Measured event size · AD/Domain controller
Active Directory log size: 300 bytes per event
The average Active Directory event is 300 bytes, measured from samples of its logs. A domain controller source typically produces 500 events per second per device, bursting to 3,000: Kerberos tickets; ~40/sec per 1,000 users. The rate is an informed estimate; the size is measured.
What that comes to
One device, raw bytes, at the typical rate for a domain controller source.
| Period | At 500 events/s | At the 3,000 events/s burst |
|---|---|---|
| An hour | 540 MB | 3.2 GB |
| A day | 13 GB | 77.8 GB |
| 90 days | 1.2 TB | 7 TB |
| A year | 4.7 TB | 28.4 TB |
A day of Active Directory logs from one device at the category's typical rate, 13 GB, is about 2 times an hour of YouTube in 4K.
Size your own
Raw bytes, before compression, indexing overhead and replication.
Measure a sample of your own
The figure above is an average; yours will differ, and for Active Directory what moves it most is this: Kerberos tickets; ~40/sec per 1,000 users. The profiler reads a sample from Active Directory in your browser, line by line, one event per line, and reports the bytes per line to set against it. Nothing is uploaded.
The domain controller category: its typical rate and every source in it →
Logcaliper, free on iOS, has these sizes and rates built in and sizes a whole list of sources at retention: storage, cluster capacity, nodes.