IBM QRadar

Hi guys

You could install the QRadar Self monitoring content pack that contains a pulse dashboard that monitors the EPS rate average and the EPS rate max.
The widgets contain an AQL query that you can modify to specify the time and period you want to look at.
I posted a screenshot of the widgets in this blog: How are you checking your QRadar deployment ? Refer to the section "How can I have an idea on the number of events per second I am receiving in real time".

I hope this will help

------------------------------
Javier Huaman

Original Message:
Sent: Wed February 09, 2022 08:33 AM
From: Gladys Koskas
Subject: EPS Calculation

Hi guys

You could install the QRadar Self monitoring content pack that contains a pulse dashboard that monitors the EPS rate average and the EPS rate max.
The widgets contain an AQL query that you can modify to specify the time and period you want to look at.
I posted a screenshot of the widgets in this blog: How are you checking your QRadar deployment ? Refer to the section "How can I have an idea on the number of events per second I am receiving in real time".

I hope this will help

------------------------------
Gladys Koskas

Original Message:
Sent: Wed February 09, 2022 08:13 AM
From: Karl Jaeger
Subject: EPS Calculation

Thank you, excellent explanation. I just added our standard XLS for doing exactly that. It calculates EPS and storage based on EPD and average event size.
If you already got Qradar just look at system monitoring dashboard event rate widget and drill down into log activity for details for determining current workload. Top log sources will give you the chance to add filter value for your new logsource and fill in the XLS sheet EPD column (24h event count). Add number of systems for your future workload and compare to what you currently got.

------------------------------
[Karl] [Jaeger] [Business Partner]
[QRadar Specialist]
[pro4bizz]
[Karlsruhe] [Germany]
[4972190981722]

Original Message:
Sent: Tue February 08, 2022 07:42 AM
From: hostcontext restart
Subject: EPS Calculation

Enable the logging for one of the servers, and get a count of non
coalesced events for the server for 24 hours or longer and average
that down to EPS using 86400 seconds per day

(Number of events per day / 86400 seconds)

you could run this for a series and graph out averages, spreads and
standard deviations if you like.


Take either the one sample day or average of days, multiply by number
of servers to add assuming the same logging workload. I always try to
round EPS to nearest 100,1000 or 2.5K for purchasing reasons. I also
like to add 10% for bursting.

example:
one server was 90 EPS average
(90 EPS average)x(10 servers)=900EPS add 10% 990EPS, round to 1000 EPS.


Original Message:
Sent: 2/8/2022 7:34:00 AM
From: Asif Siddiqui
Subject: EPS Calculation

Hi All,

We have a requirement where we need to check or calculate how much is increase in the EPS. 
There are 10 windows servers where we are enabling additional logs which will get forwarded to Qradar. Now we need to see how much is the impact on EPS and how much is the increase.

Can anyone tell me the easy method to calculate or estimate the increase in EPS (also how much is the percentage increased)


Regards
Asif Siddiqui

------------------------------
Asif Siddiqui Senior Security Analyst
------------------------------