Good afternoon everyone! I have a question. I want to disable all the WMI and SCRIPT FAILURE alerts, but would like to document them via an event collection. My question is this. Is there a way to prevent an EVENT FLOOD (I guess it could happen) from taking down the RMS. Is there an override or someway to catch a flood of the event id?? Thanks in advance! Kevin

Evening Kevin ;-) Apologies for not answering the question directly - but one option which I use is to set these types of alerts to informational (via an override). My main alerts view does not show informational alerts but I have a seperate view then for these types of errors. I don't know if there is event flood detection which you are looking for but there is alert flood workflows: http://blogs.msdn.com/b/mariussutara/archive/2009/03/25/what-is-new-opsmgr-2007-r2-alert-storm-recognition-possible-rule-misconfiguration.aspx Hence I'd probably suggest that this might be an alternative solution to consider. Cheers Graham View OpsMgr tips and tricks at http://systemcentersolutions.wordpress.com/

Thanks for the response Graham, So, what you are saying is that instead of doing event collection make them informational alerts...that way SCOM can catch a flood with the 5399 and will temporarily suspend alerting from that server if a flood does occur... Is that correct?? Kevin

Thanks for the response Graham, So, what you are saying is that instead of doing event collection make them informational alerts...that way SCOM can catch a flood with the 5399 and will temporarily suspend alerting from that server if a flood does occur... Is that correct?? Kevin

Hi Kevin Yep - I would think this would be less of an administrative burden than disabling the alert rules and creating event collection rules and has built in protection against alert storms. It depends if you can live with them being informational alerts? Cheers GrahamView OpsMgr tips and tricks at http://systemcentersolutions.wordpress.com/