The default node rebooted alerts uses the Last Boot has changed event to trigger the alert, this works and is reliable. However I want more information. So I created a component that checks for event ID 1074, then set up an alert on that, the issue is that the event log entry is generated twice for every reboot. So I get the alert twice also it seems some version of windows do not use event ID 1074.
so what I would like to do is something similar to the alert that brings in the top ten processes when the CPU is high. So keep the last boot has changed alert and just add a process to it that would pull out event log 1074 if available and include that information in the node reboot alert.
Let me know if you have any suggestions on a way to do this.