What occurs when QRadar reaches the events per second (EPS) or flows per minute (FPM) shared license pool limits?

When the rate of incoming events or flows exceeds the licensed Events Per Second (EPS) or Flows Per Minute (FPM) limit, IBM QRadar activates its burst handling mechanism. Instead of dropping the excess data immediately, it is placed into a temporary buffer or queue. QRadar continues to process data from the queue at the maximum licensed rate. This feature is designed to manage short-term spikes in data volume without data loss. A system notification is also generated to alert administrators that the license limit has been exceeded. If the high data rate persists and the queue fills to capacity, new events or flows will then be dropped.

A. Incremental Licensing is a specific license type that allows for temporary increases, but it does not remove the fundamental EPS and FPM limits.

B. QRadar generates a notification, but it does not stop processing. Stopping processing would lead to a critical loss of security visibility.

D. This statement is too general. While processing continues, it is constrained by the license limit, and this option omits the critical detail of data being queued.

1. IBM QRadar SIEM Documentation, "Administering QRadar", Section: "Event and flow license overage".

Reference: "When you exceed your licensed events per second (EPS) or flows per minute (FPM) limit, QRadar does not stop processing the data. The extra data is placed into a buffer, or queue, and a system notification is generated to alert you that you are over your license. The data in the buffer is processed when the data rate falls below your licensed limit." This directly supports the queuing mechanism described in the correct answer.

2. IBM Redbooks, "IBM Security QRadar SIEM Implementation" (SG24-8176-01), Chapter 2, Section 2.4.2 "Licensing".

Reference: "QRadar has a burst handling capability that allows events to be queued temporarily if the licensed EPS rate is exceeded for a short period. If the EPS rate is exceeded for a longer period, the queue can fill up, and events are dropped." This confirms that queuing is the primary response to exceeding the license limit.

3. IBM QRadar SIEM Documentation, "Troubleshooting System Notifications", Section: "Health metric: Average EPS rate (last 1 minute) has exceeded the licensed EPS rate".

Reference: "When the number of incoming events or flows exceeds the license limits, QRadar queues the extra events and flows to be processed later. A queue is used to handle data bursts that exceed the license." This document explains the system notification and explicitly mentions the queue for handling bursts.