Skip to content
ENExplore Calculators

Syslog Growth Calculator

Project syslog volume and retained storage from device count, message rate, size and compression.

About Syslog Growth Calculator

Log volume is a straight product of event rate, message size and time. Compression applies only to data at rest, so the ingest path still has to carry the raw rate even when the disks hold an eighth of it. Log storage is usually the first budget line to blow out on a SIEM project, and licensing is often billed per EPS or per GB per day — the two numbers this produces.

Formula

Syslog Growth

retained bytes = EPS × 86400 × average message size × retention days ÷ compression ratio.

86400
Seconds in a day
EPS
Events per second across all devices
compression ratio
Typical 8–12× for text logs at rest

Worked example

With the default values below, Syslog Growth Calculator returns Retained Storage Required of 113 GiB. Change any input above and every figure here is recalculated in your browser.

Inputs used

Logging devicesminimum 1 devices
300 devices
Messages per device per secondminimum 0.001 msg/s
5 msg/s
Average message sizeminimum 16 bytes
250 bytes
Retention periodminimum 1 days
30 days
Compression ratioaccepts 1–50 ×
8 ×

Results

Retained Storage Required
113 GiB
Events Per Second
1,500 EPS
Raw Volume Per Day
30 GiB
Compressed Volume Per Day
4 GiB
Retained Storage Required
0.111 TB

Step by step

  1. 1Values used
  2. 2Syslog Growth
  3. 3Retained Storage Required= 121,500,000,000
  4. 4Events Per Second= 1,500 EPS
  5. 5Raw Volume Per Day= 32,400,000,000
  6. 6Compressed Volume Per Day= 4,050,000,000
  7. 7Retained Storage Required= 0.111 TB

Assumptions and limits

  • The result is derived only from the 5 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax or fees or charges into account.
  • Figures are rounded for display to 3 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Syslog Growth calculated?

retained bytes = EPS × 86400 × average message size × retention days ÷ compression ratio. Log volume is a straight product of event rate, message size and time. Compression applies only to data at rest, so the ingest path still has to carry the raw rate even when the disks hold an eighth of it.

Why does Syslog Growth matter?

Log storage is usually the first budget line to blow out on a SIEM project, and licensing is often billed per EPS or per GB per day — the two numbers this produces.

What values do I need to enter?

This calculator takes 5 inputs: Logging devices, Messages per device per second, Average message size, Retention period, Compression ratio. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Related Calculators

Syslog Growth Calculator | Calcrivo