Is it possible to monitor when a server reboots? I know that a Ping monitor will show when a server is no longer responding, but that could just indicate that there's a problem with the network, NIC, etc. and that the server may still be up and running. Ideally I would like to have an alert sent out via email if one of the servers actually performs a reboot. Thanks in advance.
You should be able to tell if a server has been rebooted using the Windows Event Log Monitor, but I'm not sure if there's an event in there before the reboot that we could use.
Found one: Windows Event ID 1074 is a user initiated reboot.
Here's the text that the event generates:"The process <process> has initiated the restart of <computer name> forthe following reason: No title for this reason could be found.Minor Reason: <reason>Shutdown Type: reboot"
Alright, I'll look into that and give it a try. Thank you.
OK, I added a new event log monitor to a server, but I'm kind of confused as to how this actually works. How exactly do I need to configure an alert so that if Event ID 1074 is found in the event log (and it is recent) it sends an email notification to me? I had an Information alert configured and it sent an email, but all it said was "Found: 1 of 1", and the email was sent to me about 3.5 days after the most recent event in the log. I apologize for having to ask this in the forum, but the documentation for ipMonitor seems to be really lacking in detail for configuring things of this nature. Thanks in advance.
We're in the process of moving this content over to the our SolarWinds core site, but you can find more documentation here on the Event Log Monitor:
https://support.ipmonitor.com/helps/8b980326971d4cbc88ec362af0bec04f.aspx
chris.lapoint: We're in the process of moving this content over to the our SolarWinds core site, but you can find more documentation here on the Event Log Monitor: https://support.ipmonitor.com/helps/8b980326971d4cbc88ec362af0bec04f.aspx
Is this Event Log Monitor functionality available in Orion?
Thanks,
DE
Yes, you can do this with Orion as well. The way it works in Orion is you install the Windows Event Log Forwarder on your Windows Server, which converts Windows Event Log to Syslog. From there, you can use Orion's Syslog Server and its powerful pattern matching and alerting capabilities.
In APM 2.0 (which ships shortly), we ship a Windows Event Log monitoring script that will allow you to monitor event logs from APM without requiring the Windows Event Forwarder.