Alert for reboot of Windows/Linux device

The out of box alert, "Node Rebooted" works for me.

Doesn't seem to work for me.. it's alerting for VMs even when it's just

migrated or when SNMP is restarted...

Can u share a screenshot of your alert? And which version are you on?

I suggest to go to your Message Center, filter on reboot events and see whats reporting reboots.

that wont help... i have already cross checked with my team when the alert comes and they mentioned that there was no reboot done...

any other solutions?

hpstech​

I observed the tab u mentioned and for windows its matching with what Solarwinds is caprturing..

So this event is from the default node reboot alert OR VM reboot alert? Any idea?

Node reboot alert out of the box only looks at the sysuptime counter. If lower than the previous poll it triggers as a reboot. Problem with that is that when SNMP is restarted it clears that counter I believe, there are other things too that can clear that out causing solarwinds to falsely trigger a reboot alert.

We have not been successful at deploying this and we are still researching. We are trying to build a sam template to monitor for specific event id's you normally see on the windows side after a server has rebooted. And we made a template alert that is labeled reboot but triggers when this sam template goes down. The logic is basically this. The SAM template checks for the event id, if found it goes into down status for 5 poll cycles I believe we have set. This in return is the trigger for the alert. And as an action we have a message that pulls information from that template to let us know the event id and the reason behind the reboot.

This concept has more substance and helps us to troubleshoot it a bit better than just a simple " server has rebooted " generic alert.

The reason it failed for us is that we still need some further tweaking to get it right. It still has some rough edged. But figured it could potentially work for you.

Thanks for sharing your experience...

yes, windows is feasible via event ID using SAM templates... But i am looking on Linux devices... even i m observing it from few days and when i did inform my team on the reboot alerts i got, it did match with data they pulled from device... So lets see how the testing goes further...

With Unix, that was a pain point for us too. We couldn't find an object or source we could use that would accurately tell us when the system actually rebooted. And when we manually restarted snmp on these servers we would get the false reboot alerts as well. I'm going to follow this post here myself to get some ideas. I'm hoping all works out at your end!

Pratik, this is now easier than ever. I've written up a quick note on how to accomplish this use case with VMAN 8.4

DEAR VMAN: How do I have better visibility into VMs that are rebooting?