https://community.splunk.com/t5/Alerting/Linux-Server-Shutdown-and-Reboot-Alert/m-p/547188#M10402 <P>Hi Team,</P><P>I Need to create an alert whenever a Linux Server shutdown and whenever a Linux server reboot, can you please help me with query condition, which parameter i need to search to get this alert implemented</P><P>PS: We have RHEL,SUSE,Oracle Linux servers in our environment.</P><P>&nbsp;</P><P>&nbsp;</P> Thu, 08 Apr 2021 13:15:06 GMT nnimbe1 2021-04-08T13:15:06Z https://community.splunk.com/t5/Alerting/Linux-Server-Shutdown-and-Reboot-Alert/m-p/547188#M10402 <P>Hi Team,</P><P>I Need to create an alert whenever a Linux Server shutdown and whenever a Linux server reboot, can you please help me with query condition, which parameter i need to search to get this alert implemented</P><P>PS: We have RHEL,SUSE,Oracle Linux servers in our environment.</P><P>&nbsp;</P><P>&nbsp;</P> Thu, 08 Apr 2021 13:15:06 GMT https://community.splunk.com/t5/Alerting/Linux-Server-Shutdown-and-Reboot-Alert/m-p/547188#M10402 nnimbe1 2021-04-08T13:15:06Z https://community.splunk.com/t5/Alerting/Linux-Server-Shutdown-and-Reboot-Alert/m-p/547246#M10405 <P>Shutdowns may be a problem since it's possible the system could stop before the event is sent to Splunk.&nbsp; Reboots are possible, however.&nbsp; The key is monitoring the right source(s) on your Linux boxes and indexing that data in Splunk.&nbsp; You will need to monitor the /var/log file in which the OS records shutdown and startup events (I don't know which file, ATM).&nbsp; Then it's just a matter of creating a scheduled search to find those events and alert when they're found.&nbsp; Once you have the data in Splunk, come back with questions about searching for it.</P> Thu, 08 Apr 2021 18:02:38 GMT https://community.splunk.com/t5/Alerting/Linux-Server-Shutdown-and-Reboot-Alert/m-p/547246#M10405 richgalloway 2021-04-08T18:02:38Z