Typical event rate · category

Linux/Unix host log rate: 30 events/s per device

A Linux or Unix host source typically produces 30 events per second per device, bursting to 300: auditd rules decide this. The rate is an informed estimate, a starting point for a sizing, not a measurement; the event sizes below are measured.

Measured sources in this category

Average bytes per event, measured, and one device's volume at the typical 30 events per second.

At the median size, a day from one device, 454 MB, is about 6 times an hour of Spotify.

Size a fleet

Raw bytes, before compression, indexing overhead and replication.

Measure a sample of your own

The figure above is an average; yours will differ, and for Linux or Unix host logs what moves it most is this: auditd rules decide this. The profiler reads a sample from Linux or Unix host logs in your browser, line by line, one event per line, and reports the bytes per line to set against it. Nothing is uploaded.