For Threshold Monitor restarts, it is best to have both 5 minute as well as hourly snapshots. It is also very helpful to have CPU monitor (advanced) enabled. A full core is usually, but not always needed. Pcaps are useful if possible to catch them before the restart (or have a rolling pcap that will be incorporated into the full core). The usual system_information and eventlogs are needed.