Absent Member.
Absent Member.

Over EPS License

Hi Guys,

This question is just something which I am curious about after reading
something in the SLM documentation. So if a customer was to exceed the
license which they have purchased for Sentinel, lets say for example
2500 EPS and they occasionally see a spike of say 2300EPS. Do the 100
extra events always get tagged as OverEPSLimit and omitted from reports,
searches etc? Or is it only after a given time of exceeding the EPS

I read the following with regard to the free 25EPS license, and wondered
if it applied to enterprise licenses, and after what threshold does it
happen ie. from event 2501 and onward or is it only in the case of a
rolling average exceeding the licensed amount?

> Event Store: The authorized event rate after the license expires is 25
> EPS. Any events received while the system averages more than 25 EPS are
> stored, but the details of those events are not displayed in the search
> results or reports. These events are tagged with the OverEPSLimit tag.


alanforrest's Profile: https://forums.netiq.com/member.php?userid=363
View this thread: https://forums.netiq.com/showthread.php?t=46379

1 Reply
Absent Member.
Absent Member.

Re: Over EPS License

I believe the answer that follows is correct, but it is probably worth

The OverEPS bit happens for the 25-EPS-limited system only. Why? Because
it's free, a trial, and not ever going to be audited; plus, it runs
forever. Without this there is no incentive to eventually pay for
something, or to keep your event rate down.

With real licenses (500, 2500, 7500, etc.) I believe all events always
show up properly, but Sentinel provides those little auditing report
exports for auditors to come and let you know you're over enough to
justify increased payments; they know you have a real license because you
paid for it. Not a big deal... I know it is not a simple '2501 events
within a single second and then calm for all time before and after causing
a problem.... the exact wording/ruling is not coming to me, though. I
want to say it's an average of an hour being over (because that's what the
licensing graph shows... hourly increments, though maybe the actual export
sent to auditors is more granular), and then that happening three times in
a ninety-day period.... something like that. Anyway, it's reasonable, or
seems to be reasonable to me.

If you're going to be over regularly, go for the higher license. If you
do not want to go for the higher license, limit your event rate before
Sentinel ever sees events at all (not just the ESM filtering... filter on
the actual sources of events).

I'm sure Cheryl knows the real answer, so maybe she'll drop by and answer

Good luck.
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.