OsQuery Monitor - Uptime Script

Problem Overview

Extended system uptimes can lead to memory leaks, decreased performance, and unaddressed software updates, ultimately exposing endpoints to reliability issues and security vulnerabilities. Monitoring how long a system has been running helps IT Professionals and MSPs schedule timely reboots or maintenance before problems escalate.

Description

This resource uses OsQuery to check a system’s current uptime in days. By returning a simple numeric result, it provides a straightforward glimpse into how long a system has been operational since its last reboot.

When combined with Level’s script-based monitoring or automated workflows, this query can alert you if a machine has exceeded a preset threshold. In addition, you can schedule it at regular intervals to maintain a clear picture of overall system stability and proactively plan reboots.

Script

1/*
2# -----------------------------------------------------------------------------
3# This resource is provided as a convenience for Level users. We cannot 
4# guarantee it will work in all environments. Please test before deploying 
5# to your production environment. We welcome contributions to our community 
6# library
7
8# Level Library
9# https://level.io/library/script-osquery-monitor-uptime
10*/
11
12SELECT days FROM uptime;

Use Cases

• Notifying teams when a server or endpoint surpasses a recommended uptime window
• Planning scheduled maintenance or patch cycles based on uptime data
• Ensuring reliable performance in mission-critical systems
• Monitoring endpoints with known memory or resource constraints

Recommendations

• Test the query in a development or sandbox environment
• Pair with a script-based monitor in Level to trigger alerts when uptime crosses a defined limit
• Use a scheduled Level Automation to run this query regularly
• Combine with other OsQuery checks for a comprehensive overview of system health
• Review the results to identify trends and anticipate required reboots

FAQ

• How does this query work?
  ‍It simply calls the OsQuery uptime table and retrieves the number of days since the last reboot.

• What if I want to receive an alert after a specific number of days?
  ‍Configure a script-based monitor in Level to compare the returned uptime to your preferred threshold.

• Does this query work on all operating systems?
  ‍OsQuery supports multiple platforms, but confirm that the uptime table is available on your target OS.

• Why monitor uptime at all?
  ‍Long uptimes can hide issues like memory leaks or postponed software updates, which can cause instability or security gaps.

• Will this script reboot my system?
  ‍No. It only reports uptime. Rebooting would require a separate script or manual intervention. Review our prompt user to restart automation.