Cleaning out unwanted event collection data from ops database

Most large SCOM management groups have lots of management packs and lots of monitored computers. Invariably this means that there are lots of event collection rules collecting event data and storing it in the Ops database and the datawarehouse.

It is good practice to review these periodically as you can prevent your scom datawarehouse from unnecessary bloat by over collection of this event data that you never use.

Run the following SQL query on your Operations database to view the top 20 event collections

SELECT top 20 Number as EventID, COUNT(*) AS TotalEvents, Publishername as EventSource
FROM EventAllView eav with (nolock)
GROUP BY Number, Publishername
ORDER BY TotalEvents DESC

You can then setup an Event View for the event you want to stop in the My Workspace pane of your scom console. Select New View, Event View and enter the event id. You can use this view to create an override to disable the event collection of your choice.

 

Advertisements
This entry was posted in SQL Queries and tagged , , , , , , , , , , . Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s