IBM QRadar

 View Only

 EPS limit in tenant management is not working?

bao nguyen dang tuan's profile image
bao nguyen dang tuan posted Thu April 24, 2025 12:35 AM

Hi everyone,

I help a issue with EPS limit feature in tenant management in my lab.

A new tenant had created, I set the eps limit of this tenant is 1 eps and 0 eps to tested that feature. Then I assign it to the domain which have a EC of AIO. But the eps is not limit according to the EPS I set,  it doesn't even change. Pls help me resolv this issue.

Rory Bray's profile image
Rory Bray

Can you do a search that shows the domain for events that you expect to be in tenant 1?

bao nguyen dang tuan's profile image
bao nguyen dang tuan

Hi Rory,

I use this AQL query to show eps of domain:
select DOMAINNAME(domainid) as LogSource, sum(eventcount) / (24*60*60) as EPS from events group by domainid order by EPS desc last 24 hours

And it is not a rate according to my config.

Rory Bray's profile image
Rory Bray

It's quite likely that trying to limit to 1 EPS isn't going to be very effective. When limiting rates we don't count per event, we count the EPS in an interval (~ 1/2 a second) and then apply the throttle or drop.  So, it's entirely possible that you're getting a lot of events in 1/2 to one second. Try 100 or 200 instead and query over a shorter interval to see the results.