Huntland Services Ltd

Tel: +44 (0)1392-490518
Fax: +44 (0)1392-428003
Enquiries@huntland.co.uk

Grooming Operations and Timings

 
Back Download This Article

MOM uses default scheduled tasks that trim and check the OnePoint database.  The administrator configures these through the Admin Console\Configuration\Global Settings\Database Grooming.  MOM implements these tasks as SQL Server Agent jobs.  These can be inspected through SQL Enterprise Manager\Management\SQL Server Agent\Jobs where they all have the name suffix 'OnePoint - '.  By right clicking any of these jobs you are able to select 'View History' and see detailed information on how the job has performed over all its previous schedules.

However the grooming tasks have a complicated picture as they all use individual start times, timings and intervals for deciding what is old data and what isn't.  To clarify this the following table lists in chronological order what task is performed when, what SQL procedures it invokes and what parameters it uses to carry out the job.  There are three basic types of action:

  1. Deleting time expired Alert, Event and Performance data

  2. Updating statistics used by the Mom Admin Console root node display pane

  3. Maintaining and reporting the state of the OnePoint database

 

 

Time

Frequency

Scheduled Task

Command

00:00

Every 60 minutes

Groom Alerts

Deletes first 4,000 alerts whose ResolutionState is set to 255 (resolved) and age is > than admin specified interval default 1 day.

 

[NB the events, alerts and numeric data grooming tasks are performed using the GroomDatabase stored procedure.  This takes as its only parm the name of the job which is used as a lookup into the GroomJob table to fetch the name of the correct T-SQL script to run and the admin specified interval before a record is considered old.]

GroomDatabase 'Resolved alerts' calls stored procedure AlertsResolvedGrooming which deletes entries in tables:

            AlertHistory
            AlertToEvent
            AlertEventSuppression
            Alert

And updates table

            GroomHistory

 

 

00:00

Every 60 minutes

Groom Events

Uses three sub tasks to delete the first 4,000 events whose age is > than admin specified interval.

 

  1. From Directory Service, DNS Server, File Replication Service, Application and System Logs if older than 7 days.
  2. From Security log if older than 1 day.
  3. From Script Generated Data, Internally Generated Data, 3rd Party Application log, WMI Events, WMI numeric data, Timed Events, Generic Provider if older than 7 days

 

All procedures delete entries in tables:

            EventParam
            AlertToEvent
            EventConsolidated
            Event

And update table:

            GroomHistory

  1. GroomDatabase 'Windows NT Event Logs not including security' calls stored procedure  WinntEventLogGrooming.

  2. GroomDatabase 'Windows NT Security Event Log' calls stored procedure  WinntSecurityEventLogGrooming.

  3. GroomDatabase 'Other Events' calls stored procedure OtherEventsGrooming.

00:00

Every 60 minutes

Groom Sampled Numeric Data

Deletes first 4,000  sampled numeric data older than 1 day.

GroomDatabase 'All sampled numeric data' calls stored procedure sampledNumericDataGrooming which deletes entries in table:

            SampledNumericData

And updates table:

            GroomHistory

0:00

Every M,T,W,Th,F,S

Reindex Event Table

Uses DBCC Reindex command.

DBCC DBREINDEX (Event, CI_Event_EventSource, 95) 
DBCC DBREINDEX (EventParam, CUI_EventParam, 95)

Update tables:

            Event
            EventParam

00:00

Every 5 minutes

TodayStatisticsUpdateComputersAndAlerts

Runs 2 sub tasks to update the computers and alert  sections of the MOM root details pane.

  1. Update Computers
  2. Update Alerts

 

 

[NB the ComputersWithSecurityUnavailableView* is a misnomer as this view actually contains service unavailable]
  1. TodayStatisticsUpdateComputers Counts MonitoredComputers from Computer, Counts CriticalErrors from  ComputersWithCriticalErrorsView, Counts Errors from ComputersWithErrorsView, Counts Warnings ComputersWithWarningsView, Counts SecurityBreach from   ComputersWithSecurityBreachView, Counts SecurityUnavailable* from ComputersWithSecurityUnavailableView* and updates table TodayStatistics
  2. TodayStatisticsUpdateAlerts Summarizes ServiceLevelExceptions from Alert JOIN ResolutionState, Counts UnresolvedAlerts from Alert , Counts NewAlertsToday from Alert and updates TodayStatistics.

00:00

Every 30 minutes

TodayStatisticsUpdateEvents updates the Events section of the MOM root details pane
 

TodayStatisticsUpdateEvents counts TimeGenerated from Event and updates table TodayStatistics

00:00

Every 60 minutes

TodayStatisticsUpdatePerfmonRulesKB performs 3 sub tasks:

  1. Update Performance
  2. Update Rules
  3. Update KnowledgeBase
  1. TodayStatisticsUpdatePerformance counts TimeAdded from ProcessRule and updates table TodayStatistics.
  2. TodayStatisticsUpdateRules counts ProcessingRuleGroups from ProcessRule, counts MCSProcessingRules from ProcessRule, counts CustomProcessingRules from ProcessRule, counts ComputerGroups from ComputerRule, counts NotificationGroups from NotifyGroup, counts Scripts from Script and updates TodayStatistics.
  3. TodayStatisticsUpdateKnowledgeBase counts TimeAdded from ProcessRuleComment and updates TodayStatistics

00:30

Every 60 minutes

Update Database performs 4 sub tasks but only on alerts that are ‘New’ and are older than admin specified interval:

  1. Auto resolve success Alerts (4 hrs)
  2. Auto resolve information Alerts (4 hrs)
  3. Auto resolve warning Alerts (24 hrs)
  4. Auto resolve error Alerts (48 hrs)

 

[NB If Alert is set to resolved it is groomed from the DB at the top of each hour e.g. 30 mins later]
  1. UpdateDatabase 'Auto resolve success Alerts' calls stored procedure AlertUpdateNewToResolved which sets resolution state to ‘255’ for all new alerts of type ‘success’ older than 240 minutes in the alert table.
  2. UpdateDatabase 'Auto resolve information Alerts' calls stored procedure AlertUpdateNewToResolved which sets resolution state to ‘255’ for all new alerts of type ‘information’ older than 240 minutes in the alert table.
  3. UpdateDatabase 'Auto resolve warning Alerts' calls stored procedure AlertUpdateNewToResolved which sets resolution state to ‘255’ for all new alerts of type ‘warning’ older than 1440 minutes in the alert table.
  4. UpdateDatabase 'Auto resolve error Alerts' calls stored procedure AlertUpdateNewToResolved which sets resolution state to ‘255’ for all new alerts of type ‘error’ older than 2880 minutes in the alert table.

 

00:45

Every 2 hours

Check Free Data Space

Returns the size and freespace for the Db and Log.

EXEC sp_OnePointFreeSpace calls OLE Automation stored procedures sp_OACreate, sp_OASetProperty, sp_OAMethod, sp_OAGetProperty, sp_OADestroy to return DBSpaceinMB, LogSpaceinMB, DBFreeSpaceinMB, LogFreeSpaceinMB.

01:00

Every 24 hrs

Update Statistics runs the task ‘Update statistics on all tables’

EXEC sp_updatestats from the master db Runs UPDATE STATISTICS against all user-defined tables in the OnePoint database

22:00

Every Saturday

Check OnePoint Integrity

EXEC master.dbo.xp_sqlmaint '-PlanName OnePointCheckIntegrity -CkDB -CkAl -WriteHistory'

22:00

Every Sunday

Re-index

EXECUTE master.dbo.xp_sqlmaint '-PlanName OnePointReindex -RebldIdx 100 -WriteHistory'