Measured event size · IDS/IPS
Snort log size: 200 bytes per event
The average Snort event is 200 bytes, measured from samples of its logs. An IDS/IPS source typically produces 200 events per second per device, bursting to 2,000: alert-only sensors far lower, Zeek/Suricata far higher. The rate is an informed estimate; the size is measured.
What that comes to
One device, raw bytes, at the typical rate for an IDS/IPS source.
| Period | At 200 events/s | At the 2,000 events/s burst |
|---|---|---|
| An hour | 144 MB | 1.4 GB |
| A day | 3.5 GB | 34.6 GB |
| 90 days | 311 GB | 3.1 TB |
| A year | 1.3 TB | 12.6 TB |
A day of Snort logs from one device at the category's typical rate, 3.5 GB, is about the size of an hour of Netflix in HD.
Size your own
Raw bytes, before compression, indexing overhead and replication.
Measure a sample of your own
The figure above is an average; yours will differ, and for Snort what moves it most is this: alert-only sensors far lower, Zeek/Suricata far higher. The profiler reads a sample from Snort in your browser, line by line, one event per line, and reports the bytes per line to set against it. Nothing is uploaded.
Other IDS/IPS sources
- Zeek IDS150 B
The IDS/IPS category: its typical rate and every source in it →
Logcaliper, free on iOS, has these sizes and rates built in and sizes a whole list of sources at retention: storage, cluster capacity, nodes.