Typical event rate · category

Network flows log rate: 2,000 events/s per device

A network flow source typically produces 2,000 events per second per device, bursting to 10,000: unsampled; 1:1000 sampling is 1000x lower. The rate is an informed estimate, a starting point for a sizing, not a measurement; the event sizes below are measured.

Measured sources in this category

Average bytes per event, measured, and one device's volume at the typical 2,000 events per second.

At the median size, a day from one device, 142 GB, is about the size of a 70B model’s weights.

Size a fleet

Raw bytes, before compression, indexing overhead and replication.

Measure a sample of your own

The figure above is an average; yours will differ, and for network flow logs what moves it most is this: unsampled; 1:1000 sampling is 1000x lower. The profiler reads a sample from network flow logs in your browser, line by line, one event per line, and reports the bytes per line to set against it. Nothing is uploaded.