Skip to content
ENExplore Calculators

Cloud Logging Coverage Calculator

Score security log coverage from onboarded sources, critical source coverage and retention against requirement, with ingest and storage cost.

About Cloud Logging Coverage Calculator

Coverage is weighted rather than counted because sources are not equal: identity, control-plane and network logs answer incident questions that application debug logs never will, so critical-source coverage carries 60% of the coverage component. Retention is folded in at 30% because logs you no longer hold are indistinguishable from logs you never collected. Every incident review ends with the same sentence — 'we do not have logs for that' — and the fix is cheap in advance and impossible afterwards, because logging is never retroactive.

Formulas

Cloud Logging Coverage

Coverage score = (critical source coverage × 0.6 + all-source coverage × 0.4) × 0.7 + retention compliance × 0.3, where retention compliance = min(100, current ÷ required × 100).

criticalCoverage
Security-critical sources onboarded ÷ security-critical sources × 100
weightedCoverage
Blend of critical and overall source coverage
retentionCompliance
Current retention as a share of the required period

Ingest and retention cost

Monthly cost = GB/day × 30 × ingest price + GB/day × retention days × storage price per GB per month.

monthlyIngestCost
Charge for taking the data in
storageCostMonthly
Charge for keeping the retained window online

Worked example

With the default values below, Cloud Logging Coverage Calculator returns Logging Coverage Score of 64.1. Change any input above and every figure here is recalculated in your browser.

Inputs used

Distinct log sources in the estateaccepts 1–5,000 sources
46 sources
Sources onboarded to the SIEMaccepts 0–5,000 sources
34 sources
Sources classified as security-criticalaccepts 0–5,000 sources
14 sources
Security-critical sources onboardedaccepts 0–5,000 sources
12 sources
Current hot retentionaccepts 1–3,650 days
90 days
Required retentionaccepts 1–3,650 days
365 days
Log volume ingestedaccepts 0–1,000,000 GB/day
240 GB/day
Ingest price per GBaccepts 0–100 USD
0.5 USD
Retained storage price per GB per monthaccepts 0–100 USD
0.03 USD

Results

Logging Coverage Score
64.1 / 100
Grade
C — Fair
Source Coverage
73.9%
Critical Source Coverage
85.7%
Retention Compliance
24.7%
Sources Not Onboarded
12 sources
Monthly Logging Cost
$4,248.00
Monthly Storage at Required Retention
$2,628.00
Verdict
Onboard the missing security-critical sources first — they carry 60% of the coverage weight for a reason

Step by step

  1. 1Values used
  2. 2Cloud Logging Coverage
  3. 3Ingest and retention cost
  4. 4Logging Coverage Score= 64.1 / 100
  5. 5Grade= C — Fair
  6. 6Source Coverage= 73.9
  7. 7Critical Source Coverage= 85.7
  8. 8Retention Compliance= 24.7
  9. 9Sources Not Onboarded= 12 sources

Assumptions and limits

  • The result is derived only from the 9 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Cloud Logging Coverage calculated?

Coverage score = (critical source coverage × 0.6 + all-source coverage × 0.4) × 0.7 + retention compliance × 0.3, where retention compliance = min(100, current ÷ required × 100). Coverage is weighted rather than counted because sources are not equal: identity, control-plane and network logs answer incident questions that application debug logs never will, so critical-source coverage carries 60% of the coverage component. Retention is folded in at 30% because logs you no longer hold are indistinguishable from logs you never collected.

Why does Cloud Logging Coverage matter?

Every incident review ends with the same sentence — 'we do not have logs for that' — and the fix is cheap in advance and impossible afterwards, because logging is never retroactive.

What values do I need to enter?

This calculator takes 9 inputs: Distinct log sources in the estate, Sources onboarded to the SIEM, Sources classified as security-critical, Security-critical sources onboarded, Current hot retention, Required retention, Log volume ingested, Ingest price per GB, Retained storage price per GB per month. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Is more log volume better?

No. Volume is a cost, coverage is the control. Ingesting a terabyte a day of application debug logs while the identity provider and the cloud control plane are not onboarded is the common and expensive failure. Get the critical sources in first, then trim volume from the noisy ones.

How should I handle a long retention requirement?

Tier it. Keep 30 to 90 days hot and searchable for detection and triage, then push the remainder to object storage with a query-on-demand engine. That typically cuts the cost of a one-year requirement by an order of magnitude while still satisfying the auditor.

Related Calculators

Cloud Logging Coverage Calculator | Calcrivo