FREE · NETWORK & IT INFRASTRUCTURE
Log & SIEM Storage Calculator.
Estimate events per second, daily log volume and hot and archive storage for a SIEM or log platform from your log sources.
Primary plus replicas in a cluster.
- Average events per second
- 1,140
- Peak events per second
- 3,420 Licences and ingestion are often sized on peak EPS
- Raw data per day
- 71.54 GB
- Hot storage
- 4.29 TB
- Archive storage
- 3 TB
- Events per year
- 35,951,040,000
Volume by source
| Source | Events/s | GB per day |
|---|---|---|
| Windows servers | 100 | 12.96 |
| Linux servers | 60 | 2.07 |
| Firewalls | 600 | 25.92 |
| Workstations | 200 | 20.74 |
| Network devices | 30 | 0.78 |
| Web proxy | 150 | 9.07 |
- Event rates and sizes vary greatly with audit policy and verbosity; measure a week of real data before buying licences or disks.
- Compliance rules (PCI DSS, ISO 27001, local laws) set minimum retention periods.
How to use Log & SIEM Storage Calculator
List sources with count, events per second and bytes per event, then set retention, hot-storage ratio, archive compression and replicas.
How it works
Daily volume = Σ count × EPS × event size × 86,400. Hot storage = daily volume × hot days × storage ratio × copies; archive = daily volume × remaining days ÷ compression.
Example
Servers, firewalls, workstations and a proxy at 1,140 events per second produce about 72 GB a day and need about 7.3 TB for one year with 30 days hot.
Questions about Log & SIEM Storage Calculator
Is Log & SIEM Storage Calculator free, and do I need an account?
Yes. This tool is free to use in your browser without an account. Processing takes place on your device.
What are the limits and what should I check?
Example rates only; measure your own sources. Licence models (EPS, GB/day, per asset) differ between products. Everything is calculated in your browser; nothing is sent or probed on the network. Review the result before using it in your work.
Is my input sent to a server?
Your input is processed in your browser and is not uploaded by this tool. Files and pasted text are cleared when the page is refreshed. Normal website requests are still required to load the page and its libraries. Read the privacy explanation.