During recent work of fine-tuning Operations Manager infrastructure for the customer, high number of collected events in the SCOM database has come to my attention. So, I spent some time in analysing where did all collected events come from in order to better understand the root cause.
First thing that caught my eye was the fact that majority of collected events are the ones which have “Health Service Script” as Event Source property.
Next step was trying to understand which rule collects “Health Service Script” events. It turned out that 92% of all collected events were collected by the same rule, which was “Collect MSMQ Log Detail Script Events”.
This rule is configured with an expression which collects all events from the Operations Manager event log where Event Source equals Health Service Script.
Needless to say that most of the “Health Service Script” events are not related to the MSMQ management pack, nor relevant for understanding the health state of managed devices from the MSMQ perspective. Collection of all “Health Service Script” events might cause event flooding on the Operations Manager database side.
“Collect MSMQ Log Detail Script Events” rule is included in the Message Queuing Management Pack for Operations Manager, enabled by default. To my knowledge, it is included in the following management packs:
- Microsoft MSMQ 2003 management pack,
- Microsoft MSMQ 2008 management pack,
- Microsoft MSMQ 2008 R2 management pack and
- Message Queuing 6.0 Management Pack.
In order to prevent event flooding, you should create an override and disable the “Collect MSMQ Log Detail Script Events” rule for all applicable target classes. In order to do that, change the value of the Enabled parameter from True (default value) to False (override value).