Methods, systems, and computer program products for restarting event and alert analysis after a shutdown in a distributed processing system are provided. Embodiments include identifying, by an incident analyzer, a shutdown condition of the distributed processing system; and determining, by the incident analyzer, whether the shutdown was a planned shutdown or an unplanned shutdown; if the shutdown was planned, storing, by the incident analyzer, an identification of the last event in an event log that was injected in an event queue at the time of the planned shutdown and restarting, by the incident analyzer, event and alert analysis using the next event identified in the event log; if the shutdown was unplanned, identifying, by the incident analyzer, a previously configured restart mode; selecting, by the incident analyzer, an identification of a restart event in the event log according to the previously configured restart mode; and restarting, by the incident analyzer, event and alert analysis using the restart event identified in the event log.