3

I recently found that one of my IIS 7.5 sites (on Win 2008 R2) had been down and out (Stopped). While I'm now trying out a servers alive kind of service, I began wondering when and why was it down.

It's possible that during some routine maintenance I forgot it or accidentally stopped when trying to stop another site but I really would want to know when it was stopped and any other information that I could find. Is there a log I could check? The IIS Logs appear to only have Requests logged, which don't really help here.

Joel Peltonen
  • 169
  • 1
  • 2
  • 9

2 Answers2

3

Yes - setup the built-in Health Monitoring! It's free, and very easy. Health Monitoring enables logging of the reasons why an application pool stopped/recycled, and it can also be configured to log a heartbeat.

Web.config example: 

  <system.web>
    <healthMonitoring enabled="true" heartbeatInterval="1">
      <rules>
        <add name="HeartBeat"
             eventName="Heartbeats"
             provider="EventLogProvider"
             profile="Default"
             minInstances="1"
             minInterval="00:01:00"
             maxLimit="Infinite"/>
        <add name="App Lifetime"
             eventName="Application Lifetime Events"
             provider="EventLogProvider"
             profile="Default"
             minInstances="1"
             minInterval="00:00:00"
             maxLimit="Infinite"/>
      </rules>
    </healthMonitoring>
  </system.web>
Greg Askew
  • 35,880
  • 5
  • 54
  • 82
  • Thanks for the example, I'll be sure to add this to a site and monitor the event log to see exactly what I get. It's so incredibly hard to browse through the event log entries that this might be a very great help indeed. I was trying to look for something that could tell me when/how it happened that time but this could help me in the future :) – Joel Peltonen Nov 20 '12 at 14:11
3

Check if either the IIS log file has rolled over due to a restart of an instance (or if there is a new date/time entry line) and do the same for the HTTPERR log file (located roughly here C:\Windows\System32\LogFiles\HTTPERR) This will just give you a rought estimate of when the site went down.

John K. N.
  • 2,055
  • 1
  • 17
  • 28
  • Thanks for the answer, I have a few questions. In HTTPERR log, how would I differentiate which line is from which site? The s-siteid is "-" for all entries. Also, I do see new date/time entry lines, it appears that someone booted the entire server at that point so I guess I'll have to dig a little deeper. The site should have automatically started even if the server reboots but I guess it just didn't. – Joel Peltonen Nov 20 '12 at 14:15
  • Looks like at that point in time the site id was unavailable for logging. (see example at http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/676400bc-8969-4aa7-851a-9319490a9bbb.mspx?mfr=true) You would have to look in the Eventlog at that time to find more information. Maybe somebody remotely shutdown the server? Maybe an IIS patch was applied via SCCM that caused the server to boot? That can happen withn non-OS patches. – John K. N. Nov 20 '12 at 14:40