Audit Log Growth Calculator
Estimate auditd log growth rate and storage needs based on audit rule verbosity.
About Audit Log Growth Calculator
auditd's audit.log grows in direct proportion to the rate of audited events and each event's serialized size — a busy system with broad audit rules (file watches, syscall auditing, SELinux/AppArmor denials) can generate a meaningful sustained event rate. Daily growth is events/sec × average bytes per event × seconds/day; comparing that to auditd's `max_log_file` and `num_logs` settings (or `max_log_file_action = ROTATE`) shows how many rotated files are needed to cover a compliance-driven retention period (e.g. PCI-DSS commonly requires 90 days readily available, one year total).
Formula
Daily growth
growth_per_day = events_per_sec × avg_event_size_bytes × 86400
- e
- events per second
- s
- average event size (bytes)
Worked example
With the default values below, Audit Log Growth Calculator returns Log Growth per Day of 103 MB. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Audit Events per Secondminimum 0
- 5
- Average Event Size (bytes)minimum 1
- 250
- Retention Period (days)minimum 1
- 90
- auditd max_log_file (MB)minimum 1
- 50
Results
- Log Growth per Day
- 103 MB
- Total Storage for Retention Period
- 9.05 GB
- Growth per Day (MB)
- 103.00
- Total Storage (GB)
- 9.05
- Rotated Log Files Needed for Retention
- 186
Step by step
- 1Values used
- 2Daily growth
- 3Log Growth per Day= 103 MB
- 4Total Storage for Retention Period= 9.05 GB
- 5Growth per Day (MB)= 103.00
- 6Total Storage (GB)= 9.05
- 7Rotated Log Files Needed for Retention= 186
Assumptions and limits
- The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax or fees or charges into account.
- Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How do I check the current audit event rate on a live system?
`ausearch --input-logs -ts today | wc -l` gives today's event count so far, or watch live throughput with `auditctl -s` for kernel-level backlog/rate statistics while tailing `/var/log/audit/audit.log` growth with `du -sh`.
What happens when auditd's log storage fills up?
Behavior depends on `admin_space_left_action` and `disk_full_action` in auditd.conf — options range from rotating/ignoring to (in high-security configurations) halting the system entirely (`disk_full_action = halt`) to guarantee no auditable events go unrecorded, so undersizing retention capacity can cause an unexpected system halt.
How can I reduce audit log growth without losing important events?
Narrow audit rules with `-a always,exit -F arch=... -S <specific syscalls> -F key=...` and exclude high-frequency, low-value paths (e.g. use `-a exclude` for noisy syscalls) rather than blanket `-a always,exit -S all`, and route logs to a remote SIEM via `audisp-remote` so local retention can be shorter.