IBM Security QRadar

 View Only
  • 1.  Number of EPS is over purchased license.

    Posted Thu May 16, 2019 12:03 AM
    Hi 
    I've Qradar 3550 M4. Now number of EPS is over purchased license. I brought 500EPS but right now It's about 900EPS.  I know If number of EPS is over purchased license. EPS will keep on buffer then It will be proceeded following FIFO.

    Can I verify that EPS is kept on buffer by using CLI?
    and What's going on If number of EPS is over 1000 (Hardware supported only 1000EPS)

    Thank you

    ------------------------------
    MAC Strater
    ------------------------------


  • 2.  RE: Number of EPS is over purchased license.

    Posted Thu May 16, 2019 05:44 AM
    Hello MAC
    what i know that the buffer of QRADAR ibm is about 06 Go of storage which is enouthe for handelling 1000 eps, the probleme is if this over flow stell for a long periode will be a probleme. 
    good lock

    ------------------------------
    [Larbi] [Belmiloud]
    [Cyber Security]
    [Intervalle Technologies]
    [Algers] [Algeria]
    [+213551193200]
    ------------------------------



  • 3.  RE: Number of EPS is over purchased license.
    Best Answer

    Posted Thu May 16, 2019 08:36 AM
    to get answer to your request 

    please read this 
    IBM QRadar Event and Flow Burst Handling (Buffer)
    Ibm remove preview
    IBM QRadar Event and Flow Burst Handling (Buffer)
    How does QRadar handle events or flows that temporarily exceed my license limit?
    View this on Ibm >


    ------------------------------
    [Larbi] [Belmiloud]
    [Cyber Security]
    [Intervalle Technologies]
    [Algers] [Algeria]
    [+213551193200]
    ------------------------------



  • 4.  RE: Number of EPS is over purchased license.

    Posted Thu May 16, 2019 12:53 PM
    Thank you so much!

    ------------------------------
    MAC Strater
    ------------------------------