Did You Ever Think of Disabling Performance Collection in SCOM?

We need to disable all performance data collection rules and instead collect those performances by other more suitable systems such as Elasticsearch or Splunk.

Don’t get me wrong SCOM is a fantastic platform for monitoring, it has a very sophisticated discovery engine, great self-monitoring agent capabilities, operation tasks, alerting and monitoring. They are all great, but what about the performance data? It seems to me that performance data structure is not suitable for SCOM object-oriented structure modal. I have two main reasons as to why SCOM and performance data collection are not a good match:

  1. It’s difficult to execute performance reports – you need to know exactly on which target class types the data exists since everything in SCOM performance is targeted to a specific class.
  2. Different intervals – each performance collection rule has a different configuration of an interval between samples. This practice is bad for deep investigation.

In addition, from my experience, many organizations use only a few performance metrics even though they collect a huge amount of performance data, it has a direct impact on SCOM performance.

What is your opinion? Do you agree with me or not? Did you already do that in your company? Or maybe you know someone who did this?

5 comments

    1. The first step is to get all the rules that are writing performance data to the DB.
      I have written two simple quires that return those rules.

      –Option 1
      SELECT DISTINCT
      RuleId INTO #tmp
      FROM [OperationsManager].[dbo].[PerformanceSource]

      SELECT
      r.RuleId,r.RuleName,lt.LTValue
      FROM #tmp t
      JOIN Rules r
      ON r.RuleId = t.RuleId
      JOIN LocalizedText lt on lt.LTStringId= r.RuleId
      where r.RuleEnabled 0 AND lt.LanguageCode=’ENU’

      ORDER by r.RuleName

      DROP TABLE #tmp

      –Option 2
      SELECT ParentId,Module.ManagementPackId into #tmp1 FROM ModuleType
      JOIN Module on Module.ModuleTypeId= ModuleType.ModuleTypeId
      WHERE MDTName =’Microsoft.SystemCenter.CollectPerformanceData’

      SELECT r.RuleId,r.RuleName,lt.LTValue FROM Rules r
      JOIN #tmp1 t on r.RuleId=t.ParentId
      JOIN LocalizedText lt on lt.LTStringId= r.RuleId
      where r.RuleEnabled 0 AND lt.LanguageCode=’ENU’

      DROP TABLE #tmp1

  1. No, I haven’t. I use this data with SquaredUp and weekly and monthly SCOM reports.
    But this depends on the environment and what the server team(s) and management want. In my case we want this data, we recently had a situation where our environment was being blamed for high latency on the storage. Using VEEAM I can show how the latency is not caused by us. In our case management wants to see how the cluster disks are performing, how much compute is being used, how much ram is being used. These are all reports i have scheduled to run weekly and monthly. IMO people not using SCOM reporting are missing out, there is so much valuable data in there. You can always specify to store the data for less time, the 400 days is rather long. I haven’t ever needed to go that far back. Honestly, the last 6 months would be just fine, especially if you’re sending out reports every month you’ll have the data archived in a cheaper way than in a DB.

    1. Yes, I agree with your opinion, performance has valuable data for any organization. However, My idea is to redirect the performance data to another more suitable database such as the Elasticsearch or a Splunk or Log analytics in Azure.

  2. I dont know about splunk, I haven’t used it. However, sending perf data to Azure Log analytics will get expensive pretty quickly in larger environments, but you still need to know how to use the data to get good information out of it. Changing how its collected doesn’t change that IMO.

    Also the new HTML 5 portal for SCOM 1801 makes it much easier to create performance dashboards, its much more similar to squaredup with some definite pluses and some minuses. The problem I see is companies thinking anyone they have on staff can just learn scom as they go and they will provide IT with valuable data.