Increase the Event Hubs partition count

If you need to increase the partition count of Azure Event Hubs to accommodate higher throughput requirements, this can be completed after the initial configuration. The available methods for increasing the partition count depends on your Azure Event Hubs pricing tier and may require different approaches based on your specific configuration.

For more information about Azure Event Hubs partition limits and tiers, see Azure Event Hubs quotas and limits.

These actions are required:

These resources are required:

  • An Azure subscription with appropriate permissions to:
    • Create and configure Azure Event Hubs resources
  • An Azure tier of Standard or higher
    Note: The Basic tier does not support the Kafka protocol for Event Hubs. For more information, see Azure Event Hubs quotas and limits.
  • Administrator permissions for the Microsoft Azure portal
Do one of these actions:

Scale up the partition count

You can directly scale up the partition count if you have a Premium or Dedicated tier.

Note: The Standard tier does not support dynamic partition scaling.
  1. Sign in to Microsoft Azure portal with administrator permissions.
  2. In the search field, search for and click Event Hubs.
  3. Click the Event Hubs namespace that you want to update.
  4. In the navigation menu, click Scale.
  5. Increase the partition count to the desired amount.
  6. Click Save.

Recreate the event hub

If you have a Standard tier, you must delete and recreate the event hub with a higher partition count.

CAUTION: Because the event hub must be deleted and recreated, any logs that are in flight or have not yet been ingested will be permanently lost. You can expect a brief ingestion gap while the event hub is offline.

These actions are required:

  • Notify Arctic Wolf Support about the planned maintenance window
  1. Document your current event hub configuration in a safe location. Make sure to record the exact event hub name, consumer group names, replay consumer group name, connection strings, access policies, and retention settings.
  2. Delete the existing event hub:
    1. Sign in to Microsoft Azure portal with administrator permissions.
    2. In the search field, search for and click Event Hubs.
    3. Click the Event Hubs namespace with the event hub that you want to delete.
    4. Click the Overview tab.
    5. Click Delete.
    6. In the Delete Event Hub window, enter the event hub name to confirm deletion.
  3. Create a new event hub with the same name and a higher partition count than the event hub that you just deleted.
    To create a new event hub, see Create an event hub for Microsoft Defender XDR.
    CAUTION: Make sure to use the exact event hub name of the deleted event hub to make sure that Microsoft Defender XDR configuration is not broken. Casing is important.
  4. Recreate the consumer groups from the deleted event hub in the new event hub.
    For more information, see Create a replay consumer group.
  5. Verify that your registered application still has Azure Event Hubs Data Receiver permissions. If it does not, update the application permissions.
    For more information, see Assign Event Hubs permissions to the application.