Write to Windows Event Log when an IIS site is started or stopped

Solution 1:

A couple of things. When I enable the Microsoft-Windows-IIS-Configuration/Operational event log, I do get events when the site is started or stopped. I get "Verbose" event 29 with this content:

Changes to '/system.applicationHost/sites/site[@name="Default Web Site" and @id="1"]/@state' at 'MACHINE/WEBROOT/APPHOST' have successfully been committed.

This is on Server 2008 R2. Now this doesn't tell you whether the site is started or stopped, but merely indicates that it changed status. Could be helpful if you monitor that log.

A long while back I wrote this: http://www.eventsentry.com/blog/2010/02/how-to-really-monitor-smtp-pop.html. It was a VBScript which would enumerate the virtual directories in IIS and tell you when one of them was stopped. This works on 2003, but unfortunately not on 2008. May be a starting point, I'll revisit this at some point so we can update the script.

Not the answer, but may get you closer to what you are trying to achieve. You'll most definitely will need some script (which is maybe trigger by the above event) which will enumerate the sites and their status.

Solution 2:

Take a look in the XML View of the event log ID 29. There you can see OldValue and NewValue change from one state to another

OldValue>Starting NewValue>Stopped

\?\C:\Windows\system32\inetsrv\config\applicationHost.config MACHINE/WEBROOT/APPHOST /system.applicationHost/sites/site[@name="Default Web Site" and @id="1"]/@state 1 Starting Stopped

Solution 3:

What you're looking to do is not natively built in to Windows/IIS.

The only thing that I can think that would come close is to look for when the log headers get re-written. Log headers get re-written with starts and stops therefore you could get a pretty good idea of when, but no idea of who.

So, again, I'm sorry to say, no.