Typical event rate · category
AD/Domain controller log rate: 500 events/s per device
A domain controller source typically produces 500 events per second per device, bursting to 3,000: Kerberos tickets; ~40/sec per 1,000 users. The rate is an informed estimate, a starting point for a sizing, not a measurement; the event sizes below are measured.
Measured sources in this category
Average bytes per event, measured, and one device's volume at the typical 500 events per second.
| Source | Bytes per event | A day | A year |
|---|---|---|---|
| Active Directory | 300 | 13 GB | 4.7 TB |
At the median size, a day from one device, 13 GB, is about 2 times an hour of YouTube in 4K.
Size a fleet
Raw bytes, before compression, indexing overhead and replication.
Measure a sample of your own
The figure above is an average; yours will differ, and for domain controller logs what moves it most is this: Kerberos tickets; ~40/sec per 1,000 users. The profiler reads a sample from domain controller logs in your browser, line by line, one event per line, and reports the bytes per line to set against it. Nothing is uploaded.
Logcaliper, free on iOS, has these sizes and rates built in and sizes a whole list of sources at retention: storage, cluster capacity, nodes.