Work out syslog volume instantly with clear inputs, formula shown and shareable results.
Syslog volume is devices times message rate times message size, and text logs compress extremely well — 8:1 or better is typical because of repeated hostnames, timestamps and message templates. Sizing on the compressed figure for archival and the uncompressed figure for the searchable tier is what keeps a year of retention affordable.
Syslog volume
messages per second = devices x per-minute rate / 60; daily bytes = rate x message size x 86400; retained = daily x days / compression ratio
TCP or TLS for anything you must not lose, since UDP silently drops under congestion. UDP survives receiver outages without blocking the sender, which is why it persists on network gear.
Firewall connection logging and authentication events. Filtering at the device, or forwarding only selected facilities and severities, cuts volume dramatically.