Highlighted
Contributor.
Contributor.
547 views

EPS

Hello am new to Arcsight. What is the difference between Peak EPS and Sustanined EPS?

Labels (1)
0 Likes
Reply
8 Replies
Highlighted
Acclaimed Contributor.
Acclaimed Contributor.

Re: EPS

Hi Aarif,

Peak EPS is the maximum EPS (Events/sec) and Sustained EPS is based on an average.

Thus if you need this information for licensing,  if you use

Sustained EPS, you have just to multiply by 60x60x24 (number of sec in one day) to have your EPD (Events/day) your license will accept.

Peak EPS, you have to divide by 2 before using the same calculation step as above.

I hope I have answered to your question.

Thanks

Kind Regards

Michael

0 Likes
Reply
Highlighted
Contributor.
Contributor.

Re: EPS

Thanks Michael. This was great help.

0 Likes
Reply
Highlighted
Acclaimed Contributor.
Acclaimed Contributor.

Re: EPS

Hi Aarif,

If you are agree, could you please choose helpful or correct for my answer to permit to the other to know it?

Thanks

Regards

Michael

0 Likes
Reply
Highlighted
Acclaimed Contributor.
Acclaimed Contributor.

Re: EPS

Michael and Arif,

  • For peak EPS the daily calculation is irrelevant. No point in multiplying to get a daily value. Peak is momentary Peak.

  • No current ArcSight product is licensed by peak EPS. The peak EPS sometimes mentioned in our collateral and calculated as twice the sustained EPS is just a guideline.


  • Your peak EPS can be as high as the hardware allows, as long as the sustained EPS, i.e. the daily average, is not exceeded. So for example an entry level ArcSight Express box licensed for 250 sustained EPS can have peaks of up to 15,000 EPS, the maximum supported by the HW (by the way, in practice, even higher).


  • How much peak vs. sustained would usually be? Depends on the fluctuation in your event rate. As said, the factor of two is suggested as a guideline only. The important factor is that even if normal rates fluctuate less, attacks tend to create big spikes and ArcSight licensing by sustained EPS ensures licensing does not block issue exactly when you most need the system.


~ Ofer

0 Likes
Reply
Highlighted
Acclaimed Contributor.
Acclaimed Contributor.

Re: EPS

Dear Ofer,

Thank you for this precision.

Someone has talked me what happens if you receive more Events as noticed by your ArcSight License?

I have seen in ArcSight Console EpsEventBreachCount, Is-it still used, the number of time you could receive more events?

It is not enough clear for me.

Could you please explain us how it works now. Events are dropped or not?

Thanks

Kind Regards

Michael

0 Likes
Reply
Highlighted
New Member.

Re: EPS

Hi Ofer,

What would be the Peak EPS or maximum EPS for a "Large" System as described here:

Enterprise Security Management Specifications, ArcSight ESM | HP® Official Site

"Large" System:

Processors: 32 cores

Memory: 128 GB RAM

Storage <= 8TB RAID 10 (15000 RPM)

0 Likes
Reply
Highlighted
Acclaimed Contributor.
Acclaimed Contributor.

Re: EPS

As noted above, the 15K limit for Express is a supported limit but not a real technical limit. i.e. if you call and say you have 17K EPS, we will not help you solve the issue.

On ESM the situation is more complex as anyone can pick their own HW and we do not define such an EPS as it is highly dependent on the content and interactive use of the system. So we never defined such a max number of ESM. Since his is very context specific I suggest contacting support if you think your EPS is not what you expect it to be or contacting the HP ESP account team if you want to find the way to get help sizing a new solution.

0 Likes
Reply
Highlighted
Respected Contributor.
Respected Contributor.

Re: EPS

just want to confirm, Average EPS and EPS means the same thing right?

0 Likes
Reply
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.