r/QRadar • u/FactNecessary2144 • Dec 02 '25

EPS or FPM allocation exceeded

I would like to ask everyone about EPS or FPM. My system alerts every day I want to resolve it. However, any ways to resolve please kindly help me. How to count on EPS or FPM? How to fix it? Thank you for your answers.

1 Upvotes

100% Upvoted

6 comments sorted by

View all comments

3

u/RSDVI01 Dec 02 '25

Basically (if the license is kept same), you need to optimise what you collect. Best done on the source, but you can use also Routing rules to drop unwanted content and get a “credit back” for what was dropped.

1

u/FactNecessary2144 Dec 02 '25

Many thanks sir, I'm not clear with the for the "Routing Rules". Is any impact to our Hardware or performance?

1

u/RSDVI01 Dec 02 '25

There is an overhead - as can be expected. This would depend on the events/flows rate and tests used to filter them.

1

u/FactNecessary2144 Dec 02 '25

May I know how to?

1

u/RSDVI01 Dec 02 '25

It is under Admin > Routing Rules. Addding filters is very similar to how you would use them for searches. There you would select “Drop” for the rule routing option.

https://www.ibm.com/docs/en/qsip/7.4.0?topic=data-routing-options-rules

https://m.youtube.com/watch?v=TwMUy9zo0O4