How to check for an event storm by using MOM 2005 Reporting

When you turn on a new rule, or when you import a new management pack in Microsoft Operations Manager (MOM) 2005, the size of the MOM 2005 OnePoint database may increase. This behavior may be caused by an event storm where multiple client computers produce a large amount of the same events or alerts. Then, these events or alerts are inserted into the OnePoint database.

The following steps can help you identify the client computers that produce the events or alerts in addition to what type of events or alerts are produced:

1. Log on to a computer that has the MOM Administrator console installed by using an account that has administrative permissions.
2. Click Start, point to All Programs, click Microsoft Operations Manager 2005, and then click Administrator Console.
3. In the MOM Administrator console, click Operations, in the results page, click Start Reporting Console.
4. On the Microsoft Operations Manager Reporting Web page, click Operational Health Analysis.
5. Click Most Common Events by Computer Group to view the most common events that are produced by a specific computer group.
6. Click Most Common Alerts by Alert Count to view the most common alerts.