False reboot alert for specific node in the SolarWinds Platform

10/28/2018 9:39 PM

5/9/2025 10:18 PM

A false alert indicating that a monitored object has rebooted triggers when the monitored object has not rebooted.

Network Performance Monitor

Some devices reset counters without a reboot.

Non-Windows (SNMP) 

This is a known issue that arises when a monitored device provides incorrect values for the  OID. SolarWinds NPM determines whether or not a device has rebooted by polling the value returned by the  OID.  is a 32-bit counter reporting the number of 100ths of a second since the monitored object last booted? For more information, see the  entry. If the currently polled value is less than the previously polled value, SolarWinds NPM considers the monitored object to having rebooted, and, if reboot alerts are configured, they will fire after the new, lower  value is written to the database.

Note: The   OID also reports the time since the last boot, but SolarWinds NPM does not currently poll this OID.

 

Depending on the vendor and type of the object you are monitoring, there may be a workaround to address this false reboot issue:

Cisco 

• If for any reason, the device SNMP agent is restarted on the monitored object, SolarWinds NPM may indicate a false reboot.
• There are known issues on devices from Cisco and other vendors that will randomly reset back to zero or will begin to count backward. Both cases will lead SolarWinds NPM to indicate false reboots. SolarWinds is unable to directly address the issue in this case, and you will need to contact your device vendor for a solution. For more information about creating a Universal Device Poller to poll , see False reboot alert for a specific node.

Linux/Unix/Mac 

• This issue is often encountered when a monitored device is running an older version of Net-SNMP. Update Net-SNMP on the device that is apparently rebooting falsely.
• This 1.3.6.1.2.1.1.3.0 OID counter resets to zero every time the SNMP service on the machine is restarted. This means that the uptime value in the sensor can be different from the real uptime of the monitored device even if there was no restart of the system and Orion will be identified that the 1.3.6.1.2.1.1.3.0 OID was restarted and will trigger the reboot alert.
• If updating Net-SNMP does not correct the issue, import the Linux System Uptime Universal Device Poller from the thwack Content Exchange into your SolarWinds NPM installation, as indicated in the section "Importing MIB Pollers" of the SolarWinds Orion NPM Administrator Guide.

Please note that Thwack is a community space where users may post any content as a suggestion or recommendations to you for your internal use. The information set forth herein may come from third-party websites or customers. SolarWinds is not liable for any downtime or any issue that may occur if you perform the following suggestions on the link provided. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment.

Workaround if the "Lastboot" value is NULL in the Nodes Table and those nodes cause false reboot alerts.

1) Edit “Node rebooted alert” or the alert in question (it’s canned – so copy it and disable the canned version)
2) Change trigger condition
3) Check the tick box for “Event must match the following filter”
4) New Last Boot is not empty AND Old Last Boot is not empty

 

Windows (SNMP) 

If it is a Windows device that is apparently rebooting, uninstall and then reinstall the SNMP agent on the Windows server, as follows:

1. Log on to your SolarWinds server using an account with administrative privileges.
2. Click Start > Control Panel > Add or Remove Programs.
3. Click Add/Remove Windows Components.
4. Click Management and Monitoring Tools, and then click Details.
5. Clear Simple Network Management Protocol, and then click OK.
6. Click Next on the Windows Components window, and then click Finish after completing the Windows Components Wizard.
   Note: You may be prompted to provide your Windows Operating System media or to restart your computer.
7. After restarting, install the SNMP agent again, as follows:
   1. Log on to your SolarWinds server using an account with administrative privileges.
   2. Click Start > Control Panel > Add or Remove Programs.
   3. Click Add/Remove Windows Components.
   4. Click Management and Monitoring Tools, and then click Details.
   5. Clear Simple Network Management Protocol, and then click OK.
   6. Click Next on the Windows Components window, and then click Finish after completing the Windows Components Wizard.
      Note: You may be prompted to provide your Windows Operating System media or to restart your computer.

 

Windows(WMI) 

The query used to validate the server rebooted is the check the uptime measurement using the WMI query below which returns the number of seconds the server has been "up". If the previously polled value is greater than the currently polled value, then we consider the node to have been rebooted.
 

I recommend keeping an eye on this value before and after a false positive alert has been triggered. You can check this easily yourself by running the command "wmic path Win32_PerfFormattedData_PerfOS_System get SystemUptime" from the command line of the monitored server. 

You can also run the following query using WMIExplorer remotely, or locally on the monitored host.
 
select SystemUptime from Win32_PerfFormattedData_PerfOS_System 

 

Creating an hrSystemUptime Universal Device Poller 

1. Log in as an administrator to the Orion Web Console on the SolarWinds server that is polling the object for which you want to create the UnDP.
2. Click Start > All Programs > SolarWinds Orion > Network Performance Monitor > Universal Device Poller.
3. Click New Universal Device Poller.
4. In the OID field enter , and then click Next.
5. Click + as necessary to check all affected devices, and then click Next.
6. indicate display options as desired, and then click Finish.

 

Time Ticks Conversion: 

timeticks / 100 = seconds

timeticks / 6000 = minutes

timeticks / 360000 = hours

timeticks / 8640000 = days