Hello,

I am trying to get an "accurate" value about the EPS consumption.

There are two types of logs that report EPS values: StatFilter:

and SourceMonitor:

I noticed that the SourceMonitor events usually have higher values than the StatFilter events.

Which one has the closest value to the real EPS consumption?

In terms of the event pipeline, which one comes first: the SourceMonitor or the statFilter?

Thanks,

Salma

The SourceMonitor value is detected before any kind of analysis is applied by the various qradar engines, so it contains not only the EPS given by the logs received from the Log Source but also the 50-55EPS of logs generated by the collector itself (Health Metrics and the like) and any giveback given by any routing rules; this is why the StatFilter is always lower, because it should give you a "clean" value from all the extras (system logs+routing rules), but in reality I never get the numbers, probably because of the average calculations it makes. Let's say that the most accurate value is the source monitor but you always have to remember to subtract the giveback to get the exact value. I normally count the SourceMonitor value over 60 seconds (also because the log is generated every 60 seconds) and the Peak EPS by subtracting the giveback (tail -f /var/log/qradar.log | grep giveback). Peak EPS is more useful if you are in a multi-tenant environment, otherwise the value for the last 60 seconds is sufficient.

This link would be useful:

https://www.ibm.com/support/pages/qradar-event-rate-eps-graph-may-not-reflect-entire-event-load-system#about

Rocco

Just to add on to what Rocco posted.

This is a really good article that you should take a look at as we often get this question in support about Peak vs Avg in support. These queries used in the technical note look at the metric ID values from the payloads of the Health Metrics DSM.

Thanks Support Member,

It is less ambiguous for me now.

However, when i try to do the math with those values i get lost again.

Example of values from the system logs in minute X:

SourceMonitor (60s) = 5821

StatFilter (60s) = 1855

Giveback = 1367

EPS for external log sources in minute X = 1809

Now, I would say that the "accurate" EPS is the one from StatFilter.

but, the sum of StatFilter and the Giveback is way less than the SourceMonitor (3222 <<< 5821 ) I wonder where the 2599 EPS are?

Thanks again.

Salma