check file resolver.log with path "/var/log/resolver.log" if match "info: start of service (unbound" then alert
2021-07-18T14:30:15 unbound[34317] [34317:0] info: start of service (unbound 1.13.1). 2021-07-18T14:28:46 unbound[88879] [88879:0] info: service stopped (unbound 1.13.1).