> select serial_no, count(*) as "restarts" from event_log where event_mesg = ilike 'system sta%' and event_date > current_date - 7 > group by serial_no > having count(*) > X > order by restarts I think having is the better option.
pgsql-general by date:
Соглашаюсь с условиями обработки персональных данных