Need guidance on creating complex alert

Hi,

Want to create an alert when any server is rebooted by the users. Please guide me on how to do this.

Scenario:- Suppose, we have two offices in India in Mumbai and Delhi and have multiple servers and another device in both sites.

IT department engineers are working from the office as well as from home and took remote access via RDP or SSH to both site devices as per requirements.

Requirements:- Need to set the alert, when the server is rebooted or shut down by anyone engineer whether he is working from home or the office.

In the alert, I need the information on when was rebooted or shut down and by whom (users/IP address) the servers were rebooted or shut down.

Find more posts tagged with

support

Hybrid Cloud Observability

npm

SolarWinds Platform

Alerts

Accepted answers

All comments

rohit.l

How are you monitoring it agent or snmp?

ImNishat

Mixed, ICMP, WMI and Agent

rohit.l

adam.beedell

You need to make sure you've git a datasource for who rebooted it. There's a windows event for this if it's windows. You can get that event with log forwarding or SAM via an event log monitor or a powershell monitor.

Probably the forwarding option would be needed for the scenario of someone powers it off when they shouldnt have but also didnt turn it back on

adam.beedell

Once you've got the datasource, the alert follows from that (you may need to join up the node status and wherever the data lives)

cheryl1

First my apologies for being absent, I have been traveling for work for the better part of the last month.

@adam.beedell is correct here. First, do we even have the data source? Is the information you require being captured and in the database and if so, how?

You may need Windows event log monitoring to get the level of detail you want, but first let's tackle that issue then as Adam says, you can build an alert.

ImNishat

But, if we used the above-mentioned criteria in that case we only came to know when was server rebooted. But we need to know by whom (User details) that particular server was rebooted and whether he or she was working from the office and home.

ImNishat

Thanks for your response, I am working on the said suggestion, once i got the desire result i will update you.