Project syslog volume and retained storage from device count, message rate, size and compression.
Log volume is a straight product of event rate, message size and time. Compression applies only to data at rest, so the ingest path still has to carry the raw rate even when the disks hold an eighth of it. Log storage is usually the first budget line to blow out on a SIEM project, and licensing is often billed per EPS or per GB per day — the two numbers this produces.
Syslog Growth
retained bytes = EPS × 86400 × average message size × retention days ÷ compression ratio.
retained bytes = EPS × 86400 × average message size × retention days ÷ compression ratio. Log volume is a straight product of event rate, message size and time. Compression applies only to data at rest, so the ingest path still has to carry the raw rate even when the disks hold an eighth of it.
Log storage is usually the first budget line to blow out on a SIEM project, and licensing is often billed per EPS or per GB per day — the two numbers this produces.
This calculator takes 5 inputs: Logging devices, Messages per device per second, Average message size, Retention period, Compression ratio. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.