I am trying to figure out why a Windows 2008 server became inaccessible in terms of RDP and access to a web application. The server was turned off and then on. Look at the event log at the time it went offline, I can't find anything. And looking at misc application logs, the system was running like normal after it went offline. It has to be said that by mistake the firewall was switched off earlier, so a lot of attempts had been done to access the SQL Server with the sa user as well as RDP login. But the attempts has been going on for days, so nothing new about that. Besides the event logs, is there anywhere else I can go to examine the cause of this?

I am also in doubt whether or not a DOS attack or similar would show up in the event log. From a log for a backup application running on this server I can see that an attempt was done to access a remote IP after the server went offline, but got no connection.

  • Still hoping for some hints on this on how I can proceed investigating this. For instance, in case of a DoS attack, is it likely that an application running on the server would not get internet connection? – Rob Jan 18 '11 at 9:08

If the machine actually shut down you might find a memory dump file in C:\Windows or C:\Windows\System32 It would be called Memory.DMP and you could download the Microsoft Crash analyzer tools and explore the dump file.

  • No, it did not shut down. It just went offline. Since it is hosted, the only possibility was to switch it off and then on. – Rob Jan 14 '11 at 19:16

If it's hardware from a tier-1 server, you may find something in their logs. On HP, this is the ASR log, I believe is the correct terminology.

  • It's a Dell, but has no extra logging capabilities as far as I can see – Rob Jan 14 '11 at 19:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.