Can I get notified when an IIS web site is stopped (and/or started) on Windows 2008 or later?

Yes, to get notified when an IIS site is stopped or started, follow the steps below:

• In the Windows event viewer, navigate to the Microsoft-Windows-IIS-Configuration-Operational event log

• Right-click the log and select "Enable Log"

• In EventSentry, create a new include filter which looks for the following event properties:

  • Custom event log "Microsoft-IIS-Configuration/Operational"
  • Event Severity: Information
  • Event ID: 29
  • Event Source: Microsoft-Windows-IIS-Configuration

To further restrict the include filter to only alert you when the site is stopped, add a content filter (in the "Content Filter & Notes" section) with the following condition:

Insertion String #4 matches "*@state"
Insertion String #7 matches "Stop*"

The content filters should be chained using AND.

You can optionally also override the email subject (when using email notifications) to something like "IIS Site Stopped" as well, or use the $STR7 insertion string variable. The previously created filter can also be cloned by copying and pasting the filter, and replacing "Stopped" with "Started", to get a proper notification whenever a site is being started or stopped.

To determine which insertion string to filter against, simply open the event in question in the Windows event viewer, switch to the "Friendly" view and view the insertion strings under EventData. The insertion strings are parsed sequentially, with the first entry ("PhysicalPath") being insertion string #1.