It starts out initially as a simple warning, however if they remain in violation for too long (a week) it will begin replacing the identification information with 'License Violation' some of the time - specifically, the application name and application group. Detailed information on flow rate averages versus peaks can be seen by Using Extreme Controls Analytics Application Flow Rates tool to determine flow capacity requirements for network
Once data is in violation - adding a license that covers the amount of data that was violated does not
retrieve the data in violation. It is stored and marked as such.