Typical event rate · category

Servers log rate: 30 events/s per device

A server source typically produces 30 events per second per device, bursting to 250: generic appliance OS, no process auditing. The rate is an informed estimate, a starting point for a sizing, not a measurement; the event sizes below are measured.

Measured sources in this category

Average bytes per event, measured, and one device's volume at the typical 30 events per second.

At the median size, a day from one device, 1.4 GB, is about 2 times a CD-ROM.

Size a fleet

Raw bytes, before compression, indexing overhead and replication.

Measure a sample of your own

The figure above is an average; yours will differ, and for server logs what moves it most is this: generic appliance OS, no process auditing. The profiler reads a sample from server logs in your browser, line by line, one event per line, and reports the bytes per line to set against it. Nothing is uploaded.