Hi Guys,

This question is just something which I am curious about after reading
something in the SLM documentation. So if a customer was to exceed the
license which they have purchased for Sentinel, lets say for example
2500 EPS and they occasionally see a spike of say 2300EPS. Do the 100
extra events always get tagged as OverEPSLimit and omitted from reports,
searches etc? Or is it only after a given time of exceeding the EPS

I read the following with regard to the free 25EPS license, and wondered
if it applied to enterprise licenses, and after what threshold does it
happen ie. from event 2501 and onward or is it only in the case of a
rolling average exceeding the licensed amount?

> Event Store: The authorized event rate after the license expires is 25
> EPS. Any events received while the system averages more than 25 EPS are
> stored, but the details of those events are not displayed in the search
> results or reports. These events are tagged with the OverEPSLimit tag.


alanforrest's Profile: https://forums.netiq.com/member.php?userid=363
View this thread: https://forums.netiq.com/showthread.php?t=46379