Working with Zenoss support, we eventually came up with a solution.
Some of the bad counters were due to monitoring devices that really didn't need to be (or couldn't be) monitored. (Eg. BASP adapters have no perfmon counters, so they cannot be monitored properly. The 100MB logical disk that comes on some systems also is not necessary.)
Support suggested those counters get dropped automatically.
Go into: http://zenoss_server:8080/zport/dmd/Events/Status/Wmi/eventClassStatus and click the gear icon in the bottom left. Click Transform.
This is the transform script I used to drop my bad counters. Note, some of these bad counters (I feel) come from someone incorrect WMI monitoring templates (AKA using Exchange 2007 monitoring templates to monitor Exchange 2010).
if evt.summary.startswith("Bad counter for device"):
if evt.summary.endswith("Active Sessions"):
evt._action = "drop"
if "Microsoft Failover Cluster Virtual Adapter" in evt.summary:
evt._action = "drop"
if "SQLServer" in evt.summary:
evt._action = "drop"
if "LogicalDisk" in evt.summary:
evt._action = "drop"
if "Web Service" in evt.summary:
evt._action = "drop"
if "BASP Virtual Adapter" in evt.summary:
evt._action = "drop"
if "MSExchangeTransport Queues" in evt.summary:
evt._action = "drop"
if "SMTP Server" in evt.summary:
evt._action = "drop"
if "MSExchangeIS" in evt.summary:
evt._action = "drop"
if "Paging File" in evt.summary:
evt._action = "drop"
if "Could not read the Windows" in evt.summary:
evt.severity = 5
Modify the script for your needs. This script will only drop events that have the Bad Counters, not other valid alerts.
