Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 536
  • Last Modified:

Server Uptime/Downtime logs

Hi,
Does anyone know if there is a historical log anywhere in the system of when a Win2000 server boots up or is taken down/crashes!

I need to go back to the beginning of this year if at all possible!

Thanks and Regards
Mark
0
aark-it
Asked:
aark-it
1 Solution
 
rhickmottCommented:
If you look at the System Log it should will tell you this information im not sure it will go as far back as that though.

right Click My Computer > Manage > System tools > Event Viewer > System

Yourr after Event 6009.


Event 6005 is logged at boot time noting that the Event Log service was started. It gives the message "The Event log service was started".
• Event 6006 is logged as a clean shutdown. It gives the message "The Event log service was stopped".
• Event 6008 is logged as a dirty shutdown. It gives the message "The previous system shutdown at time on date was unexpected".
• Event 6009 is logged during every boot and indicates the operating system version, build number, service pack level, and other pertinent information about the system. Depending on your current configuration, it gives a message similar to: "Microsoft (R) Windows NT 4.0 1381 Service Pack 6 Multiprocessor free".
0
 
Steve KnightIT ConsultancyCommented:
Current startup time can be seen with

net stats server

but that doesn't help with historic info. of course

On an ongoing basis you could setup a peformance monitor log to run once daily say to write uptime to a CSV file.

Steve
0
 
elbereth21Commented:
You can download and use uptime.exe from microsoft:
http://www.microsoft.com/ntserver/nts/downloads/management/uptime/default.asp
0
Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

 
aark-itAuthor Commented:
Thanks for the info guys,
I've checked the System Event log and it only goes back to 3rd June 2006, so the historical data I need isn't there.
Net Stats is ok for current uptime, but thats not what I need.
UPTIME looks like a valuable tool, but again, it only accesses data from the event log so only goes back to the beginning of this month.

Is there no where else I might be able to retrieve this very much needed information from?

Thanks in Advance and Regards
Mark
0
 
Steve KnightIT ConsultancyCommented:
Not as far as I know.  As I said if I were having to do it I'd setup perfmon to do it now then you can the next load of data easily.  If your event logs have old data removed then the only way I can think of is restoring previous versions of event log from backup, must be doable but I've never tried.  There may be other log files you could check such as IIS logs or logs from any apps running on there that may record startup etc.    Suggest restarting box then search for all files chabged today and if you are lucky some app or another will be recording startups in its log.


0
 
aark-itAuthor Commented:
Thanks dragon-it,
I'll give that a go later when all users have gone home and let you know what I come up with.

Mark
0
 
aark-itAuthor Commented:
Hi dragon-it,
I have found some IIS reports that date back to march, but I dont know what I'm looking at.
Is there any way I can attach one of the files so you could look at it for me, or do I need to copy and paste the information into this window?

thanks again
Mark
0
 
Steve KnightIT ConsultancyCommented:
No way  I know of to attach - you can email address in my profile if you like.  Will post here if there is anything useful in there. Steve
0
 
Steve KnightIT ConsultancyCommented:
You will find in the logs every time the headings are repeated such as this then the server, or at least the web service, has been restarted:

#Software: Microsoft Internet Information Services 5.0
#Version: 1.0
#Date: 2006-03-14 10:22:52
#Fields: date time c-ip cs-username s-ip s-port cs-method cs-uri-stem cs-uri-query sc-status cs(User-Agent)

So for instance from some of the logs you sent the server probably rebooted:

2006-03-10 08:25:50
2006-03-11 09:21:02
2006-03-12 01:35:07
2006-03-12 14:50:34
2006-03-13 08:27:36
2006-03-14 00:22:14
2006-03-14 09:01:03
2006-03-14 10:22:52
2006-03-15 08:02:40
2006-03-16 00:23:49

At 16:37 on the 12th you will see someone connected from the console of your server I assume as administrator (192.168.16.1 and 127.0.0.1) and used some of the IIS admin tools.

As I have said in a quick email back to you there was an access to /iisstart.asp from an internet address on the 13th when you said the problems began but nothing much else.  I mainly suggested the IIS logs as a log of when the server rebooted which was your original question.

Steve
0
 
aark-itAuthor Commented:
Thanks Steve,
One last thing, when the log has a reasonable gap between the last time an event was written and a new log header (suggesting a reboot) does that indicate (possibly) that the server was down for the lenght of the gap. Hope that makes sense.

Mark
0
 
Steve KnightIT ConsultancyCommented:
Potentially yes.  It all depends upon whether anyone would have accessed the server through IIS during that time.  If every workstation is off then you'd get no traffic anyway.

Steve
0
 
aark-itAuthor Commented:
Thanks for your help Steve,
The evidence from the IIS logs isn't conclusive, but at least they've got something, which is more than they had!

Cheers
Mark
0
 
Steve KnightIT ConsultancyCommented:
'A's don't cost any more than B's you know.
0
 
aark-itAuthor Commented:
Sorry Steve, thought I had "A"'d it, wasn't paying attention (again)! That's twice I've done that now, Doh!
0

Featured Post

Ask an Anonymous Question!

Don't feel intimidated by what you don't know. Ask your question anonymously. It's easy! Learn more and upgrade.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now