MOM optimization

In my ever continuing quest to reduce the number of (unwanted) events in our MOM and reporting database I turned my attention to the events that are entered in the database.

From time to time I’m running some SQL queries on the MOM reporting database to check which servers are the top event generators.
I know there are some nice reports for it, but the SQL approach gives me some extra info I don’t get when running the reports.

For example, I have a query which returns the top 100 events from the database.
To my surprise a lot of them were related to IIS error 401.
Almost all errors where that the _vti_bin/owssvr.dll couldn’t be found.

After some googling I found out that this DLL was used by Office Server Extensions and Internet Explorer for the discussion button. It seems that everytime IE connects to a website it checks if there is a possibility to use the discussion functionality.

Based on info from http://www.it-jedi.net/2006/04/tuning-http-400-and-500-rules-in-iis.html I changed the existing rules so that events mentioning the owssvr.dll were not entered into the database. This saves us about 5300 events per 24 hours. Every little bit is useful :)