System requirements for virtual appliances

To ensure that IBM® QRadar® works correctly, you must use virtual appliances that meet the minimum requirements.

For more information about supported hypervisors and virtual hardware versions, see Creating your virtual machine.

Note: The minimum requirements support QRadar functionality with minimum data sets and performance. The minimum requirements support a QRadar system that uses only the default apps. For optimal performance, use the suggested requirements.

QRadar Incident Forensics is installed from a separate ISO than other QRadar appliances. For more information about installing QRadar Incident Forensics as a virtual appliance, see Virtual appliance installations for QRadar Incident Forensics.

Memory requirements

The following table describes the memory requirements for virtual appliances.

Table 1. Minimum and suggested memory requirements for QRadar virtual appliances
Appliance Minimum memory requirement Suggested memory requirement
QRadar QFlow Virtual 1299 6 GB 6 GB
QRadar Data Node Virtual 1400 appliance 24 GB 48 GB
QRadar Event Collector Virtual 1599 12 GB 16 GB
QRadar SIEM Event Processor Virtual 1699

up to 20,000 EPS

12 GB 48 GB
QRadar SIEM Event Processor Virtual 1699

20,000 EPS or higher

128 GB 128 GB
QRadar SIEM Flow Processor Virtual 1799

up to 1,200,000 FPM

12 GB 48 GB
QRadar SIEM Flow Processor Virtual 1799

1,200,000 FPM or higher

128 GB 128 GB
QRadar SIEM Event and Flow Processor Virtual 1899

5,000 EPS or less

200,000 FPM or less

12 GB 48 GB
QRadar SIEM Event and Flow Processor Virtual 1899

30,000 EPS or less

1,000,000 FPM or less

128 GB 128 GB
QRadar SIEM All-in-One Virtual 3199

5,000 EPS or less

200,000 FPM or less

32 GB 48 GB
QRadar SIEM All-in-One Virtual 3199

30,000 EPS or less

1,000,000 FPM or less

64 GB 128 GB
QRadar Log Manager Virtual 8099 24 GB 48 GB
QRadar Risk Manager 24 GB 48 GB
QRadar Vulnerability Manager Processor 32 GB 32 GB
QRadar Vulnerability Manager Scanner 16 GB 16 GB
QRadar App Host 12 GB 64 GB or more for a medium sized App Host

128 GB or more for a large sized App Host

Processor requirements

The following table describes the CPU requirements for virtual appliances.

Table 2. CPU requirements for QRadar virtual appliances
QRadar appliance Threshold Minimum number of CPU cores Suggested number of CPU cores
QRadar QFlow Virtual 1299 10,000 FPM or less 4 4
QRadar Event Collector Virtual 1599 5,000 EPS or less 8 16
20,000 EPS or less 19 19
QRadar SIEM Event Processor Virtual 1699 2,500 EPS or less 4 24
5,000 EPS or less 8 24
20,000 EPS or less 16 24
40,000 EPS or less 40 40
80,000 EPS or less 56 56
QRadar SIEM Flow Processor Virtual 1799 150,000 FPM or less 4 24
300,000 FPM or less 8 24
1,200,000 FPM or less 16 24
2,400,000 FPM or less 48 48
3,600,000 FPM or less 56 56
QRadar SIEM Event and Flow Processor Virtual 1899 200,000 FPM or less

5,000 EPS or less

16 24
300,000 FPM or less

15,000 EPS or less

48 48
1,200,000 FPM or less

30,000 EPS or less

56 56
QRadar SIEM All-in-One Virtual 3199 25,000 FPM or less

500 EPS or less

4 24
50,000 FPM or less

1,000 EPS or less

8 24
100,000 FPM or less

1,000 EPS or less

12 24
200,000 FPM or less

5,000 EPS or less

16 24
300,000 FPM or less

15,000 EPS or less

48 48
1,200,000 FPM or less

30,000 EPS or less

56 56
QRadar Log Manager Virtual 8099 2,500 EPS or less 4 16
5,000 EPS or less 8 16
QRadar Vulnerability Manager Processor   4 4
QRadar Vulnerability Manager Scanner   4 4
QRadar Risk Manager   8 8
QRadar Data Node Virtual 1400 appliance   4 16
QRadar App Host   4 12 or more for a medium sized App Host

24 or more for a large sized App Host

Storage requirements

Your virtual appliance must have at least 256 GB of storage available.

The following table shows the storage requirements for installing QRadar by using the virtual or software only option.

Table 3. Minimum storage requirements for appliances when you use the virtual or software installation option.
System classification Appliance information IOPS Data transfer rate (MB/s)
Minimum performance Supports XX05 licensing 800 500
Medium performance Supports XX29 licensing 1200 1000
High Performance Supports XX48 licensing 10,000 2000
Small All-in-One or 1600 Less than 500 EPS 300 300
Event/Flow Collectors Events and flows 300 300