View Scheduled Tasks (local and remote) on Windows Server 2008 R2

Question

In one of our production nodes which runs on Windows Server 2008 R2, we have noticed that there is a significant delay (5 times normal) in processing requests (by our application running on tomcat) during Saturday mornings (00:00AM till about 07:30AM). The application provider has asked us to provide the tasks which are scheduled to run during that time period for trouble shooting.

Is there any way I can view all the scheduled tasks (local and remotely triggered) which runs during that period? It would be great if I can see some sort of history of all the scheduled tasks which ran for the past, say five Saturday mornings.

I tried Task Scheduler. However it displays only the local schedules and there is no apparent way to filter the view to show only those which are relevant to the case (Saturday morning in this case).

Originally asked at stackoverflow (by mistake, I might add. https://stackoverflow.com/q/24751302/1479093)

Solution 1

If it's something running through the task scheduler, you can look at the Event Logs to see what ran during that time. It will be fairly verbose, so you will need to filter out regular occuring events, but it might help you drill down on the issue.

Event Viewer -> Application and Security Logs -> Microsoft -> Windows -> Task Scheduler -> Operational should contain the information.

You could also parse the logs using Powershell. See this link: http://blogs.technet.com/b/heyscriptingguy/archive/2011/01/24/use-powershell-cmdlet-to-filter-event-log-for-easy-parsing.aspx

Good luck!

Solution 2

Using the Task Scheduler Event IDs on MSDN as your reference, run a Powershell query to list the relevant Task Scheduler events that have occurred.

For instance, this will list all the tasks that correspond to event id 107 (executed by a time trigger).

Get-WinEvent -LogName Microsoft-Windows-TaskScheduler/Operational | ? { $_.Id -eq 107 }

You could then easily filter on dates, select different fields/members, and write it all out to a file which you can e-mail to your application provider for review. If you want to get fancy, you could use Powershell to dump performance log data as well and attempt some correlation.