Monitor Rebooting of Windows PCs

[hyarion]

I'd like to setup a trigger to alert me when a pc has been rebooted more than x times per day. I've already got a trigger (from the default windows_t) for checking if the pc has rebooted:

system.uptime.last(0)}<600

How can I use that to check if a pc has rebooted more than say 5 times in say a 24 hour period?

[bbrendon]

Ah! I just thought of a way... though its so ugly I wouldn't do it.

When your trigger of a reboot goes, you can have an action execute that call zabbix sender and sends a 1 to an item for the host. then you can make a trigger against this item that you just sent a 1 to, and if you have > 5 in 24 hours, you're golden!

Not pretty, but it works!

[hyarion]

you're right, not pretty, but I'll test it. thanks

[condor]

Just perhaps...

Since Zabbix uses a database, you could write a view. The view has the date range dynamic for the last 24 hour cycle and counts by server the number of reboots in the database. Then you can write yourself a trigger against the pre-counted view. This eliminates the need for triggers on triggers. It is also a bit easier to maintain as you can edit the view and not a whole bunch of trigger code, should the need arise.

See the MySQL manual on these things, but I used this for another 24 hours from right now query (pseudo code, but the date ranger works for MySQL, note: forcing of zero hundred hours on the starting date range).

This could also be done with a stored procedure or trigger to update an item which the trigger sees and then fires.

Select Winbox, Count(Winboxrebootcolumn) AS 'Reboots'
From COMMUNICATIONS
where ((`COMMUNICATIONS`.`DTGLOGGED` >= date_format((sysdate() + interval -(1) day), '%Y-%m-%d 00:00:00'))
and (`COMMUNICATIONS`.`DTGLOGGED` < now())) order by `COMMUNICATIONS`.`DTGLOGGED`
Group By Winbox

[mucknet]

Untested, but what about something like this:

({Unix_t:system.uptime.last(0)}<600) & ({Unix_t:system.uptime.prev(0)}< 85800)

So if it just rebooted, and the previous uptime number stored is less than 1 day (minus 10 minutes), send an alert. Doesn't quite get you your "X" times, but it will detect "2 or more"

Besides if you have something that is rebooting that often, maybe you should just fix it


P.S. I had originally posted this using max, but realized that wouldn't be quite accurate. previous should work though? I've never actually used the .prev trigger, so i'm not sure if there are any caveats to it. YMMV