What happens if QRadar receives events at a higher rate than the license allows?

Question

Options

• AThe events will be put into queues
• BThe source system will be asked to resend the events later
• CThe events will not be parsed
• DThe events will be dropped immediately

• A
  74% (29)
• B
  8% (3)
• C
  15% (6)
• D
  3% (1)

Explanation

When QRadar receives events at a rate exceeding the licensed Events Per Second (EPS) limit, it places the overflow events into internal queues rather than discarding them - this is a deliberate design choice to avoid data loss while still enforcing licensing boundaries. Option B is wrong because QRadar has no mechanism to instruct source systems (like firewalls or servers) to pause and resend; those systems simply transmit logs without negotiating. Option C is wrong because parsing is a separate pipeline stage - events that exceed EPS limits are held before parsing, not denied parsing specifically. Option D is wrong because immediate dropping would be destructive to security investigations; queuing is the safer, more practical approach IBM implemented.

Memory tip: Think of QRadar's EPS limit like a highway toll booth - cars (events) that arrive faster than the booth can process don't get turned away or sent back; they form a queue and wait their turn.

No community discussion yet for this question.