Measured event size · Linux/Unix host
Redhat Linux log size: 150 bytes per event
The average Redhat Linux event is 150 bytes, measured from samples of its logs. A Linux or Unix host source typically produces 30 events per second per device, bursting to 300: auditd rules decide this. The rate is an informed estimate; the size is measured.
What that comes to
One device, raw bytes, at the typical rate for a Linux or Unix host source.
| Period | At 30 events/s | At the 300 events/s burst |
|---|---|---|
| An hour | 16.2 MB | 162 MB |
| A day | 389 MB | 3.9 GB |
| 90 days | 35 GB | 350 GB |
| A year | 142 GB | 1.4 TB |
A day of Redhat Linux logs from one device at the category's typical rate, 389 MB, is about 5 times an hour of Spotify.
Size your own
Raw bytes, before compression, indexing overhead and replication.
Measure a sample of your own
The figure above is an average; yours will differ, and for Redhat Linux what moves it most is this: auditd rules decide this. The profiler reads a sample from Redhat Linux in your browser, line by line, one event per line, and reports the bytes per line to set against it. Nothing is uploaded.
Other Linux or Unix host sources
- Infoblox200 B
The Linux or Unix host category: its typical rate and every source in it →
Logcaliper, free on iOS, has these sizes and rates built in and sizes a whole list of sources at retention: storage, cluster capacity, nodes.