Alarm a missing Event...

You can configure an alert rule like shown in the screenshot below:

Then you can configure a condition like this:

Configuring the time range and search interval can be a tricky part here. For example you’d like this alert to search at 4, so

4 _ (search interval = 1439) -This will search for 1 day of logs..

This is how the this works:

(Query(time_Range)) ---- after the search interval - (Query(time_Range))  ---- after the search interval - (Query(time_Range))

So technically if you apply this alert rule at 4:05. This should trigger the query then run accordingly @ 4:05 and alert if the event is missing.

Please try this and let me know if this works.

Ah, yes - i thought about this - but this means that i have to modify the Rule only around 6 in the Morning and i don't know how reboots affect the search interval :-/

However - thanks for your Reply and i think i'll give a try