Typical event rate · category

IDS/IPS log rate: 200 events/s per device

An IDS/IPS source typically produces 200 events per second per device, bursting to 2,000: alert-only sensors far lower, Zeek/Suricata far higher. The rate is an informed estimate, a starting point for a sizing, not a measurement; the event sizes below are measured.

Measured sources in this category

Average bytes per event, measured, and one device's volume at the typical 200 events per second.

At the median size, a day from one device, 3 GB, is about the size of an hour of Netflix in HD.

Size a fleet

Raw bytes, before compression, indexing overhead and replication.

Measure a sample of your own

The figure above is an average; yours will differ, and for IDS/IPS logs what moves it most is this: alert-only sensors far lower, Zeek/Suricata far higher. The profiler reads a sample from IDS/IPS logs in your browser, line by line, one event per line, and reports the bytes per line to set against it. Nothing is uploaded.