Skip to content
ENExplore Calculators

SIEM Events Per Second Calculator

Work out siem events per second instantly with clear inputs, formula shown and shareable results.

About SIEM Events Per Second Calculator

SIEM sizing starts from events per second by source class, because a workstation generates well under one event per second while a firewall or proxy generates tens. Peaks matter more than averages: incident response, mass authentication failures and scanning bursts routinely produce three times the baseline, and licensing to the average guarantees dropped events exactly when they are needed.

Formula

EPS sizing

average EPS = hosts x host EPS + network devices x network EPS; peak ~ 3 x average; licence to peak x 1.2

Worked example

With the default values below, SIEM Events Per Second Calculator returns Average events per second of 6,500. Change any input above and every figure here is recalculated in your browser.

Inputs used

Servers and workstationsminimum 1
2,500
Events per device per secondminimum 0.001 eps
0.8 eps
Network and security devicesminimum 0
180
Events per network device per secondminimum 0.001 eps
25 eps

Results

Average events per second
6,500 eps
Peak events per second
19,500 eps
Events per day
561,600,000
Recommended licensed capacity
23,400 eps

Step by step

  1. 1Values used
  2. 2EPS sizing
  3. 3Average events per second= 6,500 eps
  4. 4Peak events per second= 19,500 eps
  5. 5Events per day= 561,600,000
  6. 6Recommended licensed capacity= 23,400 eps

Assumptions and limits

  • The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to whole numbers, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

Why is the peak factor around three?

Authentication storms, malware outbreaks and vulnerability scans all multiply log rates simultaneously. Measured peak-to-average ratios of 2 to 5 are common in enterprise estates.

What generates the most events?

Firewall and proxy connection logs, followed by endpoint process telemetry and DNS. Filtering at the source is usually more effective than buying more capacity.

Related Calculators

SIEM Events Per Second Calculator | Calcrivo