When the sensor starts, it writes a special header in the log file in the following format: *************************** Security Sensor Started [ <DATE> ]***********
Monitoring the sensor logs for this header can indicate when the sensor experienced a restart. When a process or the sensor restarts multiple times in a short time period can indicate an issue that requires further investigation. On Unix/Linux systems, the sensor DBMS instance log also contains the start header as the instance is monitored by a child process that can be started and stopped.