Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I recently found that one of my IIS 7.5 sites (on Win 2008 R2) had been down and out (Stopped). While I'm now trying out a servers alive kind of service, I began wondering when and why was it down.

It's possible that during some routine maintenance I forgot it or accidentally stopped when trying to stop another site but I really would want to know when it was stopped and any other information that I could find. Is there a log I could check? The IIS Logs appear to only have Requests logged, which don't really help here.

share|improve this question

2 Answers 2

up vote 2 down vote accepted

Check if either the IIS log file has rolled over due to a restart of an instance (or if there is a new date/time entry line) and do the same for the HTTPERR log file (located roughly here C:\Windows\System32\LogFiles\HTTPERR) This will just give you a rought estimate of when the site went down.

share|improve this answer
    
Thanks for the answer, I have a few questions. In HTTPERR log, how would I differentiate which line is from which site? The s-siteid is "-" for all entries. Also, I do see new date/time entry lines, it appears that someone booted the entire server at that point so I guess I'll have to dig a little deeper. The site should have automatically started even if the server reboots but I guess it just didn't. –  Nenotlep Nov 20 '12 at 14:15
    
Looks like at that point in time the site id was unavailable for logging. (see example at microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/…) You would have to look in the Eventlog at that time to find more information. Maybe somebody remotely shutdown the server? Maybe an IIS patch was applied via SCCM that caused the server to boot? That can happen withn non-OS patches. –  hot2use Nov 20 '12 at 14:40

Yes - setup the built-in Health Monitoring! It's free, and very easy. Health Monitoring enables logging of the reasons why an application pool stopped/recycled, and it can also be configured to log a heartbeat.

Web.config example:

  <system.web>
    <healthMonitoring enabled="true" heartbeatInterval="1">
      <rules>
        <add name="HeartBeat"
             eventName="Heartbeats"
             provider="EventLogProvider"
             profile="Default"
             minInstances="1"
             minInterval="00:01:00"
             maxLimit="Infinite"/>
        <add name="App Lifetime"
             eventName="Application Lifetime Events"
             provider="EventLogProvider"
             profile="Default"
             minInstances="1"
             minInterval="00:00:00"
             maxLimit="Infinite"/>
      </rules>
    </healthMonitoring>
  </system.web>
share|improve this answer
    
Thanks for the example, I'll be sure to add this to a site and monitor the event log to see exactly what I get. It's so incredibly hard to browse through the event log entries that this might be a very great help indeed. I was trying to look for something that could tell me when/how it happened that time but this could help me in the future :) –  Nenotlep Nov 20 '12 at 14:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.