Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a website that has been stopped and trying to figure out how long it has been down and if it was shutdown intentionally or not.

share|improve this question
Do you have access to the host which was running the webserver? – Hennes Dec 6 '12 at 20:49
@Hennes: yes I do have access. I don't see anything in the event viewer...unless I'm overlooking something. – JaJ Dec 6 '12 at 20:56
Have you checked inetpub\logs\LogFiles or similar directory for log? – Cool Dec 6 '12 at 21:10
The log files (eventviewer and IIS ones) where indeed what I was going to ask next. My only other idea is file change dates, but that assumed that something either modifies files in your webdir, or that you store some information in a database. – Hennes Dec 6 '12 at 21:12
@Hennes: Thx for the replies...I'll keep digging through the event viewer and logs to see if I see something but I definitely don't see anything. New to IIS so I was hoping for an easy way to get the uptime/stopped and other information for a service. – JaJ Dec 6 '12 at 21:23
up vote 2 down vote accepted

The short answer for the outage duration part is "not a GOOD way..." -- what you really need is a monitoring system that tells you when your server is down (and when it comes back up again).
The good ones will give you outage reports, percent uptime/availability, etc.

In the absence of a monitoring system you can use log files (when did the access log stop? When did it start showing activity again?), file access/change dates (logs, timestamps on uploaded files, etc.) to approximate things.
Your server's access log is probably the best bet, but the resolution is only as good as server activity (if you get 1-2 queries per hour you've got a pretty wide band for your start of outage).

For the cause, your server's logs should also show if the shutdown was intentional (orderly shutdown initiated by a user) or unintentional/unclean (some kind of crash error message).
You can also look at login records to see if anyone was on the system at the time the web server went down.

share|improve this answer
thanks for the information! – JaJ Dec 6 '12 at 21:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.