3

I recently found that one of my IIS 7.5 sites (on Win 2008 R2) had been down and out (Stopped). While I'm now trying out a servers alive kind of service, I began wondering when and why was it down.

It's possible that during some routine maintenance I forgot it or accidentally stopped when trying to stop another site but I really would want to know when it was stopped and any other information that I could find. Is there a log I could check? The IIS Logs appear to only have Requests logged, which don't really help here.

2 Answers 2

3

Check if either the IIS log file has rolled over due to a restart of an instance (or if there is a new date/time entry line) and do the same for the HTTPERR log file (located roughly here C:\Windows\System32\LogFiles\HTTPERR) This will just give you a rought estimate of when the site went down.

2
  • Thanks for the answer, I have a few questions. In HTTPERR log, how would I differentiate which line is from which site? The s-siteid is "-" for all entries. Also, I do see new date/time entry lines, it appears that someone booted the entire server at that point so I guess I'll have to dig a little deeper. The site should have automatically started even if the server reboots but I guess it just didn't. Nov 20, 2012 at 14:15
  • Looks like at that point in time the site id was unavailable for logging. (see example at microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/…) You would have to look in the Eventlog at that time to find more information. Maybe somebody remotely shutdown the server? Maybe an IIS patch was applied via SCCM that caused the server to boot? That can happen withn non-OS patches.
    – John K. N.
    Nov 20, 2012 at 14:40
3

Yes - setup the built-in Health Monitoring! It's free, and very easy. Health Monitoring enables logging of the reasons why an application pool stopped/recycled, and it can also be configured to log a heartbeat.

Web.config example:

  <system.web>
    <healthMonitoring enabled="true" heartbeatInterval="1">
      <rules>
        <add name="HeartBeat"
             eventName="Heartbeats"
             provider="EventLogProvider"
             profile="Default"
             minInstances="1"
             minInterval="00:01:00"
             maxLimit="Infinite"/>
        <add name="App Lifetime"
             eventName="Application Lifetime Events"
             provider="EventLogProvider"
             profile="Default"
             minInstances="1"
             minInterval="00:00:00"
             maxLimit="Infinite"/>
      </rules>
    </healthMonitoring>
  </system.web>
1
  • Thanks for the example, I'll be sure to add this to a site and monitor the event log to see exactly what I get. It's so incredibly hard to browse through the event log entries that this might be a very great help indeed. I was trying to look for something that could tell me when/how it happened that time but this could help me in the future :) Nov 20, 2012 at 14:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .