Scaling QRadar deployments
Every component has limited resources and, hence, a threshold capacity to collect and process data. Data, as we know, is ingested in the form of events and flows. So, every component has a limit on the number of flows and events that the component can collect and process. These thresholds are measured in terms of EPS and FPM. However, there are ways to scale your deployment. Let’s see what they are in the following sections.
Scaling by adding data nodes
If data – that is, the events and flows – have to be retained for more time than planned, what is needed is more disk space. You can also add processors to the deployment and move a few log sources to the new processor. However, this is not the ideal solution in this case. What you should use is the data node. Adding a data node to a processor and/or the Console will not only provide more disk space to store data but also help searches to become faster.
