As an example - if a box reboots more than 3 times in a day (24 Hours).
Type of Property to Monitor: Custom SQL Alert
Set up your Trigger Query: Node
WHERE Nodes.NodeID IN (
SELECT NetObjectID
FROM Events
WHERE NetObjectType = 'N' AND EventType = 14 AND EventTime >= DATEADD(DAY,-1,GETDATE())
GROUP BY NetObjectID
HAVING COUNT(1) > 3)
Explanation:
EventType = 14 is the reboot code (see the EventTypes table for a list)
DATEADD(DAY,-1,GETDATE()) = (DAY,-1) calculates the last day (i.e. in the last 24 hours or 1 day) Can be changed to reflect the last 3 days (-3)
NetObjectType = 'N' pulls only Node events
HAVING COUNT(1) > 3 "> 3" is the event has happened on the 3rd time (adjust the number how many reboots triggers the alert)
**Optional at the end of the script you can add - identify by vendor:
AND Nodes.Vendor = 'Windows'
This Alert has been tested and works.
