Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Possible to monitor server startup and/or shutdown?

I am using Solarwinds Event Log Forwarder for Windows. I was hoping to have it forward Windows Event IDs 12 and 13 which indicate a Windows server startup and shutdown.

However, the Solarwinds Log Forwarder service is not running when a system records the Event IDs mentioned above. Either the service is stopped before the system logs the power off Event ID or the service has not yet started when a system logs the power on Event ID.

Is there any way to monitor server startup/shutdown with Event Log Forwarder?

Find more posts tagged with

Accepted answers

All comments

kpmarcin

Hello hudsonsoft

I am not too familiar with Event Log Forwarder, but just to suggest a different approach - could you use Server & Application Monitor?

You can create a custom SAM application template with Windows Event Log component and simply monitor mentioned Event IDs.

With that approach, you will gain much more statistics and data. Events in SolarWinds will be organized in the same way as in Event Viewer.

Kind regards,

Marcin Kazmierczak.

---

IT-Indago Ltd. - Authorized Reseller & SolarWinds Certified SCP Professional

IT-Indago – Be In Control! | Follow us on Facebook & LinkedIn

dgsmith80

If the device is monitored within SolarWinds could you not set up an alert for "Last Boot has changed"

rmullal

I created a SAM template to look for event ID 6008 and 6006 which indicates a shutdown. The problem i'm running into is that the template is not catching those event IDs when a server is shutdown. I assume it's not catching it due to the polling times, it can only poll every 60 seconds. Any ideas kpmarcin?

serena

rmullal wrote:
I created a SAM template to look for event ID 6008 and 6006 which indicates a shutdown. The problem i'm running into is that the template is not catching those event IDs when a server is shutdown. I assume it's not catching it due to the polling times, it can only poll every 60 seconds. Any ideas kpmarcin ?

If you're using the Windows Event log monitor like was suggested, you can configure the number of past polling intervals to search for events, so polling interval should not be an issue.

Windows Event Log monitor

rmullal

Thank you serena! Is there a max amount of past polling intervals that it can look back to?