Measured event size · SIEM
Unified Data Model log size: 1,236 bytes per event
The average Unified Data Model event is 1,236 bytes, measured from samples of its logs. A SIEM source typically produces 10,000 events per second per device, bursting to 50,000: a normalised feed from another platform. The rate is an informed estimate; the size is measured.
What that comes to
One device, raw bytes, at the typical rate for a SIEM source.
| Period | At 10,000 events/s | At the 50,000 events/s burst |
|---|---|---|
| An hour | 44.5 GB | 222 GB |
| A day | 1.1 TB | 5.3 TB |
| 90 days | 96.1 TB | 481 TB |
| A year | 390 TB | 1.9 PB |
A day of Unified Data Model logs from one device at the category's typical rate, 1.1 TB, is about the size of a PlayStation 5's drive.
Size your own
Raw bytes, before compression, indexing overhead and replication.
Measure a sample of your own
The figure above is an average; yours will differ, and for Unified Data Model what moves it most is this: a normalised feed from another platform. The profiler reads a sample from Unified Data Model in your browser, line by line, one event per line, and reports the bytes per line to set against it. Nothing is uploaded.
Other SIEM sources
- Stellar Cyber Interflow1,000 B
The SIEM category: its typical rate and every source in it →
Logcaliper, free on iOS, has these sizes and rates built in and sizes a whole list of sources at retention: storage, cluster capacity, nodes.