Saving all event data to a Data Node appliance

To improve the performance of an event processor, configure IBM QRadar to save all event data on a Data Node appliance. With this configuration, the event processor only processes events; it doesn't store event data locally.

An event processor that is configured to only process events still saves event data locally when no active Data Node appliances are available. When a Data Node appliance becomes available, QRadar transfers as much data as possible from the event processor to the Data Node.

Procedure

  1. On the navigation menu ( Navigation menu icon ), click Admin.
  2. In the System Configuration section, click System and License Management.
  3. In the Display list, select Systems.
  4. Select the Event Processor from the host table, and on the Deployment Actions menu, click Edit Host.
  5. Click the Component Management settings icon (Gear icon for component management settings).
  6. Under Event Processor, in the Event Processor Mode field, select Processing-Only.
  7. Click Save, and then click Save again.
  8. On the Admin tab, click Deploy Changes.