Use the License Pool Management window to ensure that the events per
second (EPS) and flows per minute (FPM) that you are entitled to is fully used. Also, ensure that
IBM®
QRadar® is configured to
handle periodic bursts of data without dropping events or flows, or having excessive unused EPS and
FPM.
Before you begin
Ensure that the license pool has enough unallocated EPS or FPM. If the EPS or FPM in the
license pool is fully allocated, redistribute the allocations.
About this task
Proper allocation of EPS and FPM capacity is important to ensure that QRadar processes all events and
flows in a timely manner. The goal is to allocate EPS and FPM so that the host has enough capacity
to process data spikes efficiently, without having excessive idle EPS and FPM capacity.
Procedure
-
On the
navigation menu (
), click
Admin.
-
In the System Configuration section, click .
-
From the Display list, select Licenses.
-
Click License Pool Management and hover the mouse over the circle charts
to see the total capacity for the deployment.
-
In the License Allocations table, review the data to determine whether
the appliance has enough event and flow capacity to cover the average EPS and FPM, and still have
enough left to cover the peak volumes.
Learn more about reviewing the event and flow capacity data:
- The EPS Allocation and FPM Allocation columns show
the capacity that is assigned to each QRadar processor or QRadar console.
- The Average EPS and Average FPM columns show the
average number of events and flows that were processed by the QRadar host over the last 30 days.
- Click the host name to view the details about the peak EPS and FPM rates for the past 30 days.
-
To change the allocated EPS or FPM rate for the QRadar host, click the edit
icon.
-
Update the Allocated EPS or Allocated FPM field,
and click Save.
The revised EPS and FPM allocations are validated against these criteria:
- The EPS allocation must be a multiple of 100, and the FPM allocation must be a multiple of
5,000.
- The allocated EPS or FPM cannot cause the license pool to be over-allocated.
- The allocated EPS or FPM cannot exceed the hardware limits for the appliance type.
If your changes are not allocated correctly, click
.
If the issue persists, click
. If there are SourceMonitor Warning messages in the QRadar logs, click
. A full deployment causes event collection to stop
for several minutes.