Kaseya Community

Check for More than One Unexpected Shutdown Events Within X Days

This question is not answered


I am currently monitoring the Windows event logs on my machines for unexpected shut down events.  In most cases these turn out to be harmless and don't require follow up.  Because of this, I would like to be able to monitor for this event happening more than twice within a few days.  The problem is that the Kaseya counters reset every time a machine is restarted, so this function of the event log monitoring is useless in this case.

Does anyone else monitor like this?  What method do you use?  I had some thoughts about the monitor calling a script that keeps and checks an external counter, but that seems like a lot of work for something that should be native to the Kaseya monitoring.

Any thoughts?

Thanks in advance.

All Replies
  • AddAlarms.JPG


    In my (not so humble) opinion, an unexpected shut down is always a reason to follow up and examine the cause of this unexpected restart.

    Servers shouldn't reboot without any reason.

    However, if you do want an alert generated for X alarms generated within X days, I use the Policy manager (see screenshot).

    • Step 1: Create an "event log alert" that monitors the events for an unexpected shut down;
    • Step 2: Create a policy for this eventset;
    • Step 3: Assign the "Event log alert" set to "Alerts" with the appropriate setting (see screenshot);
    • Step 4: Assign the policy to the proper machines using a view.
    This should do the trick.
  • Walteij: I should have mentioned that I was looking to monitor unexpected shut downs on workstations.

    All:  Thanks for the suggestions.  It's frustrating that I have to work around this problem, but I appreciate the suggestions.

  • Walteij: I don't think your solution will work either.  It's not widely known, but Kaseya counters are reset when a machine reboots.  So any alerts set to alert when not seen within a certain time frame or X number of times in certain time frame cannot be relied upon.  I created a ticket about this problem, but Kaseya support insists this is a feature request not a bug.