to worry about?

Here is an excerpts from the HTTPERR log:

2016-07-05 18:45:09 172.31.77.6 2094 172.31.77.6 80 HTTP/1.1 GET /qos/1kbfile.txt 503 – ConnLimit

2016-07-05 19:51:59 127.0.0.1 2780 127.0.0.1 80 HTTP/1.1 GET /ThisIsMyUrl.htm 400 – Hostname

2016-07-05 19:53:00 127.0.0.1 2894 127.0.0.1 80 HTTP/2.0 GET / 505 - Version_N/S

2016-07-05 20:06:01 172.31.77.6 64388 127.0.0.1 80 - - - - - Timer_ConnectionIdle

In case you are new to troubleshooting HTTPERR, here is a quick overview: HTTP.sys is the Kernel-mode HTTP/HTTPS protocol listener and it's activities are logged into %SystemRoot%\system32\LogFiles\HTTPERR\  (e.g. C:\Windows\System32\LogFiles\HTTPERR). The HTTP API logs error-responses to clients, connection time-outs, orphaned requests, and dropped connections that are handled incorrectly. Specific error types are designated by Reason Phrase strings that always appear as the last field of each error line, this is where you find the Timer_ConnectionIdle entries.

In general, you shouldn't be worried about Timer_ConnectionIdle which indicates that the connection remains idle as the client hopes that soon there will be another client-server interactions as the end-user may click on a link and perform some activities within next two minutes (The default ConnectionTimeout duration is two minutes).