Measured event size · Firewall
Palo Alto Firewall log size: 734 bytes per event
The average Palo Alto Firewall event is 734 bytes, measured from samples of its logs. A firewall source typically produces 600 events per second per device, bursting to 3,000: per appliance; TLS inspection multiplies it. The rate is an informed estimate; the size is measured.
What that comes to
One device, raw bytes, at the typical rate for a firewall source.
| Period | At 600 events/s | At the 3,000 events/s burst |
|---|---|---|
| An hour | 1.6 GB | 7.9 GB |
| A day | 38.1 GB | 190 GB |
| 90 days | 3.4 TB | 17.1 TB |
| A year | 13.9 TB | 69.4 TB |
A day of Palo Alto Firewall logs from one device at the category's typical rate, 38.1 GB, is about the size of Fortnite on PC.
Size your own
Raw bytes, before compression, indexing overhead and replication.
Measure a sample of your own
The figure above is an average; yours will differ, and for Palo Alto Firewall what moves it most is this: per appliance; TLS inspection multiplies it. The profiler reads a sample from Palo Alto Firewall in your browser, line by line, one event per line, and reports the bytes per line to set against it. Nothing is uploaded.
Other firewall sources
- Forcepoint Firewall561 B
- PaloAlto Networks OS348 B
- Checkpoint FW200 B
The firewall category: its typical rate and every source in it →
Logcaliper, free on iOS, has these sizes and rates built in and sizes a whole list of sources at retention: storage, cluster capacity, nodes.