Do you want to stop collecting all the worthless SCOM events in your environment?  By default SCOM collects thousands of events out of the box with a few Management Pack installed. 99.999% of the time no one is looking at these events.  The events bloat your database and often times provide zero value.

A customer recently was decommissioning two SQL servers that created 35 Million SCOM events in 2 days.  The events took up 60GB of DB space and crashed their production SCOM.

First we need to create a Management Pack to hold all the overrides.

 

I called mine “SCOM2K16 - Disable All Events”

Copy the script to one of your management servers and run it locally.

Now we simply run this powershell script on one of your management servers

The magic in the script is that it only disables event collection rules that don’t alert.  Rules that do alert we want to keep on, so it won’t disable them.

 

PowerShell
Edit|Remove
#Change $MPName value to the Display Name of the Management Pack you want to store your overrides. 
$MPName = "SCOM2K16 - Disable All Events" 
 
import-module OperationsManager 
 
$MP = Get-SCOMManagementPack -DisplayName $MPName 
  
$MYRules = Get-SCOMRule | where{$PSItem.WriteActionCollection[0].Name -notlike "*Alert*"| Where-Object -Property "Category" -EQ "EventCollection" | where{$PSItem.WriteActionCollection.Count -ne 3} | where{$PSItem.Enabled -ne "false"| where{$PSItem.HasNonCategoryOverride -ne "True"} 
  
foreach($rule in $MYRules) 
{ 
  
$class = get-scomclass -ID $rule.Target.Id 
  
Disable-SCOMRule -Rule $rule -Class $class -ManagementPack $MP 
  
}
 

 

The script will take a long time to run as there may be thousands of rules that need to be turned off.