0

I am trying to figure out why a Windows 2008 server became inaccessible in terms of RDP and access to a web application. The server was turned off and then on. Look at the event log at the time it went offline, I can't find anything. And looking at misc application logs, the system was running like normal after it went offline. It has to be said that by mistake the firewall was switched off earlier, so a lot of attempts had been done to access the SQL Server with the sa user as well as RDP login. But the attempts has been going on for days, so nothing new about that. Besides the event logs, is there anywhere else I can go to examine the cause of this?

I am also in doubt whether or not a DOS attack or similar would show up in the event log. From a log for a backup application running on this server I can see that an attempt was done to access a remote IP after the server went offline, but got no connection.

Improve this question
1
  • Still hoping for some hints on this on how I can proceed investigating this. For instance, in case of a DoS attack, is it likely that an application running on the server would not get internet connection?
    – Rob
    Jan 18, 2011 at 9:08

2 Answers 2

Reset to default
1

If the machine actually shut down you might find a memory dump file in C:\Windows or C:\Windows\System32 It would be called Memory.DMP and you could download the Microsoft Crash analyzer tools and explore the dump file.

Improve this answer
1
  • No, it did not shut down. It just went offline. Since it is hosted, the only possibility was to switch it off and then on.
    – Rob
    Jan 14, 2011 at 19:16
0

If it's hardware from a tier-1 server, you may find something in their logs. On HP, this is the ASR log, I believe is the correct terminology.

Improve this answer
1
  • It's a Dell, but has no extra logging capabilities as far as I can see
    – Rob
    Jan 14, 2011 at 19:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .