Last night I received a false "<server> was rebooted" alert from Orion for a Windows 2008 R2 server monitored initially through SNMP, with several Application Templates applied using WMI. The alert template was "Alert me when a host reboots" in the Alert Manager.
The problem seems to be that the SNMP service crashed and restarted itself on this server and Orion misinterpreted that as a reboot. Orion believes the server rebooted two minutes after the "The SNMP Service has started successfully" message popped up in the server's System Event Log. I also confirmed the actual last boot date of the server using "net statistics server" to be sure there really wasn't a reboot. Is this a known problem?
I'm not very familiar with the new Thwack yet. Please let me know if this needed to be created somewhere else.
