Hi!.

Please, a very quick question.

In a distributed QRadar infrastructure with: two EventCollectors, an EventProcessor and a Console.

If both, the EventProcessor and the Console are poweroff. Is there some kind of buffer or temporary file where the EventCollectors store temporarly the inbound events?.

Thank you.

Regards.

Hello!

This was the response we had got for the same query raised

The 5 GB limit is for the license filter spillover queue - this comes into play if the Event Collector is receiving more raw events than it is licensed for.

There is a separate on-disk queue used when the EC cannot reach the downstream EP. That queue will basically fill until there is no disk space left - it actually stops at 93% or 95% or something like that, but as opposed to the license spillover it is effectively unbounded. When the EP comes back up, all the events will be sent at that time.

https://www.ibm.com/support/pages/qradar-event-and-flow-burst-handling-buffer

T&R

Hello.

Great!.

Thank you so much.

Regards.