Node DOWN/Node Reboot Alert for 3,000 servers

To exclude the Citrix servers, you can define specifics in the trigger conditions.  Depending on your environment, you may have to use multiple conditions.  For example, if the names all contain CTX, then you can put that in the exclusions.

In order to trigger the alert after the 5-10 timeframe, you would just need to specify the condition must exist for more then X minutes.

One thing to note, is you would also need to set up the alert to poll frequently.  If you are only polling every 10 minutes, then the box could be down for 20 minutes before you get alerted (10 minute polling, plus 10 minute condition).

For the node reboot alert, essentially that one just looks at the device boot time and triggers if it ever changes, trying to build a timeout condition would involve some much more complex SQL logic where it check the new boot time, looked for down events in the previous 5-10 minutes and only trigger when there was no down event.  Doable, but definitely not user friendly to implement.

There is a 'Lastboot' option available, unfortunately I don't think you are going to be able to easily tie that together with a down event because in order to change/trigger 'Lastboot'

Orion needs to be able to read that value from the node using SNMP/WMI. If the node is down then it will not be responding to either.

I would agree with mprobus that simply changing the polling time then the number of minutes before the alert triggers would be the easiest.  Poll every 3 minutes and set the alert 'condition must exist'  to 6 minutes would get you down to 6 minutes and two consecutive polls before it triggered.