Event and flow processing capacity

The capacity of a deployment is measured by the number of events per second (EPS) and flows per minute (FPM) that IBM® QRadar® can collect, normalize, and correlate in real time. The event and flow capacity is set by the licenses that are uploaded to the system.

Each host in your QRadar deployment must have enough event and flow capacity to ensure that QRadar can handle incoming data spikes. Most incoming data spikes are temporary, but if you continually receive system notifications that indicate that the system exceeded the license capacity, you can replace an existing license with a license that has more EPS or FPM capacity.