When the sensor starts, it writes a special header in the log file in the following format: *************************** Security Sensor Started [ <DATE> ]***********
Monitoring the sensor logs for this header can indicate when the sensor experienced a restart. Multiple sensor restarts in a short time period can indicate an issue that requires further investigation. On Unix/Linux systems, the sensor DBMS instance log also contains the start header as the instance is monitored by a child process that can be started and stopped. A process that experiences multiple restarts in a short time period can also indicate an issue that requires further investigation.