Syslog Growth Calculator
Project syslog volume and retained storage from device count, message rate, size and compression.
Inputs
Retained Storage Required
113 GiB
Events Per Second
1,500EPS
Raw Volume Per Day
30 GiB
Compressed Volume Per Day
4 GiB
Retained Storage Required
0.111TB
Step by step
Values used
Logging devices = 300 devices; Messages per device per second = 5 msg/s; Average message size = 250 bytes; Retention period = 30 days; Compression ratio = 8 ×
Syslog Growth
retained bytes = EPS × 86400 × average message size × retention days ÷ compression ratio.
Retained Storage Required
= 121,500,000,000
Events Per Second
= 1,500 EPS
Raw Volume Per Day
= 32,400,000,000
Compressed Volume Per Day
= 4,050,000,000
Retained Storage Required
= 0.111 TB
How it works
Log volume is a straight product of event rate, message size and time. Compression applies only to data at rest, so the ingest path still has to carry the raw rate even when the disks hold an eighth of it. Log storage is usually the first budget line to blow out on a SIEM project, and licensing is often billed per EPS or per GB per day — the two numbers this produces.
Formula
Syslog Growth
retained bytes = EPS × 86400 × average message size × retention days ÷ compression ratio.
- 86400
- Seconds in a day
- EPS
- Events per second across all devices
- compression ratio
- Typical 8–12× for text logs at rest
Frequently Asked Questions
How is Syslog Growth calculated?
retained bytes = EPS × 86400 × average message size × retention days ÷ compression ratio. Log volume is a straight product of event rate, message size and time. Compression applies only to data at rest, so the ingest path still has to carry the raw rate even when the disks hold an eighth of it.
Why does Syslog Growth matter?
Log storage is usually the first budget line to blow out on a SIEM project, and licensing is often billed per EPS or per GB per day — the two numbers this produces.
What values do I need to enter?
This calculator takes 5 inputs: Logging devices, Messages per device per second, Average message size, Retention period, Compression ratio. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
You might also need
- NetFlow Storage CalculatorCommonly used together
- SNMP Polling CalculatorCommonly used together
- IPFIX Storage CalculatorCommonly used together
- NTP Drift CalculatorCommonly used together
- Infrastructure Services Health Score CalculatorAlso in DNS & Network Services
- mDNS CalculatorAlso in DNS & Network Services