Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

Distributing Event and Flow Capacity

Use the License Pool Management window to ensure that the deployment is configured to use all of the events per second (EPS) and flows per minute (FPM) that you are entitled to. Also, ensure that JSA is configured to handle periodic bursts of data without dropping events or flows, or without having excessive amounts of unused EPS and FPM.

Ensure that the license pool has enough unallocated EPS or FPM. If the EPS or FPM in the license pool is fully allocated, redistribute the allocations.

Proper allocation of EPS and FPM capacity is important to ensure that JSA processes all events and flows in a timely manner. The goal is to allocate EPS and FPM so that the host has enough capacity to process data spikes efficiently, without having excessive idle EPS and FPM capacity.

  1. On the navigation menu (), click Admin.
  2. In the System Configuration section, click System and License Management.
  3. From the Display list, select Licenses.
  4. Click License Pool Management and hover the mouse over the circle charts to see the total capacity for the deployment.
  5. In the License Allocations table, review the data to determine whether the appliance has enough event and flow capacity to cover the average EPS and FPM, and still have enough left to cover the peak volumes.

    Learn more about reviewing the event and flow capacity data:

    • The EPS Allocation and FPM Allocation columns show the capacity that is assigned to each JSA processor or JSA console.

    • The Average EPS and Average FPM columns show the average number of events and flows that were processed by the JSA host over the last 30 days. The calculations use the Event Rate (EPS) and Flow Rate (FPS) saved searches. On deployments where the saved searches were deleted, the average event and flow rates appear as N/A.

    • Click the host name to view the details about the peak EPS and FPM rates for the past 30 days.

  6. To change the allocated EPS or FPM rate for the JSA host, click the edit icon.
  7. Update the Allocated EPS or Allocated FPM field, and click Save.

    The revised EPS and FPM allocations are validated against these criteria:

    • The EPS allocation must be a multiple of 500, and the FPM allocation must be a multiple of 5,000.

    • The allocated EPS or FPM does not cause the license pool to be over-allocated.

    • The allocated EPS or FPM does not exceed the hardware limits for the appliance type.

If your changes are not allocated correctly, click Admin > Advanced > Restart Event Collection Services.

If the issue persists, click Admin > Advanced > Deploy Full Configuration. If there are SourceMonitor Warning messages in the JSA logs, click Admin > Advanced > Restart Event Collection Services. A full deployment causes event collection to stop for several minutes.

Related Documentation