We are starting a series of “OpsMgr by Example” blog posts. The intent is to provide both the 5,000 foot/meter perspective on what to do and show the details for a particular type of tuning performed in an example deployment.This first one is related to an Exchange MP deployment (not covering all of Exchange). We hope to follow-up with OpsMgr by Example posts for the AD MP, SQL MP, and potentially the Exchange Management Pack.Let’s begin by talking about configuring baselines. While tuning the OpsMgr 2007 Exchange 2003 Management Pack, the majority of the alerts generated were a result of the calculated baseline rules. The following is a step-by-step for how to configure the sensitivity of these rules to decrease the alert volume. But first a huge thanks to the explanation on this which started us down the path on how to do this tuning:http://www.eggheadcafe.com/software/aspnet/29844092/tuning-baselining-monitor.aspxThe following were the primary alerts that caused large amounts of volume in the OpsMgr environment:

• Information Store Transport Temp Table is outside the calculated baseline
• Mailbox Store Send Queue is outside the calculated baseline
• SMTP Local queue is outside calculated baseline
• SMTP Messages in the Queue Directory is outside calculated baseline
• SMTP Remote Queue is outside the calculated baseline
• SMTP Remote Retry Queue is outside the calculated baseline
• IS Virtual Bytes is outside the calculated baseline
• Number of RPC requests is outside the calculated baseline

Perform the following steps for all Alerts that are causing significant volume in your environment. Implement these one at a time. We recommend following the order listed, as it groups together the types of rules to make them easier to find. The steps that refer to the Exchange Queue will vary depending upon the rule and monitor changed. The first six alerts above are all part of the Exchange Queue, the last two are part of Exchange IS Service. Change each on both the monitor and rule level.Also, we strongly recommend you save your changes to an unsealed MP other than the Default management pack.Steps to resolve: (perform all of these steps for each Alert in your environment which needs to be tuned)

1. Find the rule that applies to the alert. (To find the rules, it’s easiest to change the scope to filter by the two areas that we need – which are the Exchange Queue and Exchange IS Service. Both of these are available when you click on scope and choose the option to view all targets. Then find rules with “Baseline Collection” as the start. This scopes it down to about 17 rules versus over 6000.) Details on the names of each of the above rules are listed below. Disable the rule by creating an override to set Enabled to False. 
2. Change the rule sensitivity to 2.81 (Right-click on the rule, Overrides, Override the rule, For all Objects of type: Exchange Queue, check the Sensitivity parameter and set it to 2.81 if it’s not already set to that value, click OK).
3. Find the monitor that applies to the alert. This can be found by searching or scoping to the type of object identified for the rule. Disable the monitor (Right-click on the monitor, Overrides, Disable the monitor for all objects of type: Exchange Queue, click yes to accept).
4. Change the monitor inner sensitivity to 2.81 (Right-click on the monitor, Overrides, Overrides the monitor, For all Objects of type: Exchange Queue, check the Inner Sensitivity parameter and set it to 2.81 if it’s not already set to that value, click Ok).
5. Change the monitor outer sensitivity to 3.31 (Right-click on the monitor, overrides, Overrides the monitor, For all Objects of type: Exchange Queue, check the Outer Sensitivity parameter and set it to 3.31 if it’s not already set to that value, click Ok).
6. Re-enable the monitor. (Right-click on the monitor, click on Overrides Summary, delete the override that says Type, Exchange Queue, Enabled, False).
7. Go back to the rule identified in step #1 and re-enable the rule. (Right-click on the rule, click on Overrides Summary, delete the override that says Type, Exchange Queue, Enabled, False).

Mapping for Alerts, Rules and Monitors:

UPDATE for the IS Virtual Bytes and RPC requests:After configuring the inner and outer sensitivities (Steps 4 and 5 in that article), several of the rules were still  generating large volumes of alerts. Those rules include:

• IS Virtual Bytes is outside the calculated baseline
• Number of RPC requests is outside the calculated baseline

The alerts were identified as “Above Inner Envelope.” To minimize their frequency, we previously changed both the rule and the monitor’s sensitivity from 2.81 to 3.31 on the overrides.From reading up on this sensitivity concept, it appears that increases to this value decreases the frequency of the alerts, as it decreases the sensitivity to the difference from the calculated baseline.In theory, if the 3.31 override was not sufficient, then one should next try 3.81; this is because the increase from 2.81 to 3.31 is an increase of .5; therefore another .5 increase seems logical if another value change is required. This is an extrapolation based on what we have seen so far, as we do not know the internal workings of the algorithm! The feedback we have seen indicates that 3.81 works quite well.