Measured event size · Network flows

Cisco Netflow v9 log size: 814 bytes per event

The average Cisco Netflow v9 event is 814 bytes, measured from samples of its logs. A network flow source typically produces 2,000 events per second per device, bursting to 10,000: unsampled; 1:1000 sampling is 1000x lower. The rate is an informed estimate; the size is measured.

814 B
per event, measured
2,000
events per second, typical
141 GB
per device per day
51.3 TB
per device per year

What that comes to

One device, raw bytes, at the typical rate for a network flow source.

PeriodAt 2,000 events/sAt the 10,000 events/s burst
An hour5.9 GB29.3 GB
A day141 GB703 GB
90 days12.7 TB63.3 TB
A year51.3 TB257 TB

A day of Cisco Netflow v9 logs from one device at the category's typical rate, 141 GB, is about the size of a 70B model’s weights.

Size your own

2,000
events per second
141 GB
per day
12.7 TB
at retention

Raw bytes, before compression, indexing overhead and replication.

Measure a sample of your own

The figure above is an average; yours will differ, and for Cisco Netflow v9 what moves it most is this: unsampled; 1:1000 sampling is 1000x lower. The profiler reads a sample from Cisco Netflow v9 in your browser, line by line, one event per line, and reports the bytes per line to set against it. Nothing is uploaded.

Other network flow sources

The network flow category: its typical rate and every source in it →

Logcaliper, free on iOS, has these sizes and rates built in and sizes a whole list of sources at retention: storage, cluster capacity, nodes.