Syslog Volume Calculator

Work out syslog volume instantly with clear inputs, formula shown and shareable results.

About Syslog Volume Calculator

Syslog volume is devices times message rate times message size, and text logs compress extremely well — 8:1 or better is typical because of repeated hostnames, timestamps and message templates. Sizing on the compressed figure for archival and the uncompressed figure for the searchable tier is what keeps a year of retention affordable.

Formula

Syslog volume

messages per second = devices x per-minute rate / 60; daily bytes = rate x message size x 86400; retained = daily x days / compression ratio

Worked example

With the default values below, Syslog Volume Calculator returns Storage required at 8:1 compression of 264.33 GiB. Change any input above and every figure here is recalculated in your browser.

Inputs used

Devices sending syslogminimum 1: 900
Messages per device per minuteminimum 0.001: 15
Average message sizeminimum 1 bytes: 320 bytes
Retentionminimum 1 days: 365 days

Results

Storage required at 8:1 compression: 264.33 GiB
Message rate: 225.0 msg/s
Daily volume: 5.79 GiB
Uncompressed retained volume: 2.07 TiB

Step by step

1Values used
2Syslog volume
3Storage required at 8:1 compression= 283,824,000,000
4Message rate= 225.0 msg/s
5Daily volume= 6,220,800,000
6Uncompressed retained volume= 2,270,592,000,000

Assumptions and limits

The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

Should syslog use UDP or TCP?

TCP or TLS for anything you must not lose, since UDP silently drops under congestion. UDP survives receiver outages without blocking the sender, which is why it persists on network gear.

What generates the most syslog volume?

Firewall connection logging and authentication events. Filtering at the device, or forwarding only selected facilities and severities, cuts volume dramatically.