The PIX writes syslog messages when it fails over, so set up logging to a syslog server and then you can search for the failover messages there, they'll be timestamped. Set up logging with:
logging on
logging trap errors
logging timestamp
logging host
Syslog messages can be found here:
http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/63syslog/pixemsgs.htm
The ones you're interested in are in the 101001-105xxx range, particularly 104xxx.
You can set up a syslog server on any Unix device you have, or there's a free Windows syslog server at www.kiwisyslog.com
