Solved

Server Uptime/Downtime logs

Posted on 2006-06-28
14
511 Views
Last Modified: 2008-02-01
Hi,
Does anyone know if there is a historical log anywhere in the system of when a Win2000 server boots up or is taken down/crashes!

I need to go back to the beginning of this year if at all possible!

Thanks and Regards
Mark
0
Comment
Question by:aark-it
14 Comments
 
LVL 13

Expert Comment

by:rhickmott
ID: 17000260
If you look at the System Log it should will tell you this information im not sure it will go as far back as that though.

right Click My Computer > Manage > System tools > Event Viewer > System

Yourr after Event 6009.


Event 6005 is logged at boot time noting that the Event Log service was started. It gives the message "The Event log service was started".
• Event 6006 is logged as a clean shutdown. It gives the message "The Event log service was stopped".
• Event 6008 is logged as a dirty shutdown. It gives the message "The previous system shutdown at time on date was unexpected".
• Event 6009 is logged during every boot and indicates the operating system version, build number, service pack level, and other pertinent information about the system. Depending on your current configuration, it gives a message similar to: "Microsoft (R) Windows NT 4.0 1381 Service Pack 6 Multiprocessor free".
0
 
LVL 43

Expert Comment

by:Steve Knight
ID: 17000576
Current startup time can be seen with

net stats server

but that doesn't help with historic info. of course

On an ongoing basis you could setup a peformance monitor log to run once daily say to write uptime to a CSV file.

Steve
0
 
LVL 11

Expert Comment

by:elbereth21
ID: 17001873
You can download and use uptime.exe from microsoft:
http://www.microsoft.com/ntserver/nts/downloads/management/uptime/default.asp
0
 

Author Comment

by:aark-it
ID: 17007818
Thanks for the info guys,
I've checked the System Event log and it only goes back to 3rd June 2006, so the historical data I need isn't there.
Net Stats is ok for current uptime, but thats not what I need.
UPTIME looks like a valuable tool, but again, it only accesses data from the event log so only goes back to the beginning of this month.

Is there no where else I might be able to retrieve this very much needed information from?

Thanks in Advance and Regards
Mark
0
 
LVL 43

Expert Comment

by:Steve Knight
ID: 17008652
Not as far as I know.  As I said if I were having to do it I'd setup perfmon to do it now then you can the next load of data easily.  If your event logs have old data removed then the only way I can think of is restoring previous versions of event log from backup, must be doable but I've never tried.  There may be other log files you could check such as IIS logs or logs from any apps running on there that may record startup etc.    Suggest restarting box then search for all files chabged today and if you are lucky some app or another will be recording startups in its log.


0
 

Author Comment

by:aark-it
ID: 17010069
Thanks dragon-it,
I'll give that a go later when all users have gone home and let you know what I come up with.

Mark
0
 

Author Comment

by:aark-it
ID: 17036128
Hi dragon-it,
I have found some IIS reports that date back to march, but I dont know what I'm looking at.
Is there any way I can attach one of the files so you could look at it for me, or do I need to copy and paste the information into this window?

thanks again
Mark
0
How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

 
LVL 43

Expert Comment

by:Steve Knight
ID: 17036865
No way  I know of to attach - you can email address in my profile if you like.  Will post here if there is anything useful in there. Steve
0
 
LVL 43

Expert Comment

by:Steve Knight
ID: 17038797
You will find in the logs every time the headings are repeated such as this then the server, or at least the web service, has been restarted:

#Software: Microsoft Internet Information Services 5.0
#Version: 1.0
#Date: 2006-03-14 10:22:52
#Fields: date time c-ip cs-username s-ip s-port cs-method cs-uri-stem cs-uri-query sc-status cs(User-Agent)

So for instance from some of the logs you sent the server probably rebooted:

2006-03-10 08:25:50
2006-03-11 09:21:02
2006-03-12 01:35:07
2006-03-12 14:50:34
2006-03-13 08:27:36
2006-03-14 00:22:14
2006-03-14 09:01:03
2006-03-14 10:22:52
2006-03-15 08:02:40
2006-03-16 00:23:49

At 16:37 on the 12th you will see someone connected from the console of your server I assume as administrator (192.168.16.1 and 127.0.0.1) and used some of the IIS admin tools.

As I have said in a quick email back to you there was an access to /iisstart.asp from an internet address on the 13th when you said the problems began but nothing much else.  I mainly suggested the IIS logs as a log of when the server rebooted which was your original question.

Steve
0
 

Author Comment

by:aark-it
ID: 17049398
Thanks Steve,
One last thing, when the log has a reasonable gap between the last time an event was written and a new log header (suggesting a reboot) does that indicate (possibly) that the server was down for the lenght of the gap. Hope that makes sense.

Mark
0
 
LVL 43

Accepted Solution

by:
Steve Knight earned 150 total points
ID: 17049434
Potentially yes.  It all depends upon whether anyone would have accessed the server through IIS during that time.  If every workstation is off then you'd get no traffic anyway.

Steve
0
 

Author Comment

by:aark-it
ID: 17049449
Thanks for your help Steve,
The evidence from the IIS logs isn't conclusive, but at least they've got something, which is more than they had!

Cheers
Mark
0
 
LVL 43

Expert Comment

by:Steve Knight
ID: 17049465
'A's don't cost any more than B's you know.
0
 

Author Comment

by:aark-it
ID: 17049490
Sorry Steve, thought I had "A"'d it, wasn't paying attention (again)! That's twice I've done that now, Doh!
0

Featured Post

Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

Join & Write a Comment

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
Is your company's data protection keeping pace with virtualization? Here are 7 dynamic ways to adapt to rapid breakthroughs in technology.
Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…
You have products, that come in variants and want to set different prices for them? Watch this micro tutorial that describes how to configure prices for Magento super attributes. Assigning simple products to configurable: We assigned simple products…

746 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now