We need to disable all performance data collection rules and instead collect those performances by other more suitable systems such as Elasticsearch or Splunk.
Don’t get me wrong SCOM is a fantastic platform for monitoring, it has a very sophisticated discovery engine, great self-monitoring agent capabilities, operation tasks, alerting and monitoring. They are all great, but what about the performance data? It seems to me that performance data structure is not suitable for SCOM object-oriented structure modal. I have two main reasons as to why SCOM and performance data collection are not a good match:
- It’s difficult to execute performance reports – you need to know exactly on which target class types the data exists since everything in SCOM performance is targeted to a specific class.
- Different intervals – each performance collection rule has a different configuration of an interval between samples. This practice is bad for deep investigation.
In addition, from my experience, many organizations use only a few performance metrics even though they collect a huge amount of performance data, it has a direct impact on SCOM performance.
What is your opinion? Do you agree with me or not? Did you already do that in your company? Or maybe you know someone who did this?