Shared license pool
The EPS and FPM rate that is set by each license is combined into a shared license pool. From the shared license pool, you can distribute the processing capacity to any host within a specific deployment or that is managed by a single console, regardless of which host the original license is allocated to.
By adjusting the allocation of the shared license pool, you ensure that the event and flow capacity is distributed according to the network workload, and that each QRadar host has enough EPS and FPM to effectively manage periods of peak traffic.
In deployments that have separate event collector and event processor appliances, the event collector inherits the EPS rate from the event processor that it is attached to. To increase the capacity of the event collector, allocate more EPS from the shared license pool to the parent event processor.
Contributions to the license pool
A license that includes both event and flow capacity might not contribute both the EPS and FPM to the shared license pool. The license pool contributions are dependent on the type of appliance that the license is allocated to. For example, when you apply a license to a 16xx Event Processor, only the EPS is added to the license pool. The same license, when applied to a 17xx Flow Processor, contributes only the FPM to the license pool. Applying the license to an 18xx Event/Flow Processor contributes both EPS and FPM to the pool. With exception of software licenses for event or flow collectors, all software licenses contribute both the EPS and FPM to the shared license pool, regardless of which type of appliance the license is allocated to.
As of QRadar V7.3.2, you can now acquire stackable EPS/Flow increments instead of replacing existing console or other managed hosts license when you need to increase the overall event or flow thresholds of your deployment. After the licenses are uploaded and deployed, the event/flow capacity can then be reallocated through the License Pool Management.
Exceeding your licensed processing capacity limits
The license pool becomes over-allocated when the combined EPS and FPM that is allocated to the managed hosts exceeds the EPS and FPM that is in the shared license pool. When the license pool is overallocated, the License Pool Management window shows a negative value for the EPS and FPM, and the allocation chart turns red. QRadar blocks functionality on the Network Activity and Log Activity tabs, including the ability to view events and flows from the Messages list on the main QRadar toolbar.
To enable the blocked functionality, reduce the EPS and FPM that you allocated to the managed hosts in your deployment. If the existing licenses do not have enough event and flow capacity to handle the volume of network data, upload a new license that includes enough EPS or FPM to resolve the deficit in the shared license pool.
Expired licenses
When a license expires, QRadar continues to process events and flows at the allocated rate.
If the EPS and FPM capacity of the expired license was allocated to a host, the shared resources in the license pool might go into a deficit, and cause QRadar to block functionality on the Network Activity and Log Activity tabs.