How to get alerts when Ubuntu server restarts?

[anh_nguyen]

I am collecting logs from an Ubuntu server (16.04) using Splunk and would like to create an alert for when the Ubuntu system restarts. Does anyone know which logs or events I can utilize to trigger an alert when the Ubuntu server restarts?

[PickleRick]

Question is what logs are you ingesting from that host.

If you have TA_nix installed, you can use uptime.sh input to get system's uptime.

[anh_nguyen]

Thank you for your reply. Yes, I have TA_nix installed and have uptime.sh input too. However, I would like to be alerted whenever the Ubuntu server is down. Could you please suggest how to do it?

[PickleRick · Accepted solution]

If you want to retroactively find period of downtime, you need to compare the output of the uptime.sh script and check when the uptime value dropped instead of increasing.

You could check periodically for lack of events from the host to find when there is a possible outage but remember that this might be caused by completely different thing than a reboot of the server - for example UF crash. While Splunk can do some form of monitoring based on the logs it gets it's not a pro-active monitoring solution in the likes of Zabbix or Nagios.