Option 1: an event to read alerts (the easiest one, requires parsing)
Option 2: an event to capture a restart, or a cancellation