QRadar xx48 M5 appliance

The IBM® QRadar® xx48 (MTM 4412-Q3B) captures logs from sources that generate a large amount of traffic without a need for load balancing.

The QRadar xx48 appliance handles the higher levels of performance that are required by enterprise class clients. For example, companies can use the QRadar xx48 for the following requirements:

  • A company wants faster processing to search and analyze a large amount of data.
  • A company wants to reduce the footprint of an IBM QRadar deployment, so they install QRadar xx48 appliances to reduce rack space.

The following appliances are examples of appliance types that you can use the QRadar xx48 for:

  • QRadar Event Processor 1648
  • QRadar Flow Processor 1748
  • QRadar Event and Flow Processor 1848
  • QRadar 3148 (All-in-One)
  • QRadar 3148 (Console)
  • QRadar App Host
  • QRadar 1400 Data Node

You can configure the QRadar xx48 as a QRadar Event Collector 1501 (sometimes referred to as 1548). The default EPS threshold (capability) on M5 xx48 appliances is 56,000. This value can be overridden to values not exceeding 80,000 by completing the following steps.

  1. Add EC_APPLIANCE_EPS_THRESHOLD_TEMPLATE=80000 to /opt/qradar/conf/nva.conf on the 1501 to increase the supported event rate to the desired level, subject to performance and license limitations.
  2. Restart ecs-ec-ingress on the appliance: systemctl restart ecs-ec-ingress.
  3. Perform a full deploy.

View hardware information and requirements for the QRadar xx48 in the following table:

Table 1. QRadar xx48 overview
Description Value
Maximum capacity

QRadar Event Collector 1501: 56,000 EPS (default) 80,000 EPS with override

QRadar Event Processor 1648: 80,000 EPS

QRadar Flow Processor 1748: 3,600,000 FPM

QRadar Event and Flow Processor 1848: 30,000 EPS, 1,200,000 FPM

QRadar 3148 (All-in-One): 30,000 EPS, 1,200,000 FPM
CPU 2 x E5-2680 v4 14C 2.4 GHz 35 MB 2400 MHz 120W
Network management transceivers

2 x 10 GbE Short Range SFP+

The transceivers might have one of the following part numbers:
  • Avago AFBR-709SMZ-IB8
  • Finisar FTLX8571D3BCL-BN
  • BNT BN-CKM-SP-SR

Use these transceivers with the 2 x 10 GbE SFP+ ports, labeled as [3] in the appliance diagram.
Ports

2 x 8 Gbps Fibre Channel HBA ports

4 x 10/100/1000 Base-T Ethernet ports

1 x RJ-45 10/100/1000 Mb Ethernet systems management (IMM) port

2 x 10 Gbps SFP+ ports
Memory 128 GB, 2133 MHz DDR4 RDIMM
Storage 6x 3.8 TB SSD
Power supply Dual redundant 900 W AC
Dimensions 31.5 inches deep x 17.5 inches wide (19 inches with EIA) x 3.4 inches high
Figure 1. QRadar xx48
Image showing the back and front panels of the QRadar xx48 appliance.
Table 2. Legend for use with the QRadar xx48 image
Label Description
1 Event data storage
2 1 x RJ-45 10/100/1000 Mb Ethernet systems management (IMM) port
3 Management ports (10 GbE SFP+)
4 Fibre channel ports (8 Gb SFP+)
5 Management ports (1 GbE TX)

For battery removal steps, see Removing the coin-cell battery (also called CMOS battery) (http://www-01.ibm.com/support/knowledgecenter/api/redirect/systemx/documentation/index.jsp?topic=/com.lenovo.sysx.8871.doc/t_removing_system_battery.html).

For more information about the front panel, see Front view (http://www-01.ibm.com/support/knowledgecenter/api/redirect/systemx/documentation/index.jsp?topic=/com.lenovo.sysx.8871.doc/c_front_view.html).

For more information about the back panel, see Rear view (http://www-01.ibm.com/support/knowledgecenter/api/redirect/systemx/documentation/index.jsp?topic=/com.lenovo.sysx.8871.doc/c_rear_view.html).

For more information, you can also see System x3650 M5 (https://lenovopress.com/lp0068-lenovo-system-x3650-m5-machine-type-8871.html).