Huntland Services Ltd

Tel: +44 (0)1392-490518
Fax: +44 (0)1392-428003
Enquiries@huntland.co.uk

Delete Events

Introduction

Sometimes its useful to be able to 're-set' the events for a particular server.  Maybe you have been experimenting or have only just rolled out Mom and already have a considerable number of events in the database generated by a particular machine.   This is even more likely if it's taken a bit of time to realise that some of those events are just not very interesting and were collected by default when you activated one of the management packs.  So now you have Mom fine tuned but the database is full of junk.  How do you get rid of it?  There are two ways.

1. Mom will naturally groom events if they are older than a certain (admin specified) date.  This is the normal Mom tidy up process.  For further information see 'Grooming Operations and Timings' here.  This is applied to all machines and by default and you will have to wait seven days for the current events to be deleted.
2. Use the following script to delete all events generated by a particular machine as of right now.  At the end of this process there will be zero events in the database related to this machine.

Health Warning This is a permanent deletion and cannot be recovered. Always backup your data first.

Run DeleteEvents.vbs from a Command Prompt using CSCRIPT.  You will need to specify the following paramaters:

1. myMomSqlServer - The name of the server hosting the MOM Onepoint Database
2. myServer - The name of the computer whose events you want deleted.  Notice wild cards are not available here.  You need to be specific.

In all cases your account must have access to the MOM SQL Server and at least read access to the Onepoint database.  Windows Security ('Integrated') is assumed.

If your database is many gigabytes in size then you can expect a delay while the script runs.  Each script has two commented timeout values controlling the maximum connection time and the maximum time to run a command.  By default these are set low and may have to be increased for larger databases.

DeleteEvents.vbs

Purpose:   To permanently remove all traces of events logged by a particular machine

Syntax:     cscript  DeleteEvents .vbs   myMomSqlServer     myServer

Result:

EventParam ........
         541 records marked for deletion
AlertToEvent ........
        166 records marked for deletion
EventConsolidated ........
         0 records marked for deletion
Event ........
         1234 records marked for deletion
Deletions Committed

Or if there was a problem, the deletions would all be rolled back, restoring the database to its origional condition. e.g. no deletions have taken place:

There has been a problem
-2147217871 Timeout expired
Deletions rolledback 

 Timeout problems will occur if the database is very big, the network connectivity is poor or Mom is very busy.  Either way, the deletion statement fails to complete on one or more of the tables (probably the Event table as it is the largest).  In these cases you can modify two timeout values specified in the body of the script.  The values are given in seconds and you can just go on doubling them until it works.

objCn.connectionTimeout = 15         'Increase this value (in seconds) if server timeout errors occur
objCn.CommandTimeout  = 30         'Increase this value (in seconds) if server timeout errors occur

Please accept this script as is.  Any feedback will be gratefully received at Debug@Huntland.co.uk