Solarwinds Orion Reboot Alerts

jasonbku

Using Solarwinds Orion, we have a issue here or there where we font get alerted that a server rebooted, or we get two alerts. How does Orion determine that a server rebooted? What is it looking at on the OS level to determine this?

There is no ryme or reason for this, alerts look fine nothing is duplicated to send the two alerts. I could reboot the same server 15 times, 13 times it alerts fine, 1 time no alert and 1 time 2 alerts for the same reboot. I just want to get a understanding on what it is looking at to determine that a server even rebooted. Our servers are NOT sending traps to the Orion server. But the Orion server is polling them. So far the only issue seems to be with Server 2008 R2 Enterprise.

aLTeReGo

The out of the box "Alert me when a node reboots" works by comparing the "sysUpTime" OID via SNMP between two polls. For WMI managed nodes the "LastBootUpTime" is used. Because the actual time of the monitored host is used when the node is managed via WMI, it is theoretically possible that an alert may not fire if the time is off from the Orion server by more than 2 minutes.