Measured event size · Firewall
Checkpoint FW log size: 200 bytes per event
The average Checkpoint FW event is 200 bytes, measured from samples of its logs. A firewall source typically produces 600 events per second per device, bursting to 3,000: per appliance; TLS inspection multiplies it. The rate is an informed estimate; the size is measured.
What that comes to
One device, raw bytes, at the typical rate for a firewall source.
| Period | At 600 events/s | At the 3,000 events/s burst |
|---|---|---|
| An hour | 432 MB | 2.2 GB |
| A day | 10.4 GB | 51.8 GB |
| 90 days | 933 GB | 4.7 TB |
| A year | 3.8 TB | 18.9 TB |
A day of Checkpoint FW logs from one device at the category's typical rate, 10.4 GB, is about 2 times an hour of YouTube in 4K.
Size your own
Raw bytes, before compression, indexing overhead and replication.
Measure a sample of your own
The figure above is an average; yours will differ, and for Checkpoint FW what moves it most is this: per appliance; TLS inspection multiplies it. The profiler reads a sample from Checkpoint FW in your browser, line by line, one event per line, and reports the bytes per line to set against it. Nothing is uploaded.
Other firewall sources
- Palo Alto Firewall734 B
- Forcepoint Firewall561 B
- PaloAlto Networks OS348 B
The firewall category: its typical rate and every source in it →
Logcaliper, free on iOS, has these sizes and rates built in and sizes a whole list of sources at retention: storage, cluster capacity, nodes.