An approach is provided for determining whether to reboot a computing node. Data specifying user behaviors and intra-box and inter-box factors associated with computing nodes are collected and classified in groups. Rules corresponding to the groups are generated. Each rule includes an indicator of whether the corresponding group is associated with permitting or not permitting a reboot. Computing node data is received which specifies intra-box and inter-box factors of the computing node and user operations of the computing node. After determining that the computing node data matches one of the groups, it is determined that a rule corresponding to the group includes an indicator of whether the computing node is permitted to be rebooted. Based on the indicator, the computing node is rebooted or not rebooted.