Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Custom SWQL Alert for Loop Reboots 15 minutes 3 reboots

Wondering if anyone has a working SWQL Alert, to detect/alert on Loop Reboots. Ideally looking to have an alert that only triggers on a group of nodes if the node reboots 3 times within 15 minutes to capture looped reboots due to patching. Few posts I have found are looking back days or weeks for reboots. I have noticed when checking the message center they also not accurate.

Ideally the alert would monitor reboot events only within a 15 minute time frame. Alert would only trigger if 3 reboots occurred on target box within the 15 minute time frame. Any information/advice or query showing results would be appreciated. Thanks!

Find more posts tagged with

Accepted answers

All comments

robert777

You might use the SAM component Windows Event Log monitor to track the reboot message ID in the Windows Event Log (I think the System log). Then use component properties to put the component into Critical health state if the component fires 3 times in 15 minutes.

Alert on Critical health state for that component.

Cheers.

runyanj

Thanks for the response and this information. I will give that a try with the windows boxes, but we also have Linux boxes we would want to do also. Forgot to mention that above.

robert777

Wondering... do you monitor Linux servers with SolarWinds Agent, SNMP, other? Do you have credentials for an SSH login to the Linux servers?

I'm not sure if SolarWinds has an out-of-box component monitor for Linux reboots. Your solution might involve writing a Bash script to track reboots.

Anyone in the community feel free to question or comment.

runyanj

Our Linux boxes are monitored via Agent. I think SSH is possible with the agent, not sure if we have that permitted though. Thanks for the suggestion Ill check into the bash script.

antonis.athanasiou

It is likely that, if the box in question is stuck on a reboot loop, the monitoring protocols (WMI, SNMP, Agent) may have not been fired up yet and any OS level monitoring may fail. I would approach the problem from a different perspective:

If the target boxes are VMs, monitor reboot events on the hypervisor level
if there are a mix of physical and VM boxes, lower their poll interval (Default is 120 seconds) to catch any ping timeouts; then configure an alert to look for X times of packet loss over Y period of time (probably targeted only on the boxes in question to reduce any noise from other devices that experience packet loss)