Cloud Logging Coverage Calculator

Coverage score = (critical source coverage × 0.6 + all-source coverage × 0.4) × 0.7 + retention compliance × 0.3, where retention compliance = min(100, current ÷ required × 100). Coverage is weighted rather than counted because sources are not equal: identity, control-plane and network logs answer incident questions that application debug logs never will, so critical-source coverage carries 60% of the coverage component. Retention is folded in at 30% because logs you no longer hold are indistinguishable from logs you never collected.

Every incident review ends with the same sentence — 'we do not have logs for that' — and the fix is cheap in advance and impossible afterwards, because logging is never retroactive.

This calculator takes 9 inputs: Distinct log sources in the estate, Sources onboarded to the SIEM, Sources classified as security-critical, Security-critical sources onboarded, Current hot retention, Required retention, Log volume ingested, Ingest price per GB, Retained storage price per GB per month. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

No. Volume is a cost, coverage is the control. Ingesting a terabyte a day of application debug logs while the identity provider and the cloud control plane are not onboarded is the common and expensive failure. Get the critical sources in first, then trim volume from the noisy ones.

Tier it. Keep 30 to 90 days hot and searchable for detection and triage, then push the remainder to object storage with a query-on-demand engine. That typically cuts the cost of a one-year requirement by an order of magnitude while still satisfying the auditor.