Typical event rate · category

Proxy log rate: 600 events/s per device

A proxy source typically produces 600 events per second per device, bursting to 3,000: one record per HTTP request, tracks user count. The rate is an informed estimate, a starting point for a sizing, not a measurement; the event sizes below are measured.

600
events per second, typical
3,000
at the burst
1,446 B
median event size, 2 sources
74.9 GB
per device per day

Measured sources in this category

Average bytes per event, measured, and one device's volume at the typical 600 events per second.

SourceBytes per eventA dayA year
Netskope Alert2,591134 GB49 TB
Bluecoat30015.6 GB5.7 TB

At the median size, a day from one device, 74.9 GB, is about the size of a day of James Webb data.

Size a fleet

6,000
events per second
750 GB
per day
67.5 TB
at retention

Raw bytes, before compression, indexing overhead and replication.

Measure a sample of your own

The figure above is an average; yours will differ, and for proxy logs what moves it most is this: one record per HTTP request, tracks user count. The profiler reads a sample from proxy logs in your browser, line by line, one event per line, and reports the bytes per line to set against it. Nothing is uploaded.

Logcaliper, free on iOS, has these sizes and rates built in and sizes a whole list of sources at retention: storage, cluster capacity, nodes.