Event data, views and grooming

Every day I have a number of fleeting thoughts that I hope every Operations Manager administrator knows.  With all the emerging blogs about Operations Manager over the past year offering up a wealth of knowledge, sometimes I assume the majority of these fleeting thoughts are common knowledge.  I’m going to stop assuming, and start writing.

So here’s a little bit of “common knowledge”.

When is the last time you were in the console looking at an event view?  If you recall, was it a good experience and did it help you resolve some issue?  Would you have considered it a good use of your time?  If so, did you need to see event data from 6 days ago…or even yesterday?  Or were you interested in current event data flowing into Operations Manager?

Personally, I have yet to use an event view for anything more than viewing current events flowing into Operations Manager.  Even still, it is a rare case I will use any event view, and I wouldn’t miss them if they disappeared.  If I need a history of events logged on a particular computer, or a history of a particular event across the Management Group, I’ll run a report.  Reports offer great value for event analysis.  And that’s the real value of event collection rules.

The point I’m trying to get across here is, consider adjusting the operational event grooming cycle down.  By default, Operations Manager retains event data in the operations database for 7 days.  Depending on your environment and how many event collection rules you’ve got running, this can amount to unnecessary expense.  Not just disk space.  There’s a penalty for performance as well.

It’s not uncommon for a single event collection rule to collect up to 1 million events in a week in some environments.  Imagine an operator opening that event view and the impact this would cause just serving up that view.  What could we possibly ascertain by looking at such a view, other than there are a load of events being collected?  This is what I call system overload.

Hypothetically speaking, if I were an Operations Manager administrator at some company, I would adjust the event grooming interval down to 1 day.  This is just one of many things I could do to help Operations Manager perform better without really losing anything.  I’d like to hear if there is a downside to this.