/var/log/eps.log

/var/qradar.log

/var/log/qradar.log

/var/log/qradar.old

Restart the hostcontext service

Re-add all managed hosts

Restart the docker service

Delete all users

Excessive events in a spike cause a System Notification that advises the customer to increase their EPS license allocation.

QRadar EPS license allocation is implemented with a hard cutoff to ensure resources are not saturated.

During the spike, excess events are written to a queue, and they are processed after the EPS rate drops.

QRadar EPS licensing is measured as an average over a 24-hour period, which allows spikes to be handled gracefully.