The catalogue
Measured log event sizes, 2026
The 39 average event sizes Logcaliper ships, measured from more than ten million log events, and the typical event rates for 16 source categories. The sizes are measured; the rates are informed estimates, and every page says what drives them. Each source has its own page with a worked day and year, a calculator, and the profiler for measuring your own sample.
Take the data: the CSV, under CC BY 4.0, which asks for a link back to this page. Every row carries its page's address.
Average bytes per event, measured; and one device's day at the category's typical rate, raw.
Typical event rates, by category
Events per second per device: the typical figure, the burst, and what decides it. Estimates, not measurements.
| Category | Typical | Burst | What drives it |
|---|---|---|---|
| SIEM | 10,000 | 50,000 | a normalised feed from another platform |
| Network flows | 2,000 | 10,000 | unsampled; 1:1000 sampling is 1000x lower |
| Firewall | 600 | 3,000 | per appliance; TLS inspection multiplies it |
| Proxy | 600 | 3,000 | one record per HTTP request, tracks user count |
| AD/Domain controller | 500 | 3,000 | Kerberos tickets; ~40/sec per 1,000 users |
| IDS/IPS | 200 | 2,000 | alert-only sensors far lower, Zeek/Suricata far higher |
| Database | 100 | 1,000 | audit policy decides this, not workload |
| Application | 100 | 1,000 | web access logs high, service audit trails low |
| Distributed system | 100 | 1,000 | per node at INFO; log level is the lever |
| Windows servers | 50 | 300 | assumes 4688 plus Sysmon |
| Servers | 30 | 250 | generic appliance OS, no process auditing |
| Linux/Unix host | 30 | 300 | auditd rules decide this |
| Router | 15 | 200 | control plane only; ACL logging is the swing |
| Managed endpoint | 10 | 100 | detections only is far lower, full telemetry far higher |
| Windows workstation | 5 | 50 | assumes Sysmon; raw EDR telemetry is 10x |
| Network switch | 3 | 50 | link state and 802.1X only |
How the sizes were measured
Each figure is the average byte length of the events in log samples of that product, as a collector receives them, more than ten million events in all; some figures are rounded. An average is a starting point: the audit level and which fields are kept move it by a factor of two or more either way, which is what the profiler is for. The rates are what one device of the kind usually produces, with the condition that moves the figure most named beside it; they are the figure Logcaliper starts a sizing from.
Measure a sample of your own
The profiler reads a sample log in your browser, line by line, and reports the bytes per line to set against these averages. Nothing is uploaded.
Logcaliper, free on iOS, has these sizes and rates built in and sizes a whole list of sources at retention: storage, cluster capacity, nodes.